This vulnerability affects Oracle PeopleSoft Enterprise CS Campus Community version 9.2.38 and involves the security component. It requires the attacker to have physical access to the communication segment connected to the hardware where the software executes. Exploitation can lead to unauthorized access to critical or all accessible data and unauthorized modification of some data. The CVSS vector indicates the attack vector is adjacent network (AV:A), with high attack complexity (AC:H), no privileges required (PR:N), no user interaction (UI:N), unchanged scope (S:U), high confidentiality impact (C:H), low integrity impact (I:L), and no availability impact (A:N). No official patch or remediation level is stated in the vendor advisory. Oracle's July 2026 Critical Patch Update advisory does not explicitly mention a patch for this specific vulnerability, and patch availability is not confirmed.

Successful exploitation can result in unauthorized access to critical and potentially all accessible data within PeopleSoft Enterprise CS Campus Community 9.2.38. Additionally, it may allow unauthorized update, insert, or delete operations on some data. The confidentiality impact is high, integrity impact is low, and availability is not affected. Exploitation requires physical access to the communication segment, making it difficult to exploit.

Patch status is not yet confirmed — check the Oracle advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle strongly recommends applying security patches promptly when available and remaining on actively supported versions. Since exploitation requires physical access to the communication segment, restricting physical access and network segmentation may reduce risk. No official fix or temporary mitigation is currently documented for this vulnerability.