Peoplesoft Enterprise Campus Software Campus Community
Monthly
Unauthenticated data compromise in Oracle PeopleSoft Enterprise CS Campus Community 9.2.38 (Security component) lets remote attackers reach the application over HTTP and read all data the module can access, with limited unauthorized insert/update/delete on some data. Vendor and community tags flag this as an authentication bypass, aligning with the PR:N (no privileges) CVSS vector. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but Oracle rates it 'easily exploitable' with a CVSS 3.1 base score of 8.2.
Data manipulation and denial-of-service in Oracle PeopleSoft Enterprise CS Campus Community 9.2.38 (Person Data component) lets a low-privileged, network-authenticated attacker create, delete or modify critical data, read a subset of accessible data, and trigger a repeatable crash of the module. The flaw carries a CVSS 3.1 base score of 7.1 and is flagged as difficult to exploit (AC:H). No public exploit has been identified at time of analysis, and it is not listed in CISA KEV.
Unauthorized data disclosure in Oracle PeopleSoft Enterprise CS Student Records 9.2.38 (Higher Ed Statistics Agency - UK HESA component) lets a remote, unauthenticated attacker reach all data accessible to the Student Records module over HTTP. The flaw is easily exploitable per Oracle and, tagged as an authentication bypass, yields high confidentiality impact with no integrity or availability effect (CVSS 3.1 7.5). No public exploit identified at time of analysis and it is not listed in CISA KEV; EPSS data was not provided.
Full takeover of Oracle PeopleSoft Enterprise CS Campus Community 9.2.38 is possible for a low-privileged attacker with network (HTTP) access to the Security component, resulting in high confidentiality, integrity and availability impact. Oracle rates this CVSS 3.1 7.5 but flags it as difficult to exploit (AC:H), and it requires an authenticated (low-privilege) session. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; the fix ships in Oracle's July 2026 Critical Patch Update.
Privilege-escalating takeover of Oracle PeopleSoft Enterprise CS Student Records (Campus Solutions) 9.2.38, specifically the Australian Features component, allows a low-privileged attacker with only HTTP network access to fully compromise the module. Per Oracle's CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N, C:H/I:H/A:H, score 8.8), a single valid low-level application account is enough to achieve complete confidentiality, integrity, and availability impact. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV; it was disclosed via the Oracle Critical Patch Update of July 2026.
Data compromise in Oracle PeopleSoft Enterprise CS Student Records 9.2.38 (Research Tracking component) lets a low-privileged, network-authenticated attacker over HTTPS read, create, delete, or modify all data accessible to the module. Rated CVSS 3.1 8.1 (C:H/I:H, no availability impact), it was disclosed in Oracle's July 2026 Critical Patch Update and is tagged as an authentication-bypass class issue. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Full compromise of Oracle PeopleSoft Enterprise CS Student Records version 9.2.38 (Research Tracking component) allows an authenticated, low-privileged attacker with network HTTP access to take over the module, impacting confidentiality, integrity, and availability. Oracle rates it CVSS 3.1 7.5 despite high attack complexity (AC:H), reflecting the severity of a complete takeover. No public exploit identified at time of analysis and it is not listed in CISA KEV.
Account takeover in Oracle PeopleSoft Enterprise CS Campus Community 9.2.38 (Integration and Interfaces component) lets a low-privileged, network-based attacker fully compromise the module over HTTP. The Oracle CPU July 2026 advisory rates it CVSS 3.1 8.8 with high confidentiality, integrity, and availability impact, and Oracle labels it 'easily exploitable,' meaning any authenticated user can escalate to complete control of the application. No public exploit identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and single required privilege make it a strong patching priority for higher-education and enterprise PeopleSoft deployments.
Authentication bypass in Oracle PeopleSoft Enterprise CS Campus Community 9.2.38 exposes sensitive student and institutional data to unauthenticated remote attackers over HTTP. The Security component vulnerability allows a network-adjacent attacker to skip authentication controls and gain full read access to all Campus Community data, plus limited write access for inserts and deletes. No public exploit code exists and no CISA KEV listing has been observed, but the PR:N/C:H combination makes this a material confidentiality risk for higher education institutions running the affected version.
Full system takeover is possible in Oracle PeopleSoft Enterprise CS Student Records 9.2.38 via the Research Tracking component, exploitable over HTTP by a high-privileged network attacker under high-complexity conditions. Successful exploitation yields complete compromise of confidentiality, integrity, and availability - effectively granting an attacker control over the affected instance. No public exploit code exists and the vulnerability is not listed in CISA KEV; Oracle disclosed this through its Critical Patch Update for July 2026.
Unauthenticated read access in Oracle PeopleSoft Enterprise CS Campus Community 9.2.38 allows remote attackers to retrieve a subset of protected campus data via HTTP without credentials. The 'Authentication Bypass' tag indicates the Security component fails to enforce access controls on at least one network-accessible endpoint, exposing data - likely student records, enrollment data, or PII - to anonymous network queries. No public exploit code or CISA KEV listing has been identified at time of analysis, though Oracle explicitly characterizes this as 'easily exploitable.'
Unauthorized data disclosure in Oracle PeopleSoft Enterprise CS Campus Community 9.2.38 allows unauthenticated network attackers via HTTPS to access critical or complete application data through an authentication bypass in the Security component. Disclosed as part of Oracle's Critical Patch Update for July 2026, the CVSS 3.1 score of 5.9 (Medium) reflects high attack complexity (AC:H), meaning exploitation requires specific non-trivial conditions. No public exploit code has been identified at time of analysis, and the vulnerability has not been added to the CISA KEV catalog.
Unauthorized data access in Oracle PeopleSoft Enterprise CS Campus Community 9.2.38 allows a low-privileged authenticated attacker to read all data accessible within the system via HTTPS against the Communication component. Tagged as an Authentication Bypass by EUVD intelligence, the flaw appears to operate at the authorization layer - an attacker with a valid low-privilege session can exceed their permitted data scope rather than bypass authentication entirely. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low complexity and network accessibility make this a credible insider or credential-theft-follow-on threat for higher education environments.
Vulnerability in the PeopleSoft Enterprise CS Campus Community product of Oracle PeopleSoft (component: Frameworks). Rated low severity (CVSS 3.5), this vulnerability is remotely exploitable, low attack complexity.
Vulnerability in the PeopleSoft Enterprise CS Campus Community component of Oracle PeopleSoft Products (subcomponent: Frameworks). Rated low severity (CVSS 3.1), this vulnerability is remotely exploitable, no authentication required.
Unauthenticated data compromise in Oracle PeopleSoft Enterprise CS Campus Community 9.2.38 (Security component) lets remote attackers reach the application over HTTP and read all data the module can access, with limited unauthorized insert/update/delete on some data. Vendor and community tags flag this as an authentication bypass, aligning with the PR:N (no privileges) CVSS vector. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but Oracle rates it 'easily exploitable' with a CVSS 3.1 base score of 8.2.
Data manipulation and denial-of-service in Oracle PeopleSoft Enterprise CS Campus Community 9.2.38 (Person Data component) lets a low-privileged, network-authenticated attacker create, delete or modify critical data, read a subset of accessible data, and trigger a repeatable crash of the module. The flaw carries a CVSS 3.1 base score of 7.1 and is flagged as difficult to exploit (AC:H). No public exploit has been identified at time of analysis, and it is not listed in CISA KEV.
Unauthorized data disclosure in Oracle PeopleSoft Enterprise CS Student Records 9.2.38 (Higher Ed Statistics Agency - UK HESA component) lets a remote, unauthenticated attacker reach all data accessible to the Student Records module over HTTP. The flaw is easily exploitable per Oracle and, tagged as an authentication bypass, yields high confidentiality impact with no integrity or availability effect (CVSS 3.1 7.5). No public exploit identified at time of analysis and it is not listed in CISA KEV; EPSS data was not provided.
Full takeover of Oracle PeopleSoft Enterprise CS Campus Community 9.2.38 is possible for a low-privileged attacker with network (HTTP) access to the Security component, resulting in high confidentiality, integrity and availability impact. Oracle rates this CVSS 3.1 7.5 but flags it as difficult to exploit (AC:H), and it requires an authenticated (low-privilege) session. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; the fix ships in Oracle's July 2026 Critical Patch Update.
Privilege-escalating takeover of Oracle PeopleSoft Enterprise CS Student Records (Campus Solutions) 9.2.38, specifically the Australian Features component, allows a low-privileged attacker with only HTTP network access to fully compromise the module. Per Oracle's CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N, C:H/I:H/A:H, score 8.8), a single valid low-level application account is enough to achieve complete confidentiality, integrity, and availability impact. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV; it was disclosed via the Oracle Critical Patch Update of July 2026.
Data compromise in Oracle PeopleSoft Enterprise CS Student Records 9.2.38 (Research Tracking component) lets a low-privileged, network-authenticated attacker over HTTPS read, create, delete, or modify all data accessible to the module. Rated CVSS 3.1 8.1 (C:H/I:H, no availability impact), it was disclosed in Oracle's July 2026 Critical Patch Update and is tagged as an authentication-bypass class issue. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Full compromise of Oracle PeopleSoft Enterprise CS Student Records version 9.2.38 (Research Tracking component) allows an authenticated, low-privileged attacker with network HTTP access to take over the module, impacting confidentiality, integrity, and availability. Oracle rates it CVSS 3.1 7.5 despite high attack complexity (AC:H), reflecting the severity of a complete takeover. No public exploit identified at time of analysis and it is not listed in CISA KEV.
Account takeover in Oracle PeopleSoft Enterprise CS Campus Community 9.2.38 (Integration and Interfaces component) lets a low-privileged, network-based attacker fully compromise the module over HTTP. The Oracle CPU July 2026 advisory rates it CVSS 3.1 8.8 with high confidentiality, integrity, and availability impact, and Oracle labels it 'easily exploitable,' meaning any authenticated user can escalate to complete control of the application. No public exploit identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and single required privilege make it a strong patching priority for higher-education and enterprise PeopleSoft deployments.
Authentication bypass in Oracle PeopleSoft Enterprise CS Campus Community 9.2.38 exposes sensitive student and institutional data to unauthenticated remote attackers over HTTP. The Security component vulnerability allows a network-adjacent attacker to skip authentication controls and gain full read access to all Campus Community data, plus limited write access for inserts and deletes. No public exploit code exists and no CISA KEV listing has been observed, but the PR:N/C:H combination makes this a material confidentiality risk for higher education institutions running the affected version.
Full system takeover is possible in Oracle PeopleSoft Enterprise CS Student Records 9.2.38 via the Research Tracking component, exploitable over HTTP by a high-privileged network attacker under high-complexity conditions. Successful exploitation yields complete compromise of confidentiality, integrity, and availability - effectively granting an attacker control over the affected instance. No public exploit code exists and the vulnerability is not listed in CISA KEV; Oracle disclosed this through its Critical Patch Update for July 2026.
Unauthenticated read access in Oracle PeopleSoft Enterprise CS Campus Community 9.2.38 allows remote attackers to retrieve a subset of protected campus data via HTTP without credentials. The 'Authentication Bypass' tag indicates the Security component fails to enforce access controls on at least one network-accessible endpoint, exposing data - likely student records, enrollment data, or PII - to anonymous network queries. No public exploit code or CISA KEV listing has been identified at time of analysis, though Oracle explicitly characterizes this as 'easily exploitable.'
Unauthorized data disclosure in Oracle PeopleSoft Enterprise CS Campus Community 9.2.38 allows unauthenticated network attackers via HTTPS to access critical or complete application data through an authentication bypass in the Security component. Disclosed as part of Oracle's Critical Patch Update for July 2026, the CVSS 3.1 score of 5.9 (Medium) reflects high attack complexity (AC:H), meaning exploitation requires specific non-trivial conditions. No public exploit code has been identified at time of analysis, and the vulnerability has not been added to the CISA KEV catalog.
Unauthorized data access in Oracle PeopleSoft Enterprise CS Campus Community 9.2.38 allows a low-privileged authenticated attacker to read all data accessible within the system via HTTPS against the Communication component. Tagged as an Authentication Bypass by EUVD intelligence, the flaw appears to operate at the authorization layer - an attacker with a valid low-privilege session can exceed their permitted data scope rather than bypass authentication entirely. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low complexity and network accessibility make this a credible insider or credential-theft-follow-on threat for higher education environments.
Vulnerability in the PeopleSoft Enterprise CS Campus Community product of Oracle PeopleSoft (component: Frameworks). Rated low severity (CVSS 3.5), this vulnerability is remotely exploitable, low attack complexity.
Vulnerability in the PeopleSoft Enterprise CS Campus Community component of Oracle PeopleSoft Products (subcomponent: Frameworks). Rated low severity (CVSS 3.1), this vulnerability is remotely exploitable, no authentication required.