Peoplesoft Enterprise Cs Student Financials
Monthly
Full product takeover in Oracle PeopleSoft Enterprise CS Student Financials 9.2.38 (Billing component) allows a low-privileged, authenticated attacker with HTTP network access to compromise the application, per Oracle's July 2026 Critical Patch Update. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N, C:H/I:H/A:H, score 8.8) indicates easy exploitation yielding complete confidentiality, integrity, and availability loss. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; EPSS data was not provided.
Unauthorized data access and modification in Oracle PeopleSoft Enterprise CS Student Financials 9.2.38 allows low-privileged attackers with HTTP network access to read, create, delete, or modify all data accessible to the Student Financials module. Oracle rates this CVSS 8.1 due to high confidentiality and integrity impact with no availability effect. No public exploit identified at time of analysis, but the 'easily exploitable' vendor characterization and minimal privilege requirement make this a priority for institutions running affected campus financial systems.
Full product takeover in Oracle PeopleSoft Enterprise CS Student Financials 9.2.38 (Billing component) allows a low-privileged, authenticated attacker with HTTP network access to compromise the application, per Oracle's July 2026 Critical Patch Update. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N, C:H/I:H/A:H, score 8.8) indicates easy exploitation yielding complete confidentiality, integrity, and availability loss. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; EPSS data was not provided.
Unauthorized data access and modification in Oracle PeopleSoft Enterprise CS Student Financials 9.2.38 allows low-privileged attackers with HTTP network access to read, create, delete, or modify all data accessible to the Student Financials module. Oracle rates this CVSS 8.1 due to high confidentiality and integrity impact with no availability effect. No public exploit identified at time of analysis, but the 'easily exploitable' vendor characterization and minimal privilege requirement make this a priority for institutions running affected campus financial systems.