The vulnerability resides in the Security component of Oracle PeopleSoft Enterprise CS Campus Community and allows an unauthenticated attacker with network access via HTTP to gain complete control of the application. The flaw grants full confidentiality, integrity and availability compromise, resulting in a total takeover of the PeopleSoft instance. The weakness stems from improper access control, permitting remote execution without authentication.

Oracle Corporation's PeopleSoft Enterprise CS Campus Community version 9.2.38 is affected. No other versions or vendors are listed as impacted.

The CVSS score of 8.1 indicates a high severity attack with potential for loss of all data and service availability. The EPSS score of < 1% shows that exploitation is currently considered rare, but the lack of KEV listing does not reduce the inherent risk. Likely attack vector is an HTTP request sent to the vulnerable endpoint without authentication, exploiting the improper access control to assume full application control.