The vulnerability resides in the Security component of Oracle PeopleSoft Enterprise CS Campus Community and allows an unauthenticated attacker with network access via HTTP to gain complete control of the application. The flaw grants full confidentiality, integrity and availability compromise, resulting in a total takeover of the PeopleSoft instance. The weakness stems from a code injection flaw that allows execution of arbitrary code without authentication.

Oracle Corporation's PeopleSoft Enterprise CS Campus Community version 9.2.38 is affected. No other versions or vendors are listed as impacted.

The CVSS score of 8.1 indicates a high severity attack with potential for loss of all data and service availability. The EPSS score of < 1% shows that exploitation is currently considered rare, but the lack of KEV listing does not reduce the inherent risk. Likely attack vector is an HTTP request sent to the vulnerable endpoint without authentication, exploiting a code injection flaw to execute arbitrary code and gain full application control.