This vulnerability affects Oracle PeopleSoft Enterprise SCM Purchasing version 9.2 and allows an attacker with low privileges and network access via HTTP to compromise the system, resulting in unauthorized access to sensitive data. The CVSS vector indicates the attack requires network access, low attack complexity, low privileges, no user interaction, and impacts confidentiality only. The weakness is categorized under CWE-284 (Improper Access Control). Oracle's April 2026 Critical Patch Update advisory references multiple security patches but does not explicitly confirm a patch for this CVE. The vulnerability is currently published and assigned a medium severity rating with a CVSS score of 6.5.

Successful exploitation of this vulnerability can lead to unauthorized access to critical or all accessible data within PeopleSoft Enterprise SCM Purchasing 9.2. There is no reported impact on data integrity or availability. The vulnerability allows attackers to bypass access controls, potentially exposing sensitive business data.

Oracle has released a Critical Patch Update advisory in April 2026 covering multiple vulnerabilities. However, the advisory does not explicitly confirm a patch for CVE-2026-34295. Customers should review the April 2026 Critical Patch Update and apply all relevant patches promptly. Since this is not a cloud service, remediation depends on customer action to apply patches. Patch status is not yet confirmed explicitly for this CVE in the advisory; therefore, customers should monitor Oracle's security advisories for updates and apply patches as soon as they become available.