CVE-2026-34299 affects Oracle PeopleSoft Enterprise FIN Maintenance Management 9.2, allowing an attacker with low privileges and network access over HTTP to compromise the system and gain unauthorized access to critical or all accessible data. The vulnerability relates to improper access control (CWE-284). The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, high confidentiality impact, and no integrity or availability impact. The vendor advisory from Oracle's April 2026 Critical Patch Update does not explicitly confirm a patch for this vulnerability, and no remediation level is provided. Customers are advised to monitor Oracle advisories and apply patches as they become available.

Successful exploitation results in unauthorized access to critical or all accessible data within PeopleSoft Enterprise FIN Maintenance Management 9.2. The impact is limited to confidentiality with no reported integrity or availability effects. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the Oracle advisory at https://www.oracle.com/security-alerts/cpuapr2026.html for current remediation guidance. Oracle recommends applying Critical Patch Updates promptly when available. Since this is not a cloud service, customers must apply patches themselves once released. No vendor advisory states that no action is required or that the issue is already mitigated.