CVE-2026-34301 affects Oracle PeopleSoft Enterprise FIN Maintenance Management version 9.2, allowing a low-privileged attacker with network access via HTTP to compromise the system and gain unauthorized access to sensitive data. The vulnerability impacts confidentiality with no impact on integrity or availability. The CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, reflecting network attack vector, low attack complexity, required privileges, no user interaction, unchanged scope, and high confidentiality impact. Oracle's April 2026 Critical Patch Update advisory references multiple patches but does not explicitly confirm patch availability for this specific vulnerability. No known active exploitation has been reported.

Successful exploitation of this vulnerability can lead to unauthorized access to critical or all accessible data within PeopleSoft Enterprise FIN Maintenance Management version 9.2. The impact is limited to confidentiality, with no direct effect on data integrity or system availability. This could expose sensitive financial or operational data to unauthorized parties.

Oracle's April 2026 Critical Patch Update advisory strongly recommends applying all relevant security patches promptly. Although the advisory does not explicitly confirm a patch for CVE-2026-34301, it is part of the cumulative security updates released. Organizations should verify patch availability and apply updates for PeopleSoft Enterprise FIN Maintenance Management version 9.2 as soon as possible. Until patches are applied, restrict network access to the affected service to trusted users only. Monitor Oracle's security advisories for any updates regarding this vulnerability.