This vulnerability affects Oracle PeopleSoft Enterprise PeopleTools component PIA Core Technology, specifically version 8.62. It is exploitable remotely over HTTP without authentication but requires user interaction from a third party. The vulnerability can cause unauthorized data manipulation (update, insert, delete), unauthorized data disclosure, and partial denial of service, impacting confidentiality, integrity, and availability. The CVSS vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, scope change, and low impact on confidentiality, integrity, and availability. Oracle's July 2026 Critical Patch Update advisory mentions many patches but does not explicitly confirm a fix for this CVE in the provided excerpt. No known exploits in the wild are reported.

Successful exploitation can result in unauthorized modification (update, insert, delete) of PeopleSoft Enterprise PeopleTools accessible data, unauthorized reading of some data, and partial denial of service conditions. The vulnerability affects confidentiality, integrity, and availability, with a CVSS score of 7.1 indicating high severity. The scope change means additional Oracle products beyond PeopleTools may be impacted.

Oracle's July 2026 Critical Patch Update advisory references multiple security patches but does not explicitly confirm a patch for CVE-2026-47015 in the provided content. Patch status is not yet confirmed — check the vendor advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle strongly recommends applying available patches promptly and remaining on actively supported versions. Until a patch is confirmed, monitor Oracle advisories for updates and apply any relevant mitigations provided by Oracle.