This vulnerability affects Oracle PeopleSoft Enterprise FIN Pay/Bill Management version 9.2. It is classified under CWE-306 (Missing Authentication for Critical Function) and allows an attacker with low privileges and logon access to the infrastructure to compromise the application. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) indicates the attack requires local access with low complexity and privileges, no user interaction, and results in a high confidentiality impact. Oracle's July 2026 Critical Patch Update advisory references this vulnerability but does not explicitly confirm a patch or remediation level for this specific issue. Customers are advised to remain on supported versions and apply patches from Oracle's CPU advisories promptly.

An attacker with low privileges and logon access to the infrastructure hosting PeopleSoft Enterprise FIN Pay/Bill Management 9.2 can exploit this vulnerability to gain unauthorized access to critical or all accessible data within the application. The impact is limited to confidentiality, with no reported integrity or availability effects. This could lead to data exposure or leakage of sensitive financial and billing information managed by the product.

Oracle's advisory does not explicitly confirm a patch or remediation for this vulnerability as of the July 2026 Critical Patch Update. Customers should monitor Oracle's security advisories for updates and apply any relevant patches promptly once available. Until a patch is confirmed, restricting access to the infrastructure and enforcing strict access controls for users with logon privileges can help reduce risk. Oracle strongly recommends staying on actively supported versions and applying security patches without delay.