This vulnerability affects Oracle PeopleSoft Enterprise FIN Cash Management version 9.2 and allows an unauthenticated attacker with network access via HTTP to compromise the system. The attack can result in unauthorized creation, deletion, or modification of critical data within PeopleSoft FIN Cash Management and may impact additional related products due to scope change. The CVSS 3.1 vector indicates network attack vector (AV:N), high attack complexity (AC:H), no privileges required (PR:N), no user interaction (UI:N), scope changed (S:C), and high confidentiality and integrity impacts (C:H/I:H), with no impact on availability (A:N). The vulnerability is classified under CWE-284 (Improper Access Control). Oracle's July 2026 Critical Patch Update advisory includes security patches for multiple products, but no explicit patch or remediation level for this specific vulnerability is detailed in the provided advisory content.

Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data within PeopleSoft Enterprise FIN Cash Management. The vulnerability also has a scope change, meaning it may affect additional PeopleSoft products beyond FIN Cash Management. The confidentiality and integrity of critical data are highly impacted, but availability is not affected. The vulnerability can be exploited remotely without authentication, though it is considered difficult to exploit due to high attack complexity.

Oracle's July 2026 Critical Patch Update advisory references security patches for multiple products, including PeopleSoft components. Although no explicit patch or remediation level is stated for this specific vulnerability, Oracle strongly recommends applying the latest security patches without delay to mitigate this and other vulnerabilities. Customers should review the Oracle Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for detailed patch availability and installation instructions. No vendor advisory states that no action is required or that the vulnerability is already mitigated.