This vulnerability affects Oracle PeopleSoft Enterprise FIN Project Costing version 9.2. It is classified under CWE-306 (Missing Authentication for Critical Function) and has a CVSS 3.1 base score of 7.8, indicating high severity. The attack vector requires local access (AV:L), low attack complexity (AC:L), no privileges required (PR:N), but does require user interaction (UI:R). The impact includes high confidentiality, integrity, and availability impacts. The vulnerability enables an unauthenticated attacker with logon access to the underlying infrastructure to compromise the PeopleSoft Enterprise FIN Project Costing application, potentially resulting in full takeover. Exploitation requires human interaction from a user other than the attacker. The vendor advisory from Oracle (July 2026 Critical Patch Update) lists this vulnerability but does not explicitly confirm availability of a patch or remediation level for this specific issue. No known exploits in the wild have been reported.

Successful exploitation can lead to complete compromise of the PeopleSoft Enterprise FIN Project Costing application, impacting confidentiality, integrity, and availability. This could allow attackers to take over the application and potentially affect business-critical financial project costing operations.

The Oracle July 2026 Critical Patch Update advisory references this vulnerability but does not explicitly confirm the availability of a patch or official remediation for PeopleSoft Enterprise FIN Project Costing 9.2. Customers are strongly advised to review the Oracle advisory at https://www.oracle.com/security-alerts/cpujul2026.html for the latest patch availability and apply any relevant patches promptly. Until an official fix is confirmed and applied, restrict access to the infrastructure hosting PeopleSoft Enterprise FIN Project Costing to trusted users only, and monitor for suspicious activity. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.