This vulnerability affects Oracle PeopleSoft Enterprise HCM Human Resources version 9.2, specifically its security component. It permits a low privileged attacker with network access through Oracle Net to compromise the system, potentially resulting in unauthorized creation, deletion, or modification of critical data or complete access to all accessible data. The CVSS 3.1 vector indicates network attack vector, high attack complexity, low privileges required, no user interaction, unchanged scope, and high confidentiality and integrity impacts. Oracle has published a Critical Patch Update advisory in July 2026 covering multiple vulnerabilities but does not explicitly confirm a patch for this specific CVE. Customers are urged to stay on supported versions and apply patches promptly.

Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data or full unauthorized access to all data accessible by PeopleSoft Enterprise HCM Human Resources. This compromises confidentiality and integrity of sensitive human resources data. There is no reported impact on availability. The vulnerability is rated medium severity with a CVSS score of 6.8.

Oracle has not explicitly confirmed a patch or remediation level for this vulnerability in the provided advisory. Customers should monitor the Oracle Critical Patch Update advisory for July 2026 and subsequent updates for patch availability. Oracle strongly recommends applying security patches promptly and remaining on actively supported versions to mitigate risks. Since the vulnerability is difficult to exploit and requires network access with low privileges, applying vendor patches when available is the primary mitigation. No vendor advisory states that no action is required or that the issue is already mitigated.