This vulnerability affects Oracle PeopleSoft Enterprise HCM Global Payroll Mexico version 9.2. It permits a low privileged attacker with network access over HTTP to compromise the product, resulting in unauthorized modification of critical data or all accessible data within the product and the ability to cause a partial denial of service. The CVSS 3.1 vector indicates network attack vector, high attack complexity, low privileges required, no user interaction, unchanged scope, no confidentiality impact, high integrity impact, and low availability impact. The vulnerability is associated with CWE-284 (Improper Access Control) and CWE-400 (Uncontrolled Resource Consumption). The vendor advisory from Oracle does not explicitly confirm a patch availability for this specific vulnerability but references a Critical Patch Update containing numerous fixes. Customers are advised to apply patches promptly as per Oracle's general guidance.

Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data or any data accessible by PeopleSoft Enterprise HCM Global Payroll Mexico. Additionally, it can cause a partial denial of service impacting availability. There is no confidentiality impact reported. The attack requires network access via HTTP and low privileges but has high attack complexity, making exploitation difficult.

Oracle's advisory does not explicitly confirm a patch for this specific vulnerability at this time. Patch status is not yet confirmed — check the Oracle Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle strongly recommends customers remain on actively supported versions and apply security patches without delay. Until a patch is confirmed, monitor Oracle advisories for updates and consider restricting network access to the affected service where feasible.