This vulnerability affects Oracle PeopleSoft Enterprise FIN Grants version 9.2. It allows an unauthenticated attacker with network access via HTTP to gain unauthorized update, insert, delete, and read access to some accessible data within the product. The vulnerability is rated with a CVSS 3.1 base score of 4.8, indicating medium severity, with low confidentiality and integrity impacts and no availability impact. The attack complexity is high, and no privileges or user interaction are required. The vendor advisory from Oracle's July 2026 Critical Patch Update does not explicitly confirm a patch or remediation for this specific vulnerability, though it lists many patches for various products. Therefore, patch status is not yet confirmed and should be verified with Oracle's official security alerts.

Successful exploitation can lead to unauthorized read access to a subset of accessible data and unauthorized update, insert, or delete operations on some accessible data within PeopleSoft Enterprise FIN Grants 9.2. This compromises data confidentiality and integrity but does not affect availability. The vulnerability requires network access via HTTP but is difficult to exploit and does not require authentication.

Patch status is not yet confirmed — check the Oracle advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle recommends applying security patches promptly once available and staying on actively supported versions. Until a patch is confirmed and applied, restrict network access to PeopleSoft Enterprise FIN Grants interfaces where possible to reduce exposure.