This vulnerability affects Oracle PeopleSoft Enterprise FIN Grants component (version 9.2). It allows an unauthenticated attacker with network access via HTTP to compromise the system by gaining unauthorized read and write access to certain accessible data. The CVSS 3.1 vector indicates network attack vector, high attack complexity, no privileges required, no user interaction, and impacts confidentiality and integrity with low severity. The vendor advisory references Oracle's July 2026 Critical Patch Update but does not explicitly confirm a patch for this specific vulnerability. Oracle strongly recommends applying security patches from their Critical Patch Updates to mitigate such vulnerabilities.

An attacker exploiting this vulnerability can gain unauthorized ability to read, update, insert, or delete some accessible data within PeopleSoft Enterprise FIN Grants. This impacts the confidentiality and integrity of the data but does not affect availability. The vulnerability is rated medium severity with a CVSS 3.1 base score of 4.8. No known exploits in the wild have been reported.

Patch status is not yet confirmed—check the Oracle Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle recommends applying Critical Patch Updates promptly and staying on actively supported versions. No specific temporary or official fix is documented for this vulnerability in the provided advisory content.