This vulnerability affects Oracle PeopleSoft Enterprise FIN eSettlements component version 9.2. It permits an unauthenticated attacker with network access over HTTP to gain unauthorized update, insert, delete, and read access to some accessible data within the product. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N) indicates network attack vector, high attack complexity, no privileges or user interaction required, and impacts limited confidentiality and integrity without availability impact. Oracle's July 2026 Critical Patch Update advisory references this vulnerability among many others but does not explicitly state a dedicated patch or remediation level for it. No known exploits in the wild have been reported.

Successful exploitation allows unauthorized read and write access to certain PeopleSoft Enterprise FIN eSettlements data, potentially leading to data manipulation and disclosure. The impact is limited to confidentiality and integrity with no availability impact. The vulnerability requires network access via HTTP and is difficult to exploit, reducing the likelihood of widespread exploitation.

Oracle's July 2026 Critical Patch Update advisory includes this vulnerability in its comprehensive patch release. However, no explicit patch or remediation level is confirmed for this specific issue in the advisory. It is recommended that organizations running PeopleSoft Enterprise FIN eSettlements version 9.2 review the Oracle Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html and apply all relevant patches promptly. Until a patch is applied, restrict network access to the affected service where possible and monitor for unusual activity. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.