This vulnerability affects Oracle PeopleSoft Enterprise FIN eSettlements version 9.2. It allows an unauthenticated attacker with network access via HTTP to compromise the application by gaining unauthorized update, insert, or delete access to some accessible data, as well as unauthorized read access to a subset of accessible data. The CVSS 3.1 base score is 4.8, indicating medium severity, with attack vector network, high attack complexity, no privileges required, no user interaction, and impacts limited confidentiality and integrity. The vendor advisory references Oracle's July 2026 Critical Patch Update but does not explicitly confirm a patch for this specific vulnerability.

Successful exploitation can lead to unauthorized modification (update, insert, delete) and unauthorized reading of certain data within PeopleSoft Enterprise FIN eSettlements. The confidentiality and integrity of some accessible data are impacted, but availability is not affected. The vulnerability requires network access via HTTP and is rated medium severity due to its difficulty to exploit and limited impact scope.

Oracle's advisory for the July 2026 Critical Patch Update recommends applying security patches promptly to supported versions. However, no explicit patch or remediation level is confirmed for this vulnerability in the advisory. Organizations using PeopleSoft Enterprise FIN eSettlements version 9.2 should monitor Oracle's security alerts for patch availability and apply updates as soon as they are released. Until a patch is available, consider restricting network access to the affected service to trusted users only and follow Oracle's general security recommendations.