This vulnerability affects Oracle PeopleSoft Enterprise FIN Cash Management version 9.2. It permits a low privileged attacker who has logon access to the underlying infrastructure to compromise the PeopleSoft Enterprise FIN Cash Management application. The vulnerability's scope change means that exploitation could significantly impact other Oracle products beyond the immediate component. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) indicates that the attack requires local access with low complexity and privileges, no user interaction, and results in complete confidentiality, integrity, and availability compromise with scope change. Oracle's July 2026 Critical Patch Update advisory references this vulnerability but does not explicitly state patch availability or remediation details for it.

Successful exploitation can lead to complete takeover of PeopleSoft Enterprise FIN Cash Management, compromising confidentiality, integrity, and availability of the affected system. Due to scope change, additional Oracle products integrated or dependent on this component may also be significantly impacted. The vulnerability requires local access with low privileges, making it exploitable by users with minimal rights on the infrastructure.

Oracle has included this vulnerability in its July 2026 Critical Patch Update advisory. However, the advisory does not explicitly confirm patch availability or remediation status for this specific vulnerability. Users should consult the official Oracle Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for the latest patch and remediation information. It is strongly recommended to apply Oracle security patches promptly once available and ensure that only trusted users have logon access to the infrastructure hosting PeopleSoft Enterprise FIN Cash Management. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.