This vulnerability affects Oracle PeopleSoft Enterprise FIN Engineering Argentina component (Engineering) version 9.1. It permits a high privileged attacker with network access via HTTP to compromise the system, resulting in unauthorized update, insert, or delete access to some accessible data, as well as unauthorized read access to a subset of accessible data. The CVSS 3.1 vector indicates network attack vector, high attack complexity, high privileges required, no user interaction, unchanged scope, and low confidentiality and integrity impacts with no availability impact. The vulnerability is rated low severity (CVSS 3.3). The vendor advisory from Oracle's July 2026 Critical Patch Update does not explicitly confirm a patch for this vulnerability, and no remediation level is provided. Customers are advised to consult the advisory for patch availability and apply updates promptly if available.

Successful exploitation allows a high privileged attacker with network access via HTTP to gain unauthorized read access to some data and unauthorized update, insert, or delete access to some accessible data within PeopleSoft Enterprise FIN Engineering Argentina version 9.1. The impact on confidentiality and integrity is low, with no impact on availability. This could lead to unauthorized data modification and disclosure within the affected system.

Patch status is not yet confirmed — check the vendor advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle recommends applying security patches promptly when available and staying on actively supported versions. No specific temporary mitigations or workarounds are provided in the advisory for this vulnerability.