This vulnerability affects Oracle PeopleSoft Enterprise FIN Common Objects Brazil version 9.1, specifically the Purchasing component. It permits an unauthenticated attacker with network access over HTTP to compromise the system, resulting in unauthorized access to critical or all accessible data. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) confirms that the attack can be performed remotely without authentication or user interaction, with a high confidentiality impact but no integrity or availability impact. The vendor advisory from Oracle (July 2026 Critical Patch Update) lists this vulnerability but does not explicitly confirm patch availability or remediation status for this specific issue. Customers are strongly advised to consult the Oracle advisory for patch information and apply updates promptly.

Successful exploitation leads to unauthorized access to critical or all accessible data within PeopleSoft Enterprise FIN Common Objects Brazil version 9.1. There is no reported impact on data integrity or availability. The vulnerability can be exploited remotely without authentication or user interaction, making it a significant confidentiality risk.

Oracle's July 2026 Critical Patch Update advisory references this vulnerability but does not explicitly state the availability of a patch or temporary fix for PeopleSoft Enterprise FIN Common Objects Brazil version 9.1. Customers should review the Oracle advisory at https://www.oracle.com/security-alerts/cpujul2026.html for the latest patch availability and installation instructions. Until a patch is applied, restrict network access to the affected service where possible. Monitor Oracle communications for updates on remediation status.