This vulnerability affects Oracle PeopleSoft Enterprise FIN Common Objects Brazil version 9.1, specifically the Purchasing component. It permits an unauthenticated attacker with network access over HTTP to compromise the system, resulting in unauthorized access to critical or all accessible data. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) indicates network attack vector, low attack complexity, no privileges or user interaction required, and a high confidentiality impact with no integrity or availability impact. The vendor advisory does not explicitly confirm a patch or remediation level for this specific vulnerability but references the July 2026 Critical Patch Update containing numerous security fixes. Users are advised to consult the vendor advisory for patch availability.

Successful exploitation can lead to unauthorized access to critical or all accessible data in PeopleSoft Enterprise FIN Common Objects Brazil version 9.1. The confidentiality of sensitive information is severely impacted, but there is no direct impact on integrity or availability. The vulnerability can be exploited remotely without authentication or user interaction, increasing the risk of compromise.

Patch status is not yet confirmed — check the Oracle July 2026 Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle strongly recommends applying security patches promptly and remaining on actively supported versions. Until a patch is confirmed and applied, restrict network access to the affected PeopleSoft Enterprise FIN Common Objects Brazil system to trusted users only and monitor for unusual access patterns.