This vulnerability affects the Job Opening component of Oracle PeopleSoft Enterprise HCM Talent Acquisition Manager version 9.2. It is easily exploitable by an attacker with low privileges and network access over HTTP, enabling full compromise of the affected system. The vulnerability's scope may extend to other Oracle products, potentially amplifying its impact. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) reflects network attack vector, low attack complexity, low privileges required, no user interaction, scope change, and high impact on confidentiality, integrity, and availability. Oracle has published a Critical Patch Update advisory in July 2026 addressing multiple vulnerabilities, including this one, but no explicit patch or remediation level is stated for this CVE in the provided advisory content.

Exploitation of this vulnerability can result in complete takeover of the PeopleSoft Enterprise HCM Talent Acquisition Manager, compromising confidentiality, integrity, and availability of the system. The vulnerability is easily exploitable by a low privileged attacker remotely via HTTP. Additionally, the attack may affect other Oracle products beyond the initially targeted component, increasing the potential impact.

Oracle has released a Critical Patch Update in July 2026 that addresses numerous security vulnerabilities across Oracle products, including PeopleSoft Enterprise HCM. Customers are strongly advised to apply the relevant patches from this update promptly. Since the vendor advisory does not explicitly confirm the patch status for this specific CVE, users should consult the Oracle Critical Patch Update July 2026 advisory at https://www.oracle.com/security-alerts/cpujul2026.html for the latest patch availability and installation instructions. Maintaining up-to-date patched versions is the primary mitigation. No alternative or temporary mitigations are specified in the advisory.