This vulnerability affects Oracle PeopleSoft Enterprise CC Common Application Objects version 9.2. It permits a low privileged attacker with network access via HTTP to compromise the application, contingent on user interaction from a person other than the attacker. The vulnerability impacts confidentiality and integrity, allowing unauthorized creation, deletion, or modification of critical data within PeopleSoft Enterprise CC Common Application Objects and potentially other related products (scope change). The CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N, indicating network attack vector, low attack complexity, low privileges required, user interaction required, scope changed, and high confidentiality and integrity impact without availability impact. Oracle’s July 2026 Critical Patch Update advisory references many patches but does not explicitly confirm a fix for this vulnerability, and no patch links are provided in the input data.

Successful exploitation can result in unauthorized creation, deletion, or modification of critical data within PeopleSoft Enterprise CC Common Application Objects and may affect additional Oracle products due to scope change. The confidentiality and integrity of data are highly impacted, potentially leading to significant data compromise. There is no reported impact on availability. The vulnerability requires user interaction from a person other than the attacker and low privileges with network access via HTTP.

Patch status is not yet confirmed — check the Oracle Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle strongly recommends applying security patches promptly and remaining on actively supported versions. Until a patch is confirmed and applied, organizations should consider restricting network access to PeopleSoft Enterprise CC Common Application Objects and educating users to be cautious of unexpected interactions that could trigger exploitation.