This vulnerability affects Oracle PeopleSoft Enterprise CC Common Application Objects version 9.2. It is easily exploitable by a low-privileged attacker over the network via HTTP, requiring user interaction from a third party. The vulnerability can lead to unauthorized creation, deletion, or modification of critical data, with a scope change potentially impacting additional PeopleSoft products. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, user interaction required, scope changed, and high confidentiality and integrity impacts without availability impact. Oracle's July 2026 Critical Patch Update advisory references this vulnerability among many others but does not explicitly state a dedicated patch or remediation level for it.

Successful exploitation can result in unauthorized creation, deletion, or modification of critical data within PeopleSoft Enterprise CC Common Application Objects and potentially other related PeopleSoft products due to scope change. This compromises confidentiality and integrity of the affected data. There is no reported impact on availability. The vulnerability requires user interaction from a person other than the attacker, which is a prerequisite for exploitation.

Oracle has included this vulnerability in its July 2026 Critical Patch Update advisory. However, the advisory does not explicitly confirm a dedicated patch or remediation level for this specific vulnerability. Customers are strongly advised to review the Oracle Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html and apply all relevant security patches promptly. Until explicit patch information is confirmed, monitor Oracle advisories for updates. No vendor statement indicates that no action is required or that the vulnerability is already mitigated.