This vulnerability affects Oracle PeopleSoft Enterprise SCM Order Management version 9.2 and involves a security flaw in the product's security component. An unauthenticated attacker with network access via HTTPS can exploit this vulnerability to compromise the system, resulting in unauthorized access to sensitive data. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) indicates network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, and high confidentiality impact with no integrity or availability impact. The vulnerability is publicly known and published as of July 2026. Oracle’s July 2026 Critical Patch Update advisory references multiple patches but does not explicitly confirm a patch for this specific vulnerability, so patch status remains unconfirmed.

Successful exploitation allows an unauthenticated attacker to gain unauthorized access to critical or all accessible data within PeopleSoft Enterprise SCM Order Management version 9.2. This compromises confidentiality but does not affect integrity or availability. The vulnerability is easily exploitable over the network via HTTPS without requiring authentication or user interaction.

Patch status for this vulnerability is not explicitly confirmed in the Oracle July 2026 Critical Patch Update advisory. Oracle strongly recommends applying all relevant security patches promptly and remaining on actively supported versions. Users should monitor Oracle’s security advisories for updates regarding patch availability for PeopleSoft Enterprise SCM Order Management 9.2. Until a patch is confirmed, consider restricting network access to the affected service to trusted users only.