This vulnerability affects Oracle PeopleSoft Enterprise SCM Order Management version 9.2 and is classified under CWE-284 (Improper Access Control). It enables an unauthenticated network attacker via HTTPS to compromise the system, resulting in unauthorized access to sensitive data. The CVSS 3.1 base score is 7.5, reflecting a high impact on confidentiality with no required privileges or user interaction. The vendor advisory points to the July 2026 Critical Patch Update but does not explicitly confirm a patch for this specific issue within the provided content. The vulnerability is publicly disclosed and considered easily exploitable.

Successful exploitation can lead to unauthorized access to critical or all accessible data in PeopleSoft Enterprise SCM Order Management 9.2. There is no impact on integrity or availability reported. The confidentiality breach could expose sensitive business information managed by the affected product.

Patch status is not yet confirmed — check the Oracle July 2026 Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle strongly recommends applying security patches promptly and remaining on actively supported versions. Until a patch is confirmed and applied, restrict network access to the affected service where possible.