This vulnerability affects Oracle PeopleSoft Enterprise FIN Payables version 9.2 and is classified under CWE-284 (Improper Access Control). It allows an unauthenticated attacker with network access via HTTP to compromise the product, resulting in unauthorized access to sensitive data. The CVSS 3.1 base score is 7.5, reflecting a high impact on confidentiality with no required privileges or user interaction. The vendor advisory from Oracle references a Critical Patch Update released in July 2026 that addresses multiple vulnerabilities, including this one, and strongly encourages customers to apply patches without delay. However, the advisory does not explicitly confirm a dedicated patch for this specific CVE in the provided content.

Successful exploitation leads to unauthorized access to critical or all accessible data within PeopleSoft Enterprise FIN Payables 9.2. The confidentiality of sensitive financial data is compromised, but there is no impact on integrity or availability according to the CVSS vector. This could result in data breaches and exposure of sensitive financial information.

Patch status is not yet confirmed — check the Oracle July 2026 Critical Patch Update advisory for current remediation guidance at https://www.oracle.com/security-alerts/cpujul2026.html. Oracle strongly recommends applying all relevant security patches promptly and remaining on actively supported versions. No vendor advisory states that no action is required or that the issue is already mitigated, so timely patching is advised once confirmed.