This vulnerability affects Oracle PeopleSoft Enterprise SCM Inventory version 9.2 and allows an unauthenticated remote attacker to compromise the system via HTTP. Successful exploitation can lead to unauthorized access to critical data or complete access to all accessible data within the product, as well as unauthorized modification (update, insert, delete) of some data. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N) indicates network attack vector, low attack complexity, no privileges or user interaction required, with high confidentiality impact and low integrity impact. Oracle's July 2026 Critical Patch Update advisory references this vulnerability among many others and provides patch availability information. The advisory emphasizes the importance of applying patches without delay to prevent exploitation.

An unauthenticated attacker with network access can exploit this vulnerability to gain unauthorized access to critical and potentially all accessible data in PeopleSoft Enterprise SCM Inventory 9.2. The attacker can also perform unauthorized data modifications such as updates, inserts, or deletions on some accessible data. This compromises confidentiality and integrity of the affected system's data, potentially leading to data breaches or data tampering.

Oracle has released a Critical Patch Update in July 2026 that addresses this vulnerability among others. Users of PeopleSoft Enterprise SCM Inventory version 9.2 should promptly apply the relevant security patches as detailed in Oracle's advisory (https://www.oracle.com/security-alerts/cpujul2026.html). Oracle strongly recommends remaining on actively-supported versions and applying security patches without delay to mitigate the risk of exploitation.