This vulnerability affects Oracle PeopleSoft Enterprise SCM Inventory version 9.2 and is classified under CWE-284 (Improper Access Control). It allows an unauthenticated attacker to exploit the system remotely over HTTP with low attack complexity and no privileges or user interaction required. Successful exploitation can lead to unauthorized access to all accessible data and unauthorized modification (update, insert, delete) of some data within the PeopleSoft Enterprise SCM Inventory product. The CVSS vector indicates network attack vector, low complexity, no privileges required, no user interaction, unchanged scope, high confidentiality impact, low integrity impact, and no availability impact. Oracle's July 2026 Critical Patch Update advisory references this vulnerability as part of a large set of patches but does not explicitly confirm a dedicated patch for this version or vulnerability in the provided content.

An unauthenticated attacker with network access via HTTP can gain unauthorized access to critical data within PeopleSoft Enterprise SCM Inventory 9.2 and can perform unauthorized data modifications such as updates, inserts, or deletions on some accessible data. This compromises confidentiality and integrity of the affected system's data. There is no reported impact on system availability. No known exploits in the wild have been reported as of the advisory date.

Oracle has included this vulnerability in its July 2026 Critical Patch Update advisory. While the advisory does not explicitly confirm patch availability for this specific vulnerability, Oracle strongly recommends that customers apply all relevant Critical Patch Updates promptly to mitigate such vulnerabilities. Users of PeopleSoft Enterprise SCM Inventory 9.2 should monitor Oracle's official security advisories and apply patches as soon as they become available. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance: https://www.oracle.com/security-alerts/cpujul2026.html