This vulnerability affects Oracle PeopleSoft Enterprise CRM Common Objects version 9.2.23. It permits an unauthenticated attacker with network access over HTTP to compromise the component, potentially resulting in complete takeover. The vulnerability has a CVSS 3.1 base score of 9.0, indicating critical severity with high impacts on confidentiality, integrity, and availability. The scope of impact may extend to additional Oracle products beyond the CRM Common Objects. Oracle's July 2026 Critical Patch Update advisory references this vulnerability among many others but does not explicitly confirm a dedicated patch or remediation level for this version. The vulnerability is difficult to exploit due to high attack complexity but requires no privileges or user interaction.

Successful exploitation can lead to complete compromise of PeopleSoft Enterprise CRM Common Objects, affecting confidentiality, integrity, and availability. The scope change indicates that other Oracle products related to this component may also be impacted. This could result in significant operational and security risks for organizations using the affected version 9.2.23.

Oracle has included this vulnerability in its July 2026 Critical Patch Update advisory. However, the advisory does not explicitly confirm a patch or remediation level for PeopleSoft Enterprise CRM Common Objects version 9.2.23. Customers are strongly advised to review the Oracle Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for the latest patch availability and apply all relevant security patches promptly. Until a patch is confirmed and applied, organizations should consider restricting network access to the affected component to trusted users only and monitor for any unusual activity. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.