This vulnerability affects Oracle PeopleSoft Enterprise CRM Common Objects version 9.2.23. It permits an unauthenticated attacker with network access via HTTP to compromise the component, potentially leading to complete takeover. The vulnerability has a CVSS 3.1 score of 9.0 with vector AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H, indicating network attack vector, high attack complexity, no privileges or user interaction required, scope change, and high impact on confidentiality, integrity, and availability. The vulnerability is related to weaknesses identified by CWE-306 (Missing Authentication for Critical Function), CWE-284 (Improper Access Control), and CWE-269 (Improper Privilege Management). While the vulnerability is specifically in the CRM Common Objects, successful exploitation may affect other Oracle products as well. No official patch or remediation level is explicitly stated in the advisory, and no known exploits are reported in the wild as of the publication date. The vendor advisory references the Oracle Critical Patch Update of July 2026 but does not explicitly confirm a patch for this specific CVE in the provided content.

Successful exploitation can lead to full compromise of PeopleSoft Enterprise CRM Common Objects, including complete loss of confidentiality, integrity, and availability. The vulnerability allows unauthenticated remote attackers to take over the component, which may also affect additional Oracle products due to scope change. This can result in significant operational and security impacts on affected environments.

Patch status is not yet confirmed — check the Oracle Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle strongly recommends applying security patches promptly and remaining on actively supported versions. Until a patch is confirmed and applied, restrict network access to the affected PeopleSoft Enterprise CRM Common Objects component to trusted users only, and monitor for unusual activity. No vendor advisory states that no action is required or that the issue is already mitigated.