This vulnerability affects Oracle PeopleSoft Enterprise FIN Expenses version 9.2. It is easily exploitable remotely without authentication via HTTP. Successful exploitation can result in unauthorized creation, deletion, or modification of critical data, unauthorized access to all accessible data within the application, and partial denial of service conditions. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L) reflects network attack vector, low attack complexity, no privileges or user interaction required, with high confidentiality and integrity impact and low availability impact. The vendor advisory from Oracle references this vulnerability within their July 2026 Critical Patch Update but does not explicitly state a patch or fix status for PeopleSoft Enterprise FIN Expenses 9.2. Customers are advised to consult the advisory for patch availability and installation instructions.

An unauthenticated attacker with network access can fully compromise PeopleSoft Enterprise FIN Expenses 9.2, leading to unauthorized creation, deletion, or modification of critical data, unauthorized access to all accessible data, and partial denial of service. This impacts confidentiality, integrity, and availability of the affected system, potentially causing significant operational and data security risks.

Oracle's July 2026 Critical Patch Update advisory references this vulnerability. However, the advisory content provided does not explicitly confirm the availability of a patch for PeopleSoft Enterprise FIN Expenses 9.2. Customers should review the Oracle Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for the latest patch availability and apply any relevant security patches promptly. Until a patch is confirmed and applied, consider restricting network access to the affected application and monitoring for suspicious activity. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.