This vulnerability affects Oracle PeopleSoft Enterprise FIN Program Management 9.2 (Primavera Integration component). It is remotely exploitable over the network via HTTP by an attacker with low privileges. Exploitation requires user interaction from a third party and can result in complete compromise of the PeopleSoft Enterprise FIN Program Management system. The vulnerability has a CVSS 3.1 score of 9.0 with vector AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H, indicating network attack vector, low attack complexity, low privileges required, user interaction required, scope change, and high impact on confidentiality, integrity, and availability. While the vulnerability is in this product, successful exploitation may affect other Oracle products as well. Oracle has published a Critical Patch Update advisory in July 2026 covering this and many other vulnerabilities but does not explicitly confirm the patch status for this specific CVE in the provided advisory content.

Successful exploitation can lead to full takeover of the PeopleSoft Enterprise FIN Program Management system, compromising confidentiality, integrity, and availability of the affected product. The vulnerability also has a scope change, meaning it can impact additional Oracle products beyond PeopleSoft Enterprise FIN Program Management. This could result in significant operational and security impacts for organizations using the affected version.

Oracle has released a Critical Patch Update in July 2026 that addresses multiple vulnerabilities including this one. Customers are strongly advised to review the Oracle Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html and apply the relevant patches promptly. Since the vendor advisory does not explicitly confirm the patch status for this specific CVE, patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until patched, organizations should limit network exposure of the affected product and ensure that users are aware of social engineering risks due to the required user interaction for exploitation.