This vulnerability affects Oracle PeopleSoft Enterprise SCM Purchasing component (version 9.2). It is easily exploitable remotely without authentication via HTTP. Exploitation can result in unauthorized creation, deletion, or modification of critical or all accessible data, and unauthorized read access to a subset of accessible data. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N, reflecting network attack vector, low attack complexity, no privileges or user interaction required, unchanged scope, low confidentiality impact, high integrity impact, and no availability impact. Oracle's July 2026 Critical Patch Update advisory includes patches for this vulnerability, recommending customers apply updates promptly.

An unauthenticated attacker with network access can exploit this vulnerability to gain unauthorized read access to some data and unauthorized creation, deletion, or modification access to critical or all accessible data within PeopleSoft Enterprise SCM Purchasing 9.2. This compromises confidentiality and integrity of the affected system's data, potentially leading to significant business impact due to data manipulation or leakage.

Oracle has released security patches for this vulnerability as part of the July 2026 Critical Patch Update. Customers using PeopleSoft Enterprise SCM Purchasing version 9.2 should apply the relevant patches from Oracle's advisory promptly to remediate this vulnerability. Patch status is confirmed by the vendor advisory. No alternative mitigations are specified.