This vulnerability affects Oracle PeopleSoft Enterprise SCM Purchasing version 9.2. It permits unauthenticated attackers with network access over HTTP to compromise the system, resulting in unauthorized creation, deletion, or modification of critical data, as well as unauthorized read access to some data. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N) indicates the attack requires no privileges or user interaction and has low attack complexity. The vulnerability is classified under CWE-284 (Improper Access Control). The vendor advisory from Oracle’s July 2026 Critical Patch Update mentions multiple patches but does not explicitly confirm a patch for this specific issue. No known exploits in the wild have been reported.

Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data within PeopleSoft Enterprise SCM Purchasing, as well as unauthorized read access to a subset of accessible data. This compromises data confidentiality and integrity but does not impact availability. The vulnerability allows remote, unauthenticated attackers to perform these actions over HTTP, increasing the risk of data compromise.

Patch status is not yet confirmed — check the Oracle July 2026 Critical Patch Update advisory (https://www.oracle.com/security-alerts/cpujul2026.html) for current remediation guidance. Oracle strongly recommends applying security patches without delay and remaining on actively-supported versions. Until a patch is confirmed and applied, restrict network access to PeopleSoft Enterprise SCM Purchasing interfaces where possible and monitor for unusual activity related to data modification or access.