This vulnerability affects Oracle PeopleSoft Enterprise FIN Common Objects Brazil, specifically version 9.1. It is an easily exploitable flaw that permits unauthenticated attackers with network access over HTTP to compromise the system. Successful exploitation can lead to unauthorized access to critical or all accessible data within the product. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) reflects that the attack requires no privileges or user interaction, has low attack complexity, and results in a high confidentiality impact without affecting integrity or availability. The vendor advisory from Oracle references a Critical Patch Update released in July 2026, but does not explicitly confirm a patch for this specific vulnerability in the advisory content provided.

The vulnerability allows an unauthenticated remote attacker to access sensitive data within PeopleSoft Enterprise FIN Common Objects Brazil 9.1. This can lead to unauthorized disclosure of critical information, potentially compromising confidentiality. There is no impact on integrity or availability reported. No known exploits in the wild have been reported at this time.

Patch status is not yet confirmed — check the Oracle Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle strongly recommends applying security patches promptly and remaining on actively supported versions. Until a patch is confirmed and applied, restrict network access to the affected service where possible to reduce exposure.