This vulnerability affects Oracle PeopleSoft Enterprise FIN Common Objects Argentina, specifically version 9.1. It is easily exploitable by unauthenticated attackers over the network via HTTP. Exploitation can result in unauthorized creation, deletion, or modification of critical data or full access to all data accessible by the product. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) confirms that the attack requires no privileges or user interaction and impacts confidentiality and integrity severely. The vendor advisory from Oracle references this vulnerability as part of their July 2026 Critical Patch Update but does not explicitly confirm patch availability for this specific product/version in the advisory content provided.

An attacker can remotely and without authentication compromise the affected PeopleSoft product, resulting in unauthorized creation, deletion, or modification of critical data or full access to all accessible data. This poses a severe risk to data confidentiality and integrity within the affected system. Availability is not impacted according to the CVSS vector.

Patch status is not yet confirmed — check the Oracle July 2026 Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle strongly recommends applying security patches promptly and remaining on actively supported versions. Until a patch is confirmed and applied, restrict network access to the affected service where possible to reduce exposure.