This vulnerability affects PeopleSoft Enterprise FIN Lease Administration 9.2 and permits a low privileged attacker with logon access to the infrastructure to compromise the Lease Administration component. The attack surface includes unauthorized creation, deletion, or modification of critical data, with a scope change potentially impacting other PeopleSoft products. The CVSS 3.1 vector indicates local attack vector, high attack complexity, low privileges required, no user interaction, scope changed, and high confidentiality and integrity impacts without availability impact. Oracle's August 2026 Critical Security Patch Update advisory references this vulnerability but does not explicitly confirm a patch for it, recommending customers apply available patches promptly.

Successful exploitation can result in unauthorized creation, deletion, or modification of critical data within PeopleSoft Enterprise FIN Lease Administration and potentially other PeopleSoft products due to scope change. This leads to high confidentiality and integrity impacts. There is no reported impact on availability. The vulnerability requires local access with low privileges and high attack complexity, limiting ease of exploitation.

Oracle's August 2026 Critical Security Patch Update advisory includes this vulnerability among many others and recommends that customers apply security patches without delay. However, the advisory does not explicitly confirm patch availability for this specific vulnerability. Therefore, customers should monitor Oracle's official patch documentation and apply any relevant updates as soon as they become available. Until then, restrict access to the infrastructure hosting PeopleSoft Enterprise FIN Lease Administration to trusted users only.