This vulnerability affects Oracle PeopleSoft Enterprise PRTL Interaction Hub version 9.1 and allows an attacker with low privileges and network access via HTTP to compromise the system. The scope of impact may extend to additional products beyond the Interaction Hub. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, scope change, and high confidentiality impact with no integrity or availability impact. Oracle has addressed this vulnerability in their September 2026 Critical Security Patch Update, which includes targeted security fixes for this and many other vulnerabilities.

Successful exploitation can lead to unauthorized access to critical data or complete access to all data accessible via PeopleSoft Enterprise PRTL Interaction Hub. The confidentiality impact is high, but integrity and availability are not affected. The vulnerability could also affect additional Oracle products due to scope change.

Oracle has released a security patch for this vulnerability as part of the September 2026 Critical Security Patch Update. Customers are strongly advised to apply the available patches promptly to mitigate the risk. Oracle recommends remaining on actively-supported versions and applying security patches without delay. No alternative mitigations or workarounds are specified in the advisory.