The vulnerability resides in the Purchasing component of Oracle PeopleSoft Enterprise SCM Purchasing 9.2. An attacker with low privileges and network access through HTTP can exploit the flaw, resulting in unauthorized access to critical or all accessible data. The issue does not provide integrity or availability compromise; its primary effect is confidentiality loss.

All installations of Oracle PeopleSoft Enterprise SCM Purchasing version 9.2 are affected. No sub‑edition or patch level details are provided beyond the base version, so any 9.2 deployment without the latest security updates should be considered vulnerable.

The CVSS v3.1 score of 6.5 indicates moderate severity with a confidentiality impact. The EPSS score is not available, but the flaw is listed as not in the CISA KEV catalog, suggesting no confirmed exploitation. Based on the description, the attack vector is likely network via HTTP, and a low privileged attacker can exploit the flaw without user interaction, making it reasonably easy to target.