A vulnerability in the Oracle PeopleSoft Enterprise SCM Strategic Sourcing component allows an attacker with minimal privileges and HTTP network access to compromise the application. Successful exploitation can lead to full takeover, resulting in confidentiality, integrity, and availability loss. The CVSS 3.1 base score is 8.8, reflecting a high‑severity potential. The problem is described as "easily exploitable" and requires only network connectivity; it does not require prior authentication or elevated privileges beyond what is available to a low‑privileged user. Because the attack vector is network‑based (HTTP) and the CVSS score is 8.8, the risk is high; however, the EPSS score is 0.00447 and the vulnerability is not listed in the CISA KEV catalog. This implies that while the potential impact is severe, the current exploitation probability is low, but the lack of a publicly disclosed exploit does not diminish the urgency of remediation.

Oracle Corporation's PeopleSoft Enterprise SCM Strategic Sourcing 9.2 is the definitive affected system; the vulnerability applies only to version 9.2 of this product. No other versions or vendors are listed as affected. The specific product is the Strategic Sourcing component of PeopleSoft Enterprise SCM, as identified by the CPE string for Oracle PeopleSoft 9.2. No alternative products, service packs, or bundled versions are explicitly mentioned as susceptible, so remediation and patching efforts must focus on version 9.2 deployments.

The CVSS base score of 8.8 indicates high confidentiality, integrity, and availability impacts when the flaw is successfully exploited. The EPSS score is 0.00447, which suggests the probability of exploitation in the wild is very low, but it is still a non‑zero risk. The vulnerability is not recorded in CISA's KEV catalog, implying no widespread exploitation has been documented yet. Nevertheless, the CVE notes that the flaw is easily exploitable by a low‑privileged attacker who has network access via HTTP, meaning that anyone who can reach the application can attempt the attack. Given the severity rating, the non‑zero exploitation probability, and the lack of an active KEV status, the risk remains significant enough to warrant prompt remediation. Early patching is strongly recommended, as the flaw enables full system takeover once accessed.