CVE-2026-21971 is a vulnerability in the Purchasing component of Oracle PeopleSoft Enterprise SCM Purchasing that allows an attacker with low privileges and network access to perform unauthorized create, update, delete, and read operations on data exposed through HTTP. The flaw bypasses intended access controls, resulting in confidentiality and integrity violations for data accessible through the Purchasing interface.

Oracle PeopleSoft Enterprise SCM Purchasing version 9.2, including the Enterprise SCM Purchasing and Supply Chain Management Purchasing sub‑products, is affected. The vulnerability is present in the Purchasing component of these products.

The vulnerability can be exploited with a normal network HTTP request and requires only a local non‑privileged account. Once authenticated, the attacker can modify or read data. The CVSS 3.1 base score of 5.4 reflects moderate risk, and the EPSS score of less than 1% suggests a low likelihood of current exploitation. Because it is not listed in CISA’s KEV catalog, it appears not to be actively exploited on a large scale, yet the impact on data integrity and confidentiality warrants timely mitigation.