Description
Vulnerability in the PeopleSoft Enterprise FIN Common Objects Brazil product of Oracle PeopleSoft (component: eProcurement). The supported version that is affected is 9.1. Easily exploitable vulnerability allows high privileged attacker with access to the physical communication segment attached to the hardware where the PeopleSoft Enterprise FIN Common Objects Brazil executes to compromise PeopleSoft Enterprise FIN Common Objects Brazil. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all PeopleSoft Enterprise FIN Common Objects Brazil accessible data as well as unauthorized access to critical data or complete access to all PeopleSoft Enterprise FIN Common Objects Brazil accessible data. CVSS 3.1 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N).
Published: 2026-10-20
Score: 6.1 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Privilege Escalation and Unauthorized Data Access
Action: Update System
AI Analysis

Impact

The vulnerability resides in the eProcurement component of Oracle PeopleSoft Enterprise FIN Common Objects Brazil. An attacker who has high privileges and physical access to the network segment connecting to the system can exploit this flaw to perform unauthorized creation, deletion, or modification of critical data. The flaw compromises the confidentiality and integrity of all data available through the PeopleSoft interface.

Affected Systems

Oracle PeopleSoft Enterprise FIN Common Objects Brazil version 9.1 is affected. The product is part of the Oracle PeopleSoft suite, specifically the FIN Common Objects Brazil module. Only the 9.1 release is known to contain the vulnerability as identified in the official Oracle release notes.

Risk and Exploitability

The CVSS score of 6.1 indicates a medium severity with significant confidentiality and integrity impact. The vector (AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N) shows that the attacker must have local network access and high privileges, with no user interaction required. The EPSS score is not available, so the exploitation probability cannot be quantified, but the vulnerability is not listed in the KEV catalog and therefore is not known to be actively exploited. Nevertheless, the potential for internal attackers to abuse this flaw warrants prompt remediation.

Generated by OpenCVE AI on October 21, 2026 at 13:24 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply any available vendor updates or patches for PeopleSoft Enterprise FIN Common Objects Brazil 9.1
  • Restrict physical network access to the PeopleSoft servers by implementing network segmentation and limiting connection points to authorized staff only
  • Conduct a privilege review to ensure users have only the permissions necessary for their role, particularly for eProcurement functionalities

Generated by OpenCVE AI on October 21, 2026 at 13:24 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sat, 24 Oct 2026 04:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 21 Oct 2026 13:45:00 +0000

Type Values Removed Values Added
Title Privilege Escalation in PeopleSoft eProcurement via Physical Network
Weaknesses CWE-284

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in the PeopleSoft Enterprise FIN Common Objects Brazil product of Oracle PeopleSoft (component: eProcurement). The supported version that is affected is 9.1. Easily exploitable vulnerability allows high privileged attacker with access to the physical communication segment attached to the hardware where the PeopleSoft Enterprise FIN Common Objects Brazil executes to compromise PeopleSoft Enterprise FIN Common Objects Brazil. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all PeopleSoft Enterprise FIN Common Objects Brazil accessible data as well as unauthorized access to critical data or complete access to all PeopleSoft Enterprise FIN Common Objects Brazil accessible data. CVSS 3.1 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N).
First Time appeared Oracle
Oracle peoplesoft Enterprise Fin Common Objects Brazil
CPEs cpe:2.3:a:oracle:peoplesoft_enterprise_fin_common_objects_brazil:9.1:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle peoplesoft Enterprise Fin Common Objects Brazil
References
Metrics cvssV3_1

{'score': 6.1, 'vector': 'CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N'}

Subscriptions

Oracle Peoplesoft Enterprise Fin Common Objects Brazil
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-10-27T03:55:46.766Z

Reserved: 2026-09-14T22:10:16.637Z

Link: CVE-2026-91474

cve-icon Vulnrichment

Updated: 2026-10-24T03:13:51.527Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-20T22:20:50.887

Modified: 2026-10-27T04:18:04.770

Link: CVE-2026-91474

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-22T19:00:16Z

Weaknesses