CVE-2026-91466
MediumCVSS 6.4Exploitation Probability (EPSS)
Low risk15th percentile - higher than 15% of all known CVEs
Summary
Vulnerability in Oracle PeopleSoft Enterprise FIN Common Objects Argentina (component Asset Management) version 9.1. A high-privileged attacker with network access via HTTP can, with user interaction, create, delete, or modify critical data, gain full access to it, and cause a partial denial of service.
Risk Assessment
An attacker with high privileges could compromise confidentiality, integrity, and availability of PeopleSoft data, potentially leading to data corruption and outages.
Recommendation
Update PeopleSoft Enterprise FIN Common Objects Argentina to the version containing Oracle's fix. Restrict network access to the system and enforce least privilege.
Other vulnerabilities in PeopleSoft Enterprise FIN Common Objects Argentina
See all- CVE-2026-61242Critical
Vulnerability in PeopleSoft Enterprise FIN Common Objects Argentina (Oracle PeopleSoft) in the Staffing component. Affects version 9.1. Easily exploitable by a low-privileged attacker with network access via HTTP, potentially leading to takeover of the component and impacting additional products (scope change). CVSS 9.9.
- CVE-2026-61238Critical
Vulnerability in PeopleSoft Enterprise FIN Common Objects Argentina (Oracle PeopleSoft) in the eProcurement component. Affects version 9.1. Easily exploitable by an unauthenticated attacker with network access via HTTP, potentially leading to unauthorized creation, deletion, or modification of critical data and unauthorized access to all data. CVSS 9.1.
- CVE-2026-61237Critical
Vulnerability in PeopleSoft Enterprise FIN Common Objects Argentina (component: Integration) version 9.1. An unauthenticated attacker with network access via HTTP can easily exploit this vulnerability, leading to unauthorized access to critical data, data modification, and partial denial of service. Attacks may impact additional products (scope change).
- CVE-2026-91465High
Vulnerability in PeopleSoft Enterprise FIN Common Objects Argentina (Integration component) version 9.1. An unauthenticated attacker with network access via Oracle Net can gain unauthorized access to critical data. CVSS 7.5.
- CVE-2026-70860Medium
Vulnerability in the PeopleSoft Enterprise FIN Common Objects Argentina product of Oracle PeopleSoft, component eProcurement. Affects version 9.1. A difficult-to-exploit flaw allows a low-privileged attacker with network access via HTTP to compromise the system.
- CVE-2026-61243High
Vulnerability in PeopleSoft Enterprise FIN Common Objects Argentina (Oracle PeopleSoft) component Staffing. Version 9.1 is affected. A low-privileged attacker with network access via HTTP can compromise this product.
- CVE-2026-61070Medium
Vulnerability in PeopleSoft Enterprise FIN Common Objects Argentina (Cash Management component). An unauthenticated attacker via HTTP can cause partial DOS.
Original NVD description (English source)
Vulnerability in the PeopleSoft Enterprise FIN Common Objects Argentina product of Oracle PeopleSoft (component: Asset Management). The supported version that is affected is 9.1. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise FIN Common Objects Argentina. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all PeopleSoft Enterprise FIN Common Objects Argentina accessible data as well as unauthorized access to critical data or complete access to all PeopleSoft Enterprise FIN Common Objects Argentina accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of PeopleSoft Enterprise FIN Common Objects Argentina. CVSS 3.1 Base Score 6.4 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:L).
Vulnerability data from NVD (NIST) · CISA KEV · EPSS