CVE-2026-91474
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk12th percentile - higher than 12% of all known CVEs
Summary
Vulnerability in Oracle PeopleSoft Enterprise FIN Common Objects Brazil (component eProcurement) version 9.1. A high-privileged attacker with access to the physical communication segment can create, delete, or modify critical data and gain full access to it without authorization.
Risk Assessment
An attacker with high privileges and physical network access could compromise confidentiality and integrity of PeopleSoft data. However, physical presence in the communication segment is required, limiting the attack vector.
Recommendation
Update PeopleSoft Enterprise FIN Common Objects Brazil to the version containing Oracle's fix. Restrict physical access to network segments where PeopleSoft systems operate.
Other vulnerabilities in PeopleSoft Enterprise FIN Common Objects Brazil
See all- CVE-2026-91541Medium
Vulnerability in PeopleSoft Enterprise FIN Common Objects Brazil (Common Objects component) affecting version 9.1. An unauthenticated attacker via HTTP can modify data and cause partial denial of service. CVSS 6.5.
- CVE-2026-91476Medium
Vulnerability in the eProcurement component of PeopleSoft Enterprise FIN Common Objects Brazil (Oracle PeopleSoft) affecting version 9.1. An easily exploitable flaw allows an unauthenticated attacker with network access via HTTP to gain unauthorized read access to a subset of data accessible in the application.
- CVE-2026-70861High
Vulnerability in PeopleSoft Enterprise FIN Common Objects Brazil (component: Common Objects) version 9.1. A high-privileged attacker with network access via T3 or IIOP can compromise the system. Successful attacks may result in full takeover of PeopleSoft Enterprise FIN Common Objects Brazil.
- CVE-2026-61236High
Vulnerability in PeopleSoft Enterprise FIN Common Objects Brazil (version 9.1) allows an unauthenticated attacker via HTTP to gain unauthorized access to all data. CVSS 7.5 (confidentiality only).
- CVE-2026-61232High
Vulnerability in PeopleSoft Enterprise FIN Common Objects Brazil (version 9.1) allows an unauthenticated attacker via HTTP to gain unauthorized access to all data. CVSS 7.5 (confidentiality only).
- CVE-2026-61073High
In PeopleSoft Enterprise FIN Common Objects Brazil version 9.1, a vulnerability in the Purchasing component allows an unauthenticated attacker to remotely access critical data via HTTP. CVSS 7.5 (confidentiality).
Original NVD description (English source)
Vulnerability in the PeopleSoft Enterprise FIN Common Objects Brazil product of Oracle PeopleSoft (component: eProcurement). The supported version that is affected is 9.1. Easily exploitable vulnerability allows high privileged attacker with access to the physical communication segment attached to the hardware where the PeopleSoft Enterprise FIN Common Objects Brazil executes to compromise PeopleSoft Enterprise FIN Common Objects Brazil. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all PeopleSoft Enterprise FIN Common Objects Brazil accessible data as well as unauthorized access to critical data or complete access to all PeopleSoft Enterprise FIN Common Objects Brazil accessible data. CVSS 3.1 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N).
Vulnerability data from NVD (NIST) · CISA KEV · EPSS