CVE-2026-91478
HighCVSS 8.8Summary
Vulnerability in PeopleSoft Enterprise SCM Strategic Sourcing (Strategic Sourcing component) version 9.2. A low-privileged attacker with network access via HTTP can take over the application. CVSS 8.8.
Risk Assessment
Potential takeover of the SCM application, leading to compromise of confidentiality, integrity and availability of business data.
Recommendation
Apply Oracle updates and restrict network access to the application and user privileges.
Other vulnerabilities in PeopleSoft Enterprise SCM Strategic Sourcing
See all- CVE-2026-91482Medium
Vulnerability in the Bidder Registration component of PeopleSoft Enterprise SCM Strategic Sourcing (Oracle PeopleSoft) affecting version 9.2. An easily exploitable flaw allows a low-privileged attacker with network access via HTTP to gain unauthorized access to critical data or all data accessible in the application.
- CVE-2026-91480Medium
Vulnerability in the Strategic Sourcing component of PeopleSoft Enterprise SCM Strategic Sourcing (Oracle PeopleSoft) affecting version 9.2. An easily exploitable flaw allows a low-privileged attacker with network access via HTTP to gain unauthorized access to critical data or all data accessible in the application.
Original NVD description (English source)
Vulnerability in the PeopleSoft Enterprise SCM Strategic Sourcing product of Oracle PeopleSoft (component: Strategic Sourcing). The supported version that is affected is 9.2. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise SCM Strategic Sourcing. Successful attacks of this vulnerability can result in takeover of PeopleSoft Enterprise SCM Strategic Sourcing. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Vulnerability data from NVD (NIST) · CISA KEV · EPSS