CVE-2026-91480
MediumCVSS 6.5Summary
Vulnerability in the Strategic Sourcing component of PeopleSoft Enterprise SCM Strategic Sourcing (Oracle PeopleSoft) affecting version 9.2. An easily exploitable flaw allows a low-privileged attacker with network access via HTTP to gain unauthorized access to critical data or all data accessible in the application.
Risk Assessment
A low-privileged attacker can access sensitive sourcing data, potentially compromising the confidentiality of procurement and supplier information.
Recommendation
Apply Oracle updates for PeopleSoft Enterprise SCM Strategic Sourcing and restrict network access to the application's HTTP interfaces.
Other vulnerabilities in PeopleSoft Enterprise SCM Strategic Sourcing
See all- CVE-2026-91482Medium
Vulnerability in the Bidder Registration component of PeopleSoft Enterprise SCM Strategic Sourcing (Oracle PeopleSoft) affecting version 9.2. An easily exploitable flaw allows a low-privileged attacker with network access via HTTP to gain unauthorized access to critical data or all data accessible in the application.
- CVE-2026-91478High
Vulnerability in PeopleSoft Enterprise SCM Strategic Sourcing (Strategic Sourcing component) version 9.2. A low-privileged attacker with network access via HTTP can take over the application. CVSS 8.8.
Original NVD description (English source)
Vulnerability in the PeopleSoft Enterprise SCM Strategic Sourcing product of Oracle PeopleSoft (component: Strategic Sourcing). The supported version that is affected is 9.2. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise SCM Strategic Sourcing. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all PeopleSoft Enterprise SCM Strategic Sourcing accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).
Vulnerability data from NVD (NIST) · CISA KEV · EPSS