CVE-2026-91481 Oracle Corporation CVE debrief

Who should care

Defenders managing PeopleSoft Enterprise SCM Purchasing instances, especially those with low-privileged network access, should assess exposure and potential impact on connected products.

Why it matters

CVE-2026-91481 is a medium-severity vulnerability in PeopleSoft Enterprise SCM Purchasing that allows low-privileged attackers to compromise the product with human interaction, potentially impacting additional products. Defenders managing these instances should verify exposure, assess impact, and prioritize patching.

• Potential unauthorized data modifications and access
• Possible impact on connected products
• Requires verification of exposure and patching priority
• Needs monitoring for suspicious activity

Technical summary

The vulnerability in PeopleSoft Enterprise SCM Purchasing of Oracle PeopleSoft, with a CVSS score of 5.4, allows low-privileged attackers with network access via HTTP to compromise the product. Successful attacks require human interaction and can result in unauthorized update, insert or delete access to some of PeopleSoft Enterprise SCM Purchasing accessible data as well as unauthorized read access to a subset of PeopleSoft Enterprise SCM Purchasing accessible data.

Defensive priority

Defenders should prioritize verifying exposure in their PeopleSoft Enterprise SCM Purchasing instances, especially those with low-privileged network access, and assess the potential impact on connected products.

Recommended defensive actions

• Verify PeopleSoft Enterprise SCM Purchasing instances for exposure, especially with low-privileged network access
• Assess potential impact on connected products and prioritize patching
• Monitor for suspicious activity and implement compensating controls if patching is not immediate
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, its impacts, and affected components. Oracle's security alert also provides relevant information. The vulnerability affects PeopleSoft Enterprise SCM Purchasing product of Oracle PeopleSoft, specifically component: Supplier Registration. The supported version that is affected is 9.2. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise SCM Purchasing. Successful attacks require humaninteraction

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.