CVE-2026-91485 Oracle Corporation CVE debrief

Who should care

Administrators and security teams responsible for PeopleSoft Enterprise FIN Cash Management 9.2 installations should assess exposure and apply patches or mitigations as available to prevent potential unauthorized data access and partial denial of service. They should also review compensating controls for exposed systems and monitor for unauthorized access or partial denial of service.

Why it matters

CVE-2026-91485 is a low-severity vulnerability in PeopleSoft Enterprise FIN Cash Management 9.2 that requires high privileges and human interaction to exploit, potentially leading to unauthorized data access and partial denial of service. Administrators and security teams should assess exposure and apply patches or mitigations as available.

• Potential unauthorized update, insert or delete access to some PeopleSoft Enterprise FIN Cash Management accessible data
• Potential unauthorized read access to a subset of PeopleSoft Enterprise FIN Cash Management accessible data
• Potential partial denial of service (partial DOS) of PeopleSoft Enterprise FIN Cash Management

Technical summary

The vulnerability in PeopleSoft Enterprise FIN Cash Management 9.2 has a CVSS score of 3.8 and can be exploited by high-privileged attackers with logon access, potentially leading to unauthorized data access and partial denial of service. The vulnerability requires human interaction to exploit and can result in unauthorized update, insert or delete access to some PeopleSoft Enterprise FIN Cash Management accessible data as well as unauthorized read access to a subset of PeopleSoft Enterprise FIN Cash Management accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of PeopleSoft Enterprise FIN Cash Management.

Defensive priority

Assess exposure and apply patches or mitigations as available.

Recommended defensive actions

• Assess exposure of PeopleSoft Enterprise FIN Cash Management 9.2 installations
• Review and apply patches or mitigations as available
• Monitor for unauthorized access or partial denial of service
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, but additional information on affected versions and remediation is limited. Further review of Oracle's security alert for CPUOct2026 is recommended to understand the full scope of the vulnerability and potential mitigations. The vulnerability affects PeopleSoft Enterprise FIN Cash Management 9.2 and has a CVSS score of 3.8, indicating a low-severity vulnerability.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.