CVE-2026-91486 Oracle Corporation CVE debrief

Who should care

Defenders responsible for PeopleSoft Enterprise FIN General Ledger Brazil deployments should assess exposure and prioritize verification and potential remediation based on the vulnerability details provided by Oracle and the CVE/NVD records.

Why it matters

CVE-2026-91486 is a medium-severity vulnerability in PeopleSoft Enterprise FIN General Ledger Brazil that allows low-privileged attackers to cause unauthorized data changes and partial denial of service. Defenders should verify exposure, prioritize remediation, and monitor for suspicious activity.

• Potential unauthorized data modifications by low-privileged attackers
• Partial denial of service (DOS) could impact system availability
• Need for verification of exposure in PeopleSoft Enterprise FIN General Ledger Brazil deployments
• Prioritization of updates or patches from Oracle to mitigate risks

Technical summary

The vulnerability in PeopleSoft Enterprise FIN General Ledger Brazil, part of Oracle PeopleSoft, is easily exploitable by a low-privileged attacker with logon access. Successful attacks can result in unauthorized update, insert or delete access to some accessible data and a partial denial of service (partial DOS). The CVSS 3.1 Base Score is 4.4 with Integrity and Availability impacts. The vector is CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L. Defenders should prioritize verifying exposure in their PeopleSoft Enterprise FIN General Ledger Brazil deployments and assess the need for updates or patches from Oracle.

Defensive priority

Defenders should prioritize verifying exposure in their PeopleSoft Enterprise FIN General Ledger Brazil deployments and assess the need for updates or patches from Oracle.

Recommended defensive actions

• Verify PeopleSoft Enterprise FIN General Ledger Brazil deployments for exposure
• Assess the need for updates or patches from Oracle
• Monitor system logs for suspicious activity related to PeopleSoft Enterprise FIN General Ledger Brazil
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, its impacts, and affected versions. Oracle's security alert documentation is referenced for further information. The vulnerability has a CVSS 3.1 Base Score of 4.4 with Integrity and Availability impacts. The vector is CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L. Defenders should verify exposure in their PeopleSoft Enterprise FIN General Ledger Brazil deployments and assess the need for updates or patches from Oracle.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.