CVE-2026-91264 in PeopleSoft Enterprise SCM Manufacturing
Summary
by MITRE • 10/21/2026
Vulnerability in the PeopleSoft Enterprise SCM Manufacturing product of Oracle PeopleSoft (component: Security). The supported version that is affected is 9.2. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise SCM Manufacturing. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of PeopleSoft Enterprise SCM Manufacturing accessible data. CVSS 3.1 Base Score 3.7 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N).
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/21/2026
The identified vulnerability resides within the Security component of Oracle PeopleSoft Enterprise SCM Manufacturing, specifically affecting version 9.2. This flaw represents a significant security deficiency that permits unauthenticated actors to compromise the integrity of the application's data stores. The core technical issue stems from insufficient access control mechanisms or validation checks within the HTTP-based interface of the product. Because the vulnerability is classified as difficult to exploit, it likely requires specific conditions or precise timing to trigger successfully, such as manipulating complex request parameters or exploiting race conditions in authentication logic. However, the absence of required authentication for this attack vector means that any external actor with network connectivity to the affected system can attempt exploitation without needing valid credentials.
From a technical perspective, the vulnerability allows an attacker who has network access via HTTP to perform unauthorized data manipulation operations. These operations include updates, inserts, and deletes against accessible data within the PeopleSoft Enterprise SCM Manufacturing environment. This capability directly impacts the integrity of the application's database, allowing malicious actors to alter manufacturing records, supply chain data, or inventory levels without authorization. The CVSS 3.1 base score of 3.7 reflects a low severity rating primarily due to the high complexity required for exploitation and the lack of impact on confidentiality or availability. Nevertheless, even a low-severity integrity violation can have severe operational consequences in an enterprise manufacturing context where data accuracy is critical for production planning and resource allocation.
The operational impact of this vulnerability extends beyond simple data corruption. In supply chain management systems like PeopleSoft SCM Manufacturing, accurate data is essential for maintaining the continuity of operations. Unauthorized modifications to inventory levels could lead to stockouts or overstocking situations, disrupting manufacturing schedules. Similarly, tampering with production orders or material requirements planning data can cause significant financial losses and operational inefficiencies. While the vulnerability does not directly compromise confidentiality by exposing sensitive information nor affect availability by causing service outages, the erosion of trust in system integrity poses a long-term risk to organizational decision-making processes based on this data.
This vulnerability aligns with CWE-269, which describes Improper Privilege Management, as it allows an unauthenticated user to perform actions that should be restricted to authorized personnel. Furthermore, from the perspective of the MITRE ATT&CK framework, this behavior corresponds to techniques involving Data Manipulation and potentially Initial Access if combined with other vectors, though here the focus is strictly on post-exploitation data integrity violations. The attack vector being network-based (AV:N) highlights that remote exploitation over standard web protocols is possible, making it a concern for systems exposed to internal or external networks without adequate perimeter security controls.
Mitigation strategies should prioritize immediate patching of Oracle PeopleSoft Enterprise SCM Manufacturing to version 9.2 with the latest available security updates released by Oracle. Organizations must ensure their vulnerability management processes are configured to detect and apply these patches promptly upon release. In addition to software remediation, network segmentation is recommended to restrict HTTP access to the affected application components only from trusted IP ranges or specific user segments that require legitimate business access. Implementing Web Application Firewalls can also provide an additional layer of defense by detecting and blocking anomalous request patterns associated with exploitation attempts for this type of integrity-focused vulnerability. Regular security audits and penetration testing should be conducted to identify similar weaknesses in authentication and authorization logic across the enterprise application portfolio.