CVE-2026-91465 in PeopleSoft Enterprise FIN Common Objects Argentina
Summary
by MITRE • 10/21/2026
Vulnerability in the PeopleSoft Enterprise FIN Common Objects Argentina product of Oracle PeopleSoft (component: Integration). The supported version that is affected is 9.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via Oracle Net to compromise PeopleSoft Enterprise FIN Common Objects Argentina. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all PeopleSoft Enterprise FIN Common Objects Argentina accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/21/2026
The vulnerability identified in Oracle PeopleSoft Enterprise FIN Common Objects Argentina, specifically within the Integration component of version 9.1, represents a significant security risk due to its potential for unauthenticated exploitation over network connections. This flaw allows an attacker who has access via Oracle Net to compromise the integrity and confidentiality of the system without requiring any form of user authentication or interaction. The absence of required privileges means that remote attackers can initiate attacks from anywhere on the network, provided they have connectivity to the affected service port. This characteristic aligns with Common Weakness Enumeration (CWE) categories related to insufficient authentication mechanisms, where the application fails to verify the identity of users before granting access to sensitive resources or executing privileged operations.
From a technical perspective, the core issue lies in how the Integration component handles incoming requests from Oracle Net clients. The system appears to process certain inputs without adequately validating the source credentials or enforcing proper session management protocols. This oversight enables an unauthenticated actor to interact with internal APIs or data retrieval functions that should be restricted to authorized personnel only. By leveraging this weakness, an attacker can bypass standard security controls and directly access underlying database structures or application logic layers designed for administrative use. Such behavior is often associated with CWE-287 Improper Authentication, where the system fails to correctly establish or maintain user identity during critical operations.
The operational impact of successfully exploiting this vulnerability is severe, primarily centered around data confidentiality breaches. As indicated by the CVSS 3.1 base score of 7.5 and a high confidentiality impact rating, successful exploitation grants unauthorized access to critical financial data stored within the PeopleSoft environment. This includes sensitive information such as payroll records, vendor payments, tax filings, and general ledger entries specific to Argentine regulatory requirements. In worst-case scenarios, an attacker could achieve complete read-access to all accessible data within the FIN Common Objects Argentina module. While the current assessment notes no immediate impact on integrity or availability, the exposure of highly confidential financial information can lead to significant legal liabilities under regulations like GDPR or local Argentine data protection laws, as well as reputational damage and potential fraud if the stolen data is misused by competitors or malicious actors.
In terms of threat modeling, this vulnerability maps closely to MITRE ATT&CK techniques involving Initial Access through network services that lack proper authentication checks. Attackers can utilize automated scanning tools to identify vulnerable instances on open ports and then execute targeted requests to extract sensitive records without triggering typical intrusion detection alerts associated with brute-force or credential-stuffing attacks. The simplicity of the attack vector, requiring only network access and low complexity, makes it particularly attractive for opportunistic attackers seeking quick wins against poorly patched enterprise systems.
To mitigate this risk, immediate action is required from system administrators and security teams responsible for maintaining Oracle PeopleSoft environments. The primary remediation step involves applying the latest available patches or updates provided by Oracle that address this specific integration component flaw. Organizations should verify their current version status and ensure that all critical components are updated to a secure baseline. In addition to patching, implementing network-level controls such as firewalls can help restrict access to the affected service ports only from trusted IP addresses known to host legitimate PeopleSoft clients. This reduces the attack surface by preventing unauthenticated connections from external or unauthorized internal networks. Furthermore, enabling detailed logging and monitoring for unusual query patterns directed at integration endpoints can aid in early detection of exploitation attempts while patches are being deployed across the infrastructure.