CVE-2026-91466 in PeopleSoft Enterprise FIN Common Objects Argentina
Summary
by MITRE • 10/21/2026
Vulnerability in the PeopleSoft Enterprise FIN Common Objects Argentina product of Oracle PeopleSoft (component: Asset Management). The supported version that is affected is 9.1. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise FIN Common Objects Argentina. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all PeopleSoft Enterprise FIN Common Objects Argentina accessible data as well as unauthorized access to critical data or complete access to all PeopleSoft Enterprise FIN Common Objects Argentina accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of PeopleSoft Enterprise FIN Common Objects Argentina. CVSS 3.1 Base Score 6.4 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:L).
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/21/2026
The vulnerability identified in Oracle PeopleSoft Enterprise FIN Common Objects Argentina version 9.1 represents a significant security risk within the asset management module of this enterprise resource planning suite. This component is critical for organizations relying on accurate financial reporting and asset tracking, particularly those operating under Argentine regulatory frameworks which often require specific localizations and data handling procedures. The affected software contains flaws that can be exploited by attackers to compromise the integrity, confidentiality, and availability of sensitive business data managed through this platform.
The technical nature of this vulnerability is characterized as an easily exploitable flaw requiring high privileged access for the attacker initially but also demanding human interaction from a user other than the attacker to fully realize the impact. This specific combination suggests that while the underlying code defect may be straightforward to trigger, it relies on social engineering or phishing tactics where a legitimate authenticated user with elevated privileges is tricked into performing an action that executes malicious logic within the context of their session. The attack vector operates over HTTP, indicating that if not properly secured via TLS encryption in transit, these interactions could potentially be intercepted or manipulated by network-level adversaries who have already gained some foothold or are targeting internal users directly through web-based interfaces.
From a technical standpoint, this vulnerability aligns with CWE-79 for Cross-Site Scripting or similar injection flaws where user input is not sufficiently sanitized before being processed by the backend systems. The requirement for human interaction places it firmly within the ATT&CK technique of Social Engineering, specifically targeting users to bypass automated security controls that might otherwise detect malicious payloads based on signature alone. Because the attacker must already possess high privileges, this vulnerability often serves as a mechanism for privilege escalation or lateral movement if an initial low-privileged account is compromised and then used to exploit this flaw against higher-level accounts through deceptive means.
The operational impact of successful exploitation is severe, encompassing unauthorized creation, deletion, or modification of critical financial data. This directly threatens the integrity of accounting records, asset registers, and compliance reports generated by the system. Furthermore, attackers can gain complete access to all accessible data within PeopleSoft Enterprise FIN Common Objects Argentina, leading to significant confidentiality breaches that could expose proprietary business strategies, employee information, or client details. Additionally, the vulnerability allows for a partial denial of service, disrupting operational continuity and potentially causing financial losses due to downtime in critical asset management workflows.
The CVSS 3.1 base score of 6.4 reflects these combined impacts on confidentiality, integrity, and availability. The vector string (CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:L) highlights that while the attack requires high privileges initially, it is easy to exploit with low complexity once those conditions are met, though it still depends on user interaction. This scoring underscores the importance of strict access control policies and monitoring for anomalous behavior among privileged users within the PeopleSoft environment.
Mitigation strategies must focus on both technical controls and administrative procedures. Oracle should be consulted immediately for available patches or updates that address this specific flaw in version 9.1, as running unpatched software against known vulnerabilities is a primary cause of breaches. Administrators should enforce strict least-privilege principles to ensure that high-level accounts are used only when absolutely necessary and are protected by multi-factor authentication where possible. Network segmentation can help isolate the PeopleSoft environment from less trusted zones, reducing the attack surface for HTTP-based exploits. Furthermore, security awareness training is crucial to mitigate the human interaction aspect of this vulnerability; employees must be educated on recognizing phishing attempts or social engineering tactics that aim to trick them into executing malicious actions within enterprise applications. Regular auditing of privileged account activity can also help detect suspicious behavior indicative of exploitation attempts before significant damage occurs.