CVE-2026-91480 in PeopleSoft Enterprise SCM Strategic Sourcing
Summary
by MITRE • 10/21/2026
Vulnerability in the PeopleSoft Enterprise SCM Strategic Sourcing product of Oracle PeopleSoft (component: Strategic Sourcing). The supported version that is affected is 9.2. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise SCM Strategic Sourcing. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all PeopleSoft Enterprise SCM Strategic Sourcing accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/21/2026
The vulnerability identified within Oracle PeopleSoft Enterprise SCM Strategic Sourcing version 9.2 represents a significant security risk to organizations relying on this enterprise resource planning module for procurement and sourcing operations. This specific component is designed to manage strategic sourcing activities, including supplier selection, contract management, and bid evaluation processes that often involve sensitive commercial data. The affected software contains an implementation flaw that permits unauthorized access to critical information stored within the application database or file system. Because the vulnerability allows a low-privileged attacker with network access via HTTP to compromise the system, it indicates a failure in proper authorization checks or input validation mechanisms that should restrict user actions based on their assigned roles and permissions.
From a technical perspective, this flaw aligns closely with CWE Category 269, which covers Improper Privilege Management, specifically where an actor is able to perform actions beyond what they are authorized to do. The attack vector being network-based via HTTP suggests that the vulnerability can be triggered remotely without requiring user interaction or physical access to a workstation. This characteristic places it firmly within the MITRE ATT&CK framework under techniques related to Remote Services and potentially Account Manipulation if the attacker escalates privileges further after initial access. The low complexity of exploitation means that automated tools could easily detect and exploit this weakness, increasing the likelihood of successful attacks against unpatched systems exposed to internal or external networks.
The operational impact of this vulnerability is severe due to its high confidentiality impact as indicated by the CVSS 3.1 base score of 6.5. Successful exploitation allows an attacker to view sensitive data that should be restricted, such as supplier pricing agreements, bid details, contract terms, and internal procurement strategies. In a strategic sourcing context, this information is highly valuable for competitive intelligence purposes or malicious actors seeking to manipulate supply chains. While the current assessment highlights confidentiality impacts with no immediate impact on integrity or availability according to the provided vector, unauthorized access often serves as an initial foothold that can lead to further compromise of the broader PeopleSoft environment if not contained and remediated promptly.
Mitigation strategies must prioritize the application of official security patches released by Oracle for PeopleSoft Enterprise SCM Strategic Sourcing version 9.2. Organizations should verify their current patch level against the latest Critical Patch Update recommendations from Oracle Support. In addition to applying updates, implementing network segmentation is crucial to limit HTTP access to only necessary administrative and user endpoints. Web Application Firewalls can be configured with specific rulesets to detect and block requests that attempt to exploit this authorization bypass mechanism. Regular auditing of user permissions within PeopleSoft ensures that the principle of least privilege is enforced, reducing the potential impact if a low-privileged account credentials are compromised through other vectors such as phishing or credential stuffing attacks.