CVE-2026-91481 in PeopleSoft Enterprise SCM Purchasing
Summary
by MITRE • 10/21/2026
Vulnerability in the PeopleSoft Enterprise SCM Purchasing product of Oracle PeopleSoft (component: Supplier Registration). The supported version that is affected is 9.2. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise SCM Purchasing. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in PeopleSoft Enterprise SCM Purchasing, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of PeopleSoft Enterprise SCM Purchasing accessible data as well as unauthorized read access to a subset of PeopleSoft Enterprise SCM Purchasing accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N).
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/22/2026
The vulnerability identified in Oracle PeopleSoft Enterprise SCM Purchasing, specifically within the Supplier Registration component of version 9.2, represents a significant security risk that stems from insufficient access control mechanisms. This flaw allows an attacker with low privileges and network access via HTTP to compromise the integrity and confidentiality of the application data. The core technical issue lies in the improper enforcement of authorization checks during supplier registration processes, which enables unauthorized actors to manipulate or view sensitive information without proper authentication or privilege escalation beyond their assigned role.
From a technical perspective, this vulnerability is classified as an insecure direct object reference or broken access control flaw, aligning with CWE-269 (Improper Privilege Control) and CWE-862 (Missing Authorization). The attack vector requires the presence of human interaction, indicating that the exploitation likely involves social engineering tactics such as phishing. An attacker would need to deceive a legitimate user into performing an action or clicking on a malicious link while logged into the PeopleSoft environment. This reliance on UI:R in the CVSS v3.1 vector highlights the importance of user awareness alongside technical controls, as the vulnerability cannot be exploited purely through automated network attacks without this human element.
The operational impact of successfully exploiting this vulnerability is substantial due to its scope change characteristic. While the flaw resides within PeopleSoft Enterprise SCM Purchasing, successful exploitation can lead to a broader compromise affecting additional products in the Oracle ecosystem. This lateral movement capability means that an attacker gaining unauthorized update, insert, or delete access to supplier data could potentially disrupt supply chain operations, alter vendor payment details, or exfiltrate confidential business information. The ability to perform unauthorized read and write operations on accessible data undermines the trustworthiness of procurement processes and can lead to financial fraud or operational disruption.
In terms of industry frameworks, this vulnerability maps directly to MITRE ATT&CK technique T1078 (Valid Accounts) when combined with social engineering for initial access, followed by T1048 (Exfiltration Over Alternative Protocol) if data is stolen via HTTP, and T1136 (Create Account) or T1195 (Compromise Inheritance Chain) depending on the specific exploitation path. The CVSS 3.1 base score of 5.4 reflects a medium severity level, driven by low attack complexity and availability requirements but mitigated slightly by the need for user interaction. However, the scope change elevates the potential business impact significantly beyond the immediate application layer.
Mitigation strategies must focus on both technical controls and organizational processes. Oracle has released patches to address this vulnerability in PeopleSoft Enterprise SCM Purchasing version 9.2, and administrators should prioritize applying these updates immediately. Additionally, implementing strict network segmentation can limit HTTP access to sensitive components like Supplier Registration from untrusted networks. Multi-factor authentication for all user accounts reduces the risk of credential compromise through phishing, while security awareness training helps employees recognize social engineering attempts that could trigger this vulnerability. Regular auditing of supplier registration activities and monitoring for anomalous data changes can also aid in early detection of exploitation attempts.