CVE-2026-91485 in PeopleSoft Enterprise FIN Cash Management
Summary
by MITRE • 10/21/2026
Vulnerability in the PeopleSoft Enterprise FIN Cash Management product of Oracle PeopleSoft (component: Cash Management). The supported version that is affected is 9.2. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where PeopleSoft Enterprise FIN Cash Management executes to compromise PeopleSoft Enterprise FIN Cash Management. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of PeopleSoft Enterprise FIN Cash Management accessible data as well as unauthorized read access to a subset of PeopleSoft Enterprise FIN Cash Management accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of PeopleSoft Enterprise FIN Cash Management. CVSS 3.1 Base Score 3.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:L).
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/21/2026
The vulnerability identified in Oracle PeopleSoft Enterprise FIN Cash Management version 9.2 represents a significant risk to the integrity and availability of financial data processing systems, despite its relatively low base CVSS score of 3.8. This flaw is categorized as an access control issue that requires specific conditions to be met for exploitation, primarily involving high-privileged attackers who have already gained logon access to the infrastructure hosting the PeopleSoft application. The complexity of this vulnerability lies in its requirement for human interaction from a user other than the attacker, which classifies it under social engineering vectors where an unsuspecting privileged user may inadvertently trigger the malicious action through legitimate-looking interactions within the system interface.
From a technical perspective, the core flaw allows for unauthorized modifications to data accessible by PeopleSoft Enterprise FIN Cash Management. Specifically, attackers can achieve unauthorized updates, inserts, or deletes against certain datasets, which directly compromises data integrity. Furthermore, the vulnerability permits unauthorized read access to a subset of sensitive financial information and enables partial denial-of-service conditions that disrupt normal operational capabilities. These outcomes align with common weakness enumerations such as CWE-269 for Improper Privilege Management and CWE-74 for Injection in an Incorrect Context, suggesting that the application fails to properly validate user inputs or enforce strict separation between administrative functions and standard user operations when complex interactions are involved.
The operational impact of this vulnerability extends beyond simple data corruption. The ability to cause a partial denial of service means that critical financial reporting modules could become unresponsive during peak processing times, leading to potential delays in cash flow management and reconciliation processes. For organizations relying on real-time or near-real-time financial visibility, such disruptions can have cascading effects on decision-making and compliance with regulatory standards like SOX which mandate accurate and timely financial records. The requirement for human interaction significantly narrows the attack surface compared to remote code execution flaws but does not eliminate risk; it shifts the threat model towards insider threats or compromised high-privilege accounts that are tricked into performing specific actions within the application environment.
Mitigation strategies must focus on strict access control and behavioral monitoring given the nature of this flaw. Organizations should enforce the principle of least privilege, ensuring that users with administrative capabilities do not routinely perform standard data entry tasks where such vulnerabilities might be triggered. Implementing multi-factor authentication for all privileged accounts adds a layer of verification that can prevent unauthorized actions even if credentials are compromised through social engineering. Additionally, deploying Web Application Firewalls configured to detect anomalous sequences of requests associated with this specific vulnerability pattern can help block exploitation attempts before they reach the application logic. Regular auditing of user activities and reviewing logs for unusual patterns of data modification or service degradation will aid in early detection and response.
In terms of threat intelligence frameworks, this vulnerability maps to MITRE ATT&CK techniques involving privilege escalation via social engineering and potential impact on availability through resource exhaustion. Security teams should prioritize patching the PeopleSoft Enterprise FIN Cash Management component to version 9.2 with all available security updates that address these specific access control flaws. Continuous monitoring of system logs for signs of unauthorized data manipulation or service interruptions is essential, as is educating users about the risks associated with interacting with suspicious requests from other privileged individuals within the organization.