CVE-2026-91486 in PeopleSoft Enterprise FIN General Ledger Brazil
Summary
by MITRE • 10/21/2026
Vulnerability in the PeopleSoft Enterprise FIN General Ledger Brazil product of Oracle PeopleSoft (component: General Ledger). The supported version that is affected is 9.1. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where PeopleSoft Enterprise FIN General Ledger Brazil executes to compromise PeopleSoft Enterprise FIN General Ledger Brazil. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of PeopleSoft Enterprise FIN General Ledger Brazil accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of PeopleSoft Enterprise FIN General Ledger Brazil. CVSS 3.1 Base Score 4.4 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L).
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/22/2026
The vulnerability identified in Oracle PeopleSoft Enterprise FIN General Ledger Brazil, specifically within the General Ledger component of version 9.1, represents a significant risk to organizations relying on this enterprise resource planning software for financial management and reporting. This flaw is classified as an easily exploitable issue that requires low-privileged access to the underlying infrastructure where the application executes. The attack vector is local, meaning an attacker must already have valid logon credentials or some form of authenticated access to the server hosting the PeopleSoft environment. Despite requiring authentication, the ease of exploitation and the relatively low privilege level needed make this a critical concern for internal security postures, as it highlights potential weaknesses in role-based access controls or input validation mechanisms within the application logic itself.
From a technical perspective, the core flaw allows an authenticated attacker to manipulate data integrity by performing unauthorized updates, inserts, or deletes against accessible data sets within the General Ledger module. This capability directly compromises the confidentiality and reliability of financial records, which are central to the purpose of this software component. Furthermore, the vulnerability extends beyond mere data manipulation to include availability impacts, specifically enabling a partial denial of service condition. This suggests that the flaw may involve improper handling of resources or state management during specific operations, allowing an attacker to exhaust system resources or trigger errors that degrade the performance and responsiveness of the General Ledger application for legitimate users. The combination of integrity and availability impacts underscores the severity of the defect in a production environment where data accuracy and uptime are paramount.
The operational impact of this vulnerability is substantial for financial departments and IT administrators alike. Unauthorized modifications to general ledger entries can lead to inaccurate financial reporting, potential regulatory non-compliance, and significant reputational damage if discovered externally. The partial denial of service aspect disrupts business continuity by hindering the ability of authorized users to access critical financial data or perform necessary transactions during an attack window. Given that PeopleSoft is often integrated with other enterprise systems such as payroll, accounts payable, and external banking interfaces, a compromise in the General Ledger module can have cascading effects across the broader IT ecosystem. The CVSS 3.1 base score of 4.4 reflects these combined impacts on integrity and availability, indicating a medium severity level that warrants prompt attention to prevent potential exploitation by insiders or attackers who have gained initial foothold access through other means such as phishing or weak credential management.
In terms of industry standard classifications, this vulnerability aligns with CWE-269 Improper Privilege Management if the low-privileged user is able to perform actions reserved for higher privileges, and CWE-78 OS Command Injection or CWE-89 SQL Injection depending on the specific technical mechanism exploited within the General Ledger component. The ability to cause a partial denial of service may also relate to CWE-400 Uncontrolled Resource Consumption if the attack involves resource exhaustion techniques. From an adversary tactics perspective, this aligns with MITRE ATT&CK technique T1530 Data from Cloud Storage or T1213 Data from Information Repositories for data access and modification aspects, while the denial of service component relates to availability attacks that disrupt operational continuity. Understanding these mappings helps in categorizing the risk within broader security frameworks and aligning remediation efforts with established best practices.
Mitigation strategies should focus on both immediate technical controls and long-term architectural improvements. First, ensure that all available patches from Oracle for PeopleSoft Enterprise FIN General Ledger Brazil version 9.1 are applied immediately to address the specific code flaw responsible for this vulnerability. Second, implement strict network segmentation to isolate the PeopleSoft infrastructure from less trusted networks, limiting the attack surface accessible by potential low-privileged attackers. Third, enforce rigorous identity and access management policies, including multi-factor authentication and regular review of user privileges to ensure that only necessary personnel have logon access to the production environment. Additionally, deploying intrusion detection systems tailored for application-layer attacks can help identify attempts to exploit this vulnerability in real-time. Regular security assessments and penetration testing focused on input validation and privilege escalation paths within PeopleSoft modules are recommended to proactively identify similar weaknesses before they can be exploited by malicious actors.