CVE-2026-91559 in PeopleSoft Enterprise FIN Manufacturing Brazil
Summary
by MITRE • 10/21/2026
Vulnerability in the PeopleSoft Enterprise FIN Manufacturing Brazil product of Oracle PeopleSoft (component: Integration). The supported version that is affected is 9.1. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where PeopleSoft Enterprise FIN Manufacturing Brazil executes to compromise PeopleSoft Enterprise FIN Manufacturing Brazil. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of PeopleSoft Enterprise FIN Manufacturing Brazil accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of PeopleSoft Enterprise FIN Manufacturing Brazil. CVSS 3.1 Base Score 4.4 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L).
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/22/2026
The identified vulnerability resides within the Integration component of Oracle PeopleSoft Enterprise FIN Manufacturing Brazil, specifically affecting version 9.1. This software suite is widely utilized by enterprises for financial and manufacturing operations, particularly in regions requiring specific local compliance such as Brazil. The integration layer serves as a critical interface for data exchange between various modules and external systems, making it a high-value target for attackers seeking to disrupt business continuity or manipulate sensitive operational data. The presence of this flaw indicates a deficiency in how the application handles input validation or access control mechanisms within its integration endpoints, allowing malicious actors to exploit weaknesses that bypass standard security boundaries when they have already gained initial foothold on the infrastructure.
The technical nature of this vulnerability allows for exploitation by an attacker with low privileges who has successfully authenticated and logged onto the underlying infrastructure where PeopleSoft Enterprise FIN Manufacturing Brazil executes. This prerequisite implies that the flaw is not remotely exploitable over a network without prior authentication, but rather represents an internal privilege escalation or lateral movement risk within the application server environment. The core technical flaw likely involves improper validation of user inputs or insufficient checks on data modification operations performed through integration interfaces. When triggered, this allows the attacker to perform unauthorized update, insert, or delete actions against accessible data stores managed by the PeopleSoft system. This capability directly undermines the integrity of financial and manufacturing records, potentially leading to corrupted transaction logs, inaccurate inventory counts, or manipulated fiscal reports that could have significant downstream consequences for organizational decision-making and regulatory compliance.
In addition to compromising data integrity, the vulnerability also impacts availability by enabling a partial denial of service condition against PeopleSoft Enterprise FIN Manufacturing Brazil. This means an attacker can degrade system performance or render specific functionalities unavailable without necessarily crashing the entire application server. Such disruptions can halt critical manufacturing workflows or financial processing tasks, leading to operational delays and potential revenue loss. The combination of integrity and availability impacts classifies this as a moderate severity issue with a CVSS 3.1 Base Score of 4.4. The vector string (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L) confirms that the attack requires local access, low complexity, and no user interaction, while resulting in limited confidentiality impact but significant integrity and availability impacts within an unchanged security scope.
From a classification perspective, this vulnerability aligns with CWE-269 Improper Privilege Management or CWE-77 SQL Injection if the data manipulation involves database queries, depending on the specific implementation details of the integration component. It also maps to MITRE ATT&CK techniques related to Data Manipulation and Service Stoppage, specifically within the context of lateral movement after initial compromise. The lack of confidentiality impact suggests that while an attacker cannot directly exfiltrate sensitive data through this specific vector, they can corrupt it or disrupt access to it, which is often a precursor to more severe ransomware attacks or further exploitation attempts targeting other components with higher privilege requirements.
Mitigation strategies should focus on strict adherence to the principle of least privilege within the PeopleSoft environment. Administrators must ensure that service accounts and user profiles associated with integration processes are granted only the minimum permissions necessary for their specific tasks, thereby limiting the blast radius if such an account is compromised. Regular patching is essential; organizations running version 9.1 should apply all available security updates from Oracle to address known flaws in the Integration component. Additionally, implementing robust network segmentation can isolate critical PeopleSoft servers from general corporate networks, reducing the attack surface for low-privileged attackers who might gain access through other means such as phishing or compromised workstations. Monitoring and logging integration activities with high fidelity will also aid in detecting anomalous data modification patterns indicative of exploitation attempts, allowing security teams to respond before significant damage occurs.