CVE-2026-91562 in PeopleSoft Enterprise FIN Inventory Brazil
Summary
by MITRE • 10/21/2026
Vulnerability in the PeopleSoft Enterprise FIN Inventory Brazil product of Oracle PeopleSoft (component: Inventory). The supported version that is affected is 9.1. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where PeopleSoft Enterprise FIN Inventory Brazil executes to compromise PeopleSoft Enterprise FIN Inventory Brazil. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of PeopleSoft Enterprise FIN Inventory Brazil accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of PeopleSoft Enterprise FIN Inventory Brazil. CVSS 3.1 Base Score 4.4 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L).
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/21/2026
The vulnerability identified in Oracle PeopleSoft Enterprise FIN Inventory Brazil, specifically within the Inventory component of version 9.1, represents a significant risk to organizations relying on this enterprise resource planning module for managing stock and supply chain operations in Brazilian markets. This flaw is classified as an easily exploitable security weakness that requires low-privileged access to the underlying infrastructure where the PeopleSoft application executes. Unlike vulnerabilities that can be exploited remotely over a network without authentication, this issue necessitates that an attacker first gains logon credentials or shell access to the server hosting the application logic. Once such initial foothold is established through compromised user accounts, malware execution on the host, or insider threats with limited privileges, the vulnerability allows for direct manipulation of the application's data integrity and availability states without requiring additional complex exploitation techniques or social engineering interactions from end-users.
From a technical perspective, this flaw falls under the category of insufficient access control mechanisms within the specific inventory management functions of the PeopleSoft suite. The attacker can leverage their existing low-level privileges to perform unauthorized update, insert, or delete operations on critical database records managed by the Inventory module. This capability directly maps to CWE-269 Improper Privilege Management and CWE-778 Insufficient Logging or Monitoring if the actions are not adequately audited, though the core issue is the lack of proper authorization checks before executing data modification commands. The vulnerability also enables a partial denial of service condition, suggesting that an attacker can disrupt specific inventory processes, such as stock counting, goods receipt processing, or order fulfillment workflows, by corrupting data states or exhausting system resources through malformed requests processed by the vulnerable component. This aligns with ATT&CK technique T1485 Data Destruction and potentially T1078 Valid Accounts if the attacker is using stolen credentials to maintain persistence while exploiting this flaw.
The operational impact of this vulnerability extends beyond simple data corruption, affecting the reliability of financial reporting and supply chain continuity for affected organizations. Since PeopleSoft Enterprise FIN Inventory Brazil handles sensitive transactional data related to stock valuation, cost accounting, and regulatory compliance specific to Brazilian tax laws, unauthorized modifications can lead to significant financial discrepancies and audit failures. The ability to cause a partial denial of service means that critical business processes may halt unexpectedly, leading to operational downtime and potential loss of revenue during the period required for recovery and data restoration from backups. For organizations with strict Service Level Agreements regarding inventory accuracy or system uptime, this vulnerability poses a tangible risk to contractual obligations and customer trust. The CVSS 3.1 base score of 4.4 reflects these moderate impacts on integrity and availability, emphasizing that while the attack vector is local, the consequences for business operations are substantial due to the critical nature of financial inventory data.
Mitigation strategies must focus on both immediate remediation and long-term architectural improvements. The primary defense is applying the latest security patches provided by Oracle for PeopleSoft Enterprise FIN Inventory Brazil version 9.1, which address the underlying code flaws allowing unauthorized access. Organizations should also enforce strict least-privilege principles across their infrastructure, ensuring that service accounts running the application have only the minimum permissions necessary to function and are isolated from general user logon capabilities where possible. Implementing robust network segmentation can limit lateral movement if an attacker gains initial low-level access, preventing them from reaching the server hosting the vulnerable component easily. Additionally, deploying intrusion detection systems configured with signatures for known exploitation patterns of this vulnerability can provide early warning indicators. Regular auditing of database changes and monitoring for anomalous data modification patterns within the inventory module are essential operational controls to detect potential abuse in real-time or during forensic investigations after a breach occurs.