{"id":"CVE-2026-91331","kind":"vulnerability","aliases":["CVE-2026-91331"],"related":[],"title":"Oracle PeopleSoft: high-privilege HTTP attacker can alter some CC application data","description":"Vulnerability in the PeopleSoft Enterprise CC Common Application Objects product of Oracle PeopleSoft (component: Common Application Objects).   The supported version that is affected is 9.2. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise CC Common Application Objects.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of PeopleSoft Enterprise CC Common Application Objects accessible data as well as  unauthorized read access to a subset of PeopleSoft Enterprise CC Common Application Objects accessible data. CVSS 3.1 Base Score 3.8 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N).","summary":"A flaw in the Common Application Objects component of Oracle PeopleSoft Enterprise CC 9.2 lets a user with high privileges over the network read and change a subset of application data. The CVSS 3.1 base score is 3.8 (low), with confidentiality and integrity impact and no availability impact.","severity":"low","cvss":3.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["enterprise-apps","oracle","peoplesoft","vendor"],"not_affected_if":["auth-required"],"how_to_check":"- unknown","fix":"- unknown","status":"open","published_at":"2026-10-20T22:20:35+00:00","first_seen_at":"2026-10-23T21:57:26+00:00","triaged_at":"2026-10-25T04:43:14+00:00","updated_at":"2026-10-25T04:43:14+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-10-25T04:43:14Z","model":"claude-haiku-5-5","output":{"fix":"- unknown","reach":"network","title":"Oracle PeopleSoft: high-privilege HTTP attacker can alter some CC application data","impact":"low","summary":"A flaw in the Common Application Objects component of Oracle PeopleSoft Enterprise CC 9.2 lets a user with high privileges over the network read and change a subset of application data. The CVSS 3.1 base score is 3.8 (low), with confidentiality and integrity impact and no availability impact.","category":"vendor","nicknames":[],"who_cares":["peoplesoft","oracle","enterprise-apps"],"confidence":0.6,"needs_auth":"yes","worst_case":"Some application data readable, insertable, updatable and deletable by a privileged user","analyst_note":"Check Oracle's Critical Patch Update advisory for the fixed PeopleSoft CC 9.2 patch level and the Common Application Objects component details.","how_to_check":"- unknown","needs_analyst":true,"not_affected_if":["auth-required"],"who_is_affected":"Organizations running Oracle PeopleSoft Enterprise CC Common Application Objects 9.2 with HTTP access for privileged users. Sources do not say which deployments are exposed beyond the stated version.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"low"},"cost_usd":0.000587,"input_tokens":3538,"output_tokens":467,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-2026':15A,18A '-91331':16A,19A '/av':175C '3.1':59B,163C,174C '3.8':63B,166C '9.2':39B,98C 'access':108C,132C,142C,149C,160C 'affect':96C 'allow':102C 'alter':9A 'app':22B 'applic':12A,31B,55B,81C,89C,117C,140C,158C 'attack':7A,105C,120C 'avail':72B 'base':60B,164C 'cc':11A,38B,79C,115C,138C,156C 'chang':51B 'common':30B,80C,88C,116C,139C,157C 'compon':33B,87C 'compromis':112C 'confidenti':66B,167C 'cve':14A,17A 'cvss':58B,162C,171C,173C 'data':13A,56B,143C,161C 'delet':131C 'easili':99C 'enterpris':21B,37B,78C,114C,137C,155C 'enterprise-app':20B 'exploit':100C 'flaw':27B 'h/ui':178C 'high':4A,44B,103C 'high-privileg':3A 'http':6A,110C 'impact':69B,73B,170C 'insert':129C 'integr':68B,169C 'l/a':182C 'l/i':181C 'l/pr':177C 'let':40B 'low':64B 'n':183C 'n/ac':176C 'n/s':179C 'network':48B,107C 'object':32B,82C,90C,118C,141C,159C 'oracl':1A,23B,35B,85C 'peoplesoft':2A,24B,36B,77C,86C,113C,136C,154C 'privileg':5A,45B,104C 'product':83C 'read':49B,148C 'result':125C 'score':61B,165C 'subset':53B,152C 'success':119C 'support':92C 'u/c':180C 'unauthor':127C,147C 'updat':128C 'user':42B 'vector':172C 'vendor':25B 'version':93C 'via':109C 'vulner':74C,101C,123C 'well':145C","nicknames":[],"mitigations":[],"who_affected":"Organizations running Oracle PeopleSoft Enterprise CC Common Application Objects 9.2 with HTTP access for privileged users. Sources do not say which deployments are exposed beyond the stated version.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:20:35+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-91331","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91331","severity":null,"published_at":"2026-10-20T22:20:35+00:00","modified_at":"2026-10-21T18:44:40+00:00","first_seen_at":"2026-10-23T21:57:26+00:00","fetched_at":"2026-10-23T22:29:00+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}