---
id: "CVE-2026-91331"
kind: "vulnerability"
aliases: ["CVE-2026-91331"]
title: "Oracle PeopleSoft: high-privilege HTTP attacker can alter some CC application data"
severity: "low"
cvss: 3.8
epss: 0.00257
exploited: false
status: "open"
category: "vendor"
products: []
ecosystems: []
tags: ["enterprise-apps", "oracle", "peoplesoft", "vendor"]
not_affected_if: ["auth-required"]
published_at: "2026-10-20T22:20:35+00:00"
first_seen_at: "2026-10-23T21:57:26+00:00"
updated_at: "2026-10-25T12:38:52+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-91331", "first_seen_at": "2026-10-23T21:57:26+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-91331", "first_seen_at": "2026-10-25T12:38:52+00:00"}]
---

# Oracle PeopleSoft: high-privilege HTTP attacker can alter some CC application data

A flaw in the Common Application Objects component of Oracle PeopleSoft Enterprise CC 9.2 lets a user with high privileges over the network read and change a subset of application data. The CVSS 3.1 base score is 3.8 (low), with confidentiality and integrity impact and no availability impact.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- unknown

## Fix

- unknown

## Timeline

- 2026-10-23T21:57:26+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-91331
- 2026-10-25T12:38:52+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-91331

## From the sources

Vulnerability in the PeopleSoft Enterprise CC Common Application Objects product of Oracle PeopleSoft (component: Common Application Objects).   The supported version that is affected is 9.2. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise CC Common Application Objects.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of PeopleSoft Enterprise CC Common Application Objects accessible data as well as  unauthorized read access to a subset of PeopleSoft Enterprise CC Common Application Objects accessible data. CVSS 3.1 Base Score 3.8 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_