---
id: "CVE-2026-91356"
kind: "vulnerability"
aliases: ["CVE-2026-91356"]
title: "Oracle PeopleSoft Global Payroll Switzerland: high-privilege local user can alter data"
severity: "medium"
cvss: 4.2
epss: 0.00143
exploited: false
status: "open"
category: "vendor"
products: []
ecosystems: []
tags: ["hcm", "on-prem", "oracle", "payroll", "peoplesoft", "vendor"]
not_affected_if: ["no-local-logon-exposure", "not-running-peoplesoft-9.2"]
published_at: "2026-10-20T22:20:38+00:00"
first_seen_at: "2026-10-23T21:57:26+00:00"
updated_at: "2026-10-25T12:38:52+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-91356", "first_seen_at": "2026-10-23T21:57:26+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-91356", "first_seen_at": "2026-10-25T12:38:52+00:00"}]
---

# Oracle PeopleSoft Global Payroll Switzerland: high-privilege local user can alter data

Oracle PeopleSoft Enterprise HCM Global Payroll Switzerland 9.2 has a flaw in its Global Payroll for Switzerland component. An attacker who already holds high privileges and a logon to the host running the application can read, change or delete some payroll data and partly disrupt service.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Confirm the product and release: PeopleSoft Enterprise HCM Global Payroll Switzerland `9.2`
- Check whether the Oracle Critical Patch Update advisory for the quarter listed in the NVD entry includes this CVE
- unknown for anything beyond this

## Fix

- Apply the Oracle Critical Patch Update that addresses CVE-2026-91356 for PeopleSoft Enterprise HCM Global Payroll Switzerland `9.2`
- unknown for the exact patch name, as the sources do not give it

## Timeline

- 2026-10-23T21:57:26+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-91356
- 2026-10-25T12:38:52+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-91356

## From the sources

Vulnerability in the PeopleSoft Enterprise HCM Global Payroll Switzerland product of Oracle PeopleSoft (component: Global Payroll for Switzerland).   The supported version that is affected is 9.2. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where PeopleSoft Enterprise HCM Global Payroll Switzerland executes to compromise PeopleSoft Enterprise HCM Global Payroll Switzerland.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of PeopleSoft Enterprise HCM Global Payroll Switzerland accessible data as well as  unauthorized read access to a subset of PeopleSoft Enterprise HCM Global Payroll Switzerland accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of PeopleSoft Enterprise HCM Global Payroll Switzerland. CVSS 3.1 Base Score 4.2 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_