{"id":"CVE-2026-91465","kind":"vulnerability","aliases":["CVE-2026-91465"],"related":[],"title":"Oracle PeopleSoft FIN Common Objects Argentina: unauthenticated network access to data","description":"Vulnerability in the PeopleSoft Enterprise FIN Common Objects Argentina product of Oracle PeopleSoft (component: Integration).   The supported version that is affected is 9.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via Oracle Net to compromise PeopleSoft Enterprise FIN Common Objects Argentina.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all PeopleSoft Enterprise FIN Common Objects Argentina accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).","summary":"An Oracle PeopleSoft Enterprise FIN Common Objects Argentina component (Integration) for version 9.1 can be reached over Oracle Net without credentials. A successful attack gives an attacker unauthorized read access to the application's data.","severity":"high","cvss":7.5,"epss":0.00303,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["finance","oracle","oracle-net","peoplesoft","vendor"],"not_affected_if":["oracle-net-not-exposed","product-not-installed"],"how_to_check":"- Confirm whether PeopleSoft Enterprise FIN Common Objects Argentina 9.1 is installed, using the PeopleSoft application inventory\n- Check whether the Oracle Net listener for the PeopleSoft environment is reachable from untrusted networks, which the sources do not detail further","fix":"- Apply the Oracle Critical Patch Update fix for CVE-2026-91465 for PeopleSoft Enterprise FIN Common Objects Argentina 9.1; the exact patch identifier is unknown from the sources\n- Restrict Oracle Net access to the PeopleSoft database and application tier to trusted networks until patched","status":"open","published_at":"2026-10-20T22:20:50+00:00","first_seen_at":"2026-10-23T21:57:27+00:00","triaged_at":"2026-10-25T03:18:21+00:00","updated_at":"2026-10-25T12:38:52+00:00","category":"vendor","confidence":0.7,"triage":{"at":"2026-10-25T03:18:21Z","model":"claude-haiku-5-5","output":{"fix":"- Apply the Oracle Critical Patch Update fix for CVE-2026-91465 for PeopleSoft Enterprise FIN Common Objects Argentina 9.1; the exact patch identifier is unknown from the sources\n- Restrict Oracle Net access to the PeopleSoft database and application tier to trusted networks until patched","reach":"network","title":"Oracle PeopleSoft FIN Common Objects Argentina: unauthenticated network access to data","impact":"medium","summary":"An Oracle PeopleSoft Enterprise FIN Common Objects Argentina component (Integration) for version 9.1 can be reached over Oracle Net without credentials. A successful attack gives an attacker unauthorized read access to the application's data.","category":"vendor","nicknames":[],"who_cares":["peoplesoft","oracle","finance","oracle-net"],"confidence":0.7,"needs_auth":"no","worst_case":"Unauthorized read access to critical PeopleSoft financial data","analyst_note":"Check the Oracle Critical Patch Update advisory for the patch identifier and any exploit status; the NVD entry alone does not give fix versions.","how_to_check":"- Confirm whether PeopleSoft Enterprise FIN Common Objects Argentina 9.1 is installed, using the PeopleSoft application inventory\n- Check whether the Oracle Net listener for the PeopleSoft environment is reachable from untrusted networks, which the sources do not detail further","needs_analyst":true,"not_affected_if":["product-not-installed","oracle-net-not-exposed"],"who_is_affected":"Organisations running PeopleSoft Enterprise FIN Common Objects Argentina 9.1 with the Integration component reachable over Oracle Net. Systems without this product, or where Oracle Net is only reachable from trusted internal hosts, are less exposed. The sources do not say which configurations beyond this are required.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.0007,"input_tokens":3504,"output_tokens":700,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-91465':14A,17A '/av':140C '3.1':130C,139C '7.5':133C '9.1':37B,82C 'access':9A,54B,91C,112C,118C,127C 'affect':80C 'allow':86C 'applic':57B 'argentina':6A,32B,68C,102C,126C 'attack':48B,51B,88C,104C 'base':131C 'common':4A,30B,66C,100C,124C 'complet':117C 'compon':33B,73C 'compromis':96C 'confidenti':134C 'credenti':45B 'critic':114C 'cve':12A,15A 'cvss':129C,136C,138C 'data':11A,59B,115C,128C 'easili':83C 'enterpris':28B,64C,98C,122C 'exploit':84C 'fin':3A,29B,65C,99C,123C 'financ':18B 'give':49B 'h/i':146C 'impact':135C 'integr':34B,74C 'l/pr':142C 'n':148C 'n/a':147C 'n/ac':141C 'n/s':144C 'n/ui':143C 'net':22B,43B,94C 'network':8A,90C 'object':5A,31B,67C,101C,125C 'oracl':1A,19B,21B,26B,42B,71C,93C 'oracle-net':20B 'peoplesoft':2A,23B,27B,63C,72C,97C,121C 'product':69C 'reach':40B 'read':53B 'result':109C 'score':132C 'success':47B,103C 'support':76C 'u/c':145C 'unauthent':7A,87C 'unauthor':52B,111C 'vector':137C 'vendor':24B 'version':36B,77C 'via':92C 'vulner':60C,85C,107C 'without':44B","nicknames":[],"mitigations":[],"who_affected":"Organisations running PeopleSoft Enterprise FIN Common Objects Argentina 9.1 with the Integration component reachable over Oracle Net. Systems without this product, or where Oracle Net is only reachable from trusted internal hosts, are less exposed. The sources do not say which configurations beyond this are required.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:20:50+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-91465","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91465","severity":null,"published_at":"2026-10-20T22:20:50+00:00","modified_at":"2026-10-21T18:44:55+00:00","first_seen_at":"2026-10-23T21:57:27+00:00","fetched_at":"2026-10-23T22:29:00+00:00","note":null},{"source":"epss","external_id":"CVE-2026-91465","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-91465","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-25T12:38:52+00:00","fetched_at":"2026-10-25T12:38:52+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}