---
id: "CVE-2026-91465"
kind: "vulnerability"
aliases: ["CVE-2026-91465"]
title: "Oracle PeopleSoft FIN Common Objects Argentina: unauthenticated network access to data"
severity: "high"
cvss: 7.5
epss: 0.00303
exploited: false
status: "open"
category: "vendor"
products: []
ecosystems: []
tags: ["finance", "oracle", "oracle-net", "peoplesoft", "vendor"]
not_affected_if: ["oracle-net-not-exposed", "product-not-installed"]
published_at: "2026-10-20T22:20:50+00:00"
first_seen_at: "2026-10-23T21:57:27+00:00"
updated_at: "2026-10-25T12:38:52+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-91465", "first_seen_at": "2026-10-23T21:57:27+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-91465", "first_seen_at": "2026-10-25T12:38:52+00:00"}]
---

# Oracle PeopleSoft FIN Common Objects Argentina: unauthenticated network access to data

An Oracle PeopleSoft Enterprise FIN Common Objects Argentina component (Integration) for version 9.1 can be reached over Oracle Net without credentials. A successful attack gives an attacker unauthorized read access to the application's data.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Confirm whether PeopleSoft Enterprise FIN Common Objects Argentina 9.1 is installed, using the PeopleSoft application inventory
- Check whether the Oracle Net listener for the PeopleSoft environment is reachable from untrusted networks, which the sources do not detail further

## Fix

- Apply the Oracle Critical Patch Update fix for CVE-2026-91465 for PeopleSoft Enterprise FIN Common Objects Argentina 9.1; the exact patch identifier is unknown from the sources
- Restrict Oracle Net access to the PeopleSoft database and application tier to trusted networks until patched

## Timeline

- 2026-10-23T21:57:27+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-91465
- 2026-10-25T12:38:52+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-91465

## From the sources

Vulnerability in the PeopleSoft Enterprise FIN Common Objects Argentina product of Oracle PeopleSoft (component: Integration).   The supported version that is affected is 9.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via Oracle Net to compromise PeopleSoft Enterprise FIN Common Objects Argentina.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all PeopleSoft Enterprise FIN Common Objects Argentina accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_