Live › vulnerability › CVE-2026-91466
Go to dashboardAn Oracle PeopleSoft Enterprise FIN Common Objects Argentina flaw in the Asset Management component, version 9.1, lets a highly privileged remote user over HTTP create, modify or delete critical data and partially disrupt service. Exploitation requires a second person to interact with the attacker's crafted action.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Organisations running PeopleSoft Enterprise FIN Common Objects Argentina 9.1 with the Asset Management component exposed over HTTP. The sources do not describe further configuration conditions. Teams without this Oracle product in their estate can skip it.
No product ranges from the sources yet.
9.1 is deployed, and whether the Asset Management component is in use.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Vulnerability in the PeopleSoft Enterprise FIN Common Objects Argentina product of Oracle PeopleSoft (component: Asset Management). The supported version that is affected is 9.1. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise FIN Common Objects Argentina. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all PeopleSoft Enterprise FIN Common Objects Argentina accessible data as well as unauthorized access to critical data or complete access to all PeopleSoft Enterprise FIN Common Objects Argentina accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of PeopleSoft Enterprise FIN Common Objects Argentina. CVSS 3.1 Base Score 6.4 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:L).
This page as .md · .json · in your agent: get_signal("CVE-2026-91466")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.