{"id":"CVE-2026-91471","kind":"vulnerability","aliases":["CVE-2026-91471"],"related":[],"title":"Oracle PeopleSoft: BAM Framework flaw allows limited data changes over HTTP","description":"Vulnerability in the PeopleSoft Enterprise CC Common Application Objects product of Oracle PeopleSoft (component: BAM Framework).   The supported version that is affected is 9.2. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise CC Common Application Objects.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of PeopleSoft Enterprise CC Common Application Objects accessible data. CVSS 3.1 Base Score 3.7 (Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N).","summary":"An Oracle PeopleSoft Enterprise CC Common Application Objects 9.2 component (BAM Framework) has a flaw that an unauthenticated network attacker can reach over HTTP. Successful exploitation allows unauthorized update, insert or delete of some accessible data, rated low (CVSS 3.7).","severity":"low","cvss":3.7,"epss":0.00187,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["enterprise-apps","oracle","peoplesoft","vendor"],"not_affected_if":[],"how_to_check":"- unknown","fix":"- unknown","status":"open","published_at":"2026-10-20T22:20:50+00:00","first_seen_at":"2026-10-23T21:57:27+00:00","triaged_at":"2026-10-25T04:43:38+00:00","updated_at":"2026-10-25T12:38:51+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-10-25T04:43:38Z","model":"claude-haiku-5-5","output":{"fix":"- unknown","reach":"network","title":"Oracle PeopleSoft: BAM Framework flaw allows limited data changes over HTTP","impact":"low","summary":"An Oracle PeopleSoft Enterprise CC Common Application Objects 9.2 component (BAM Framework) has a flaw that an unauthenticated network attacker can reach over HTTP. Successful exploitation allows unauthorized update, insert or delete of some accessible data, rated low (CVSS 3.7).","category":"vendor","nicknames":[],"who_cares":["peoplesoft","oracle","enterprise-apps"],"confidence":0.6,"needs_auth":"no","worst_case":"Attacker alters or deletes some accessible PeopleSoft data","analyst_note":"Check Oracle's July CPU advisory or the NVD entry for patch version and the exact affected BAM Framework scope.","how_to_check":"- unknown","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Organizations running Oracle PeopleSoft Enterprise CC Common Application Objects 9.2 with the BAM Framework reachable over HTTP. Sources do not say which deployments are reachable or how exposed they are.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"low"},"cost_usd":0.000579,"input_tokens":3492,"output_tokens":460,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-91471':14A,17A '/av':144C '3.1':134C,143C '3.7':63B,137C '9.2':32B,87C 'access':58B,97C,121C,131C 'affect':85C 'allow':6A,50B,92C 'app':20B 'applic':30B,71C,106C,129C 'attack':43B,94C,109C 'bam':3A,34B,78C 'base':135C 'cc':28B,69C,104C,127C 'chang':9A 'common':29B,70C,105C,128C 'compon':33B,77C 'compromis':101C 'cve':12A,15A 'cvss':62B,133C,140C,142C 'data':8A,59B,132C 'delet':55B,120C 'difficult':88C 'enterpris':19B,27B,68C,103C,126C 'enterprise-app':18B 'exploit':49B,90C 'flaw':5A,38B 'framework':4A,35B,79C 'h/pr':146C 'http':11A,47B,99C 'impact':139C 'insert':53B,118C 'integr':138C 'l/a':151C 'limit':7A 'low':61B 'n':152C 'n/ac':145C 'n/i':150C 'n/s':148C 'n/ui':147C 'network':42B,96C 'object':31B,72C,107C,130C 'oracl':1A,21B,25B,75C 'peoplesoft':2A,22B,26B,67C,76C,102C,125C 'product':73C 'rate':60B 'reach':45B 'result':114C 'score':136C 'success':48B,108C 'support':81C 'u/c':149C 'unauthent':41B,93C 'unauthor':51B,116C 'updat':52B,117C 'vector':141C 'vendor':23B 'version':82C 'via':98C 'vulner':64C,91C,112C","nicknames":[],"mitigations":[],"who_affected":"Organizations running Oracle PeopleSoft Enterprise CC Common Application Objects 9.2 with the BAM Framework reachable over HTTP. Sources do not say which deployments are reachable or how exposed they are.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:20:50+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-91471","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91471","severity":null,"published_at":"2026-10-20T22:20:50+00:00","modified_at":"2026-10-21T18:44:55+00:00","first_seen_at":"2026-10-23T21:57:27+00:00","fetched_at":"2026-10-23T22:29:00+00:00","note":null},{"source":"epss","external_id":"CVE-2026-91471","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-91471","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-25T12:38:51+00:00","fetched_at":"2026-10-25T12:38:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}