{"id":"CVE-2026-91476","kind":"vulnerability","aliases":["CVE-2026-91476"],"related":[],"title":"Oracle PeopleSoft FIN Common Objects Brazil: unauthenticated read of some data","description":"Vulnerability in the PeopleSoft Enterprise FIN Common Objects Brazil product of Oracle PeopleSoft (component: eProcurement).   The supported version that is affected is 9.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise FIN Common Objects Brazil.  Successful attacks of this vulnerability can result in  unauthorized read access to a subset of PeopleSoft Enterprise FIN Common Objects Brazil accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).","summary":"An unauthenticated attacker with network access over HTTP can read a subset of data in PeopleSoft Enterprise FIN Common Objects Brazil, specifically via the eProcurement component, for version 9.1. The flaw is rated CVSS 5.3 with confidentiality impact only.","severity":"medium","cvss":5.3,"epss":0.00316,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["brazil-localization","eprocurement","erp","oracle","peoplesoft","vendor"],"not_affected_if":["different-version","module-not-deployed"],"how_to_check":"- Confirm whether the PeopleSoft Enterprise FIN Common Objects Brazil module, eProcurement component, version 9.1 is deployed\n- unknown for any further check, the sources do not describe a specific setting or file","fix":"- Apply the Oracle Critical Patch Update fix for PeopleSoft Enterprise FIN Common Objects Brazil 9.1 eProcurement\n- unknown for the exact patch identifier, the sources do not name one","status":"open","published_at":"2026-10-20T22:20:51+00:00","first_seen_at":"2026-10-23T21:57:27+00:00","triaged_at":"2026-10-25T04:22:31+00:00","updated_at":"2026-10-25T12:38:51+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-10-25T04:22:31Z","model":"claude-haiku-5-5","output":{"fix":"- Apply the Oracle Critical Patch Update fix for PeopleSoft Enterprise FIN Common Objects Brazil 9.1 eProcurement\n- unknown for the exact patch identifier, the sources do not name one","reach":"internet","title":"Oracle PeopleSoft FIN Common Objects Brazil: unauthenticated read of some data","impact":"low","summary":"An unauthenticated attacker with network access over HTTP can read a subset of data in PeopleSoft Enterprise FIN Common Objects Brazil, specifically via the eProcurement component, for version 9.1. The flaw is rated CVSS 5.3 with confidentiality impact only.","category":"vendor","nicknames":[],"who_cares":["peoplesoft","oracle","erp","eprocurement","brazil-localization"],"confidence":0.6,"needs_auth":"no","worst_case":"Attacker reads a subset of accessible PeopleSoft data without logging in","analyst_note":"Check the Oracle Security Alert advisory for the patch level and whether eProcurement exposure is required; sources give only the NVD text.","how_to_check":"- Confirm whether the PeopleSoft Enterprise FIN Common Objects Brazil module, eProcurement component, version 9.1 is deployed\n- unknown for any further check, the sources do not describe a specific setting or file","needs_analyst":true,"not_affected_if":["module-not-deployed","different-version"],"who_is_affected":"Organizations running Oracle PeopleSoft Enterprise FIN Common Objects Brazil version 9.1 with the eProcurement component reachable over HTTP. Sites without this module or version, or without network exposure of the component, can likely skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000666,"input_tokens":3501,"output_tokens":632,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-91476':14A,17A '/av':140C '3.1':130C,139C '5.3':60B,133C '9.1':54B,86C 'access':31B,95C,116C,127C 'affect':84C 'allow':90C 'attack':28B,92C,107C 'base':131C 'brazil':6A,19B,46B,72C,105C,126C 'brazil-loc':18B 'common':4A,44B,70C,103C,124C 'compon':51B,77C 'compromis':99C 'confidenti':62B,134C 'cve':12A,15A 'cvss':59B,129C,136C,138C 'data':11A,39B,128C 'easili':87C 'enterpris':42B,68C,101C,122C 'eprocur':21B,50B,78C 'erp':22B 'exploit':88C 'fin':3A,43B,69C,102C,123C 'flaw':56B 'http':33B,97C 'impact':63B,135C 'l/i':146C 'l/pr':142C 'local':20B 'n':148C 'n/a':147C 'n/ac':141C 'n/s':144C 'n/ui':143C 'network':30B,94C 'object':5A,45B,71C,104C,125C 'oracl':1A,23B,75C 'peoplesoft':2A,24B,41B,67C,76C,100C,121C 'product':73C 'rate':58B 'read':8A,35B,115C 'result':112C 'score':132C 'specif':47B 'subset':37B,119C 'success':106C 'support':80C 'u/c':145C 'unauthent':7A,27B,91C 'unauthor':114C 'vector':137C 'vendor':25B 'version':53B,81C 'via':48B,96C 'vulner':64C,89C,110C","nicknames":[],"mitigations":[],"who_affected":"Organizations running Oracle PeopleSoft Enterprise FIN Common Objects Brazil version 9.1 with the eProcurement component reachable over HTTP. Sites without this module or version, or without network exposure of the component, can likely skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:20:51+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-91476","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91476","severity":null,"published_at":"2026-10-20T22:20:51+00:00","modified_at":"2026-10-21T18:44:55+00:00","first_seen_at":"2026-10-23T21:57:27+00:00","fetched_at":"2026-10-23T22:29:00+00:00","note":null},{"source":"epss","external_id":"CVE-2026-91476","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-91476","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-25T12:38:51+00:00","fetched_at":"2026-10-25T12:38:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}