---
id: "CVE-2026-91476"
kind: "vulnerability"
aliases: ["CVE-2026-91476"]
title: "Oracle PeopleSoft FIN Common Objects Brazil: unauthenticated read of some data"
severity: "medium"
cvss: 5.3
epss: 0.00316
exploited: false
status: "open"
category: "vendor"
products: []
ecosystems: []
tags: ["brazil-localization", "eprocurement", "erp", "oracle", "peoplesoft", "vendor"]
not_affected_if: ["different-version", "module-not-deployed"]
published_at: "2026-10-20T22:20:51+00:00"
first_seen_at: "2026-10-23T21:57:27+00:00"
updated_at: "2026-10-25T12:38:51+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-91476", "first_seen_at": "2026-10-23T21:57:27+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-91476", "first_seen_at": "2026-10-25T12:38:51+00:00"}]
---

# Oracle PeopleSoft FIN Common Objects Brazil: unauthenticated read of some data

An unauthenticated attacker with network access over HTTP can read a subset of data in PeopleSoft Enterprise FIN Common Objects Brazil, specifically via the eProcurement component, for version 9.1. The flaw is rated CVSS 5.3 with confidentiality impact only.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Confirm whether the PeopleSoft Enterprise FIN Common Objects Brazil module, eProcurement component, version 9.1 is deployed
- unknown for any further check, the sources do not describe a specific setting or file

## Fix

- Apply the Oracle Critical Patch Update fix for PeopleSoft Enterprise FIN Common Objects Brazil 9.1 eProcurement
- unknown for the exact patch identifier, the sources do not name one

## Timeline

- 2026-10-23T21:57:27+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-91476
- 2026-10-25T12:38:51+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-91476

## From the sources

Vulnerability in the PeopleSoft Enterprise FIN Common Objects Brazil product of Oracle PeopleSoft (component: eProcurement).   The supported version that is affected is 9.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise FIN Common Objects Brazil.  Successful attacks of this vulnerability can result in  unauthorized read access to a subset of PeopleSoft Enterprise FIN Common Objects Brazil accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_