{"id":"CVE-2026-91478","kind":"vulnerability","aliases":["CVE-2026-91478"],"related":[],"title":"Oracle PeopleSoft Strategic Sourcing: low-privilege network user can take over","description":"Vulnerability in the PeopleSoft Enterprise SCM Strategic Sourcing product of Oracle PeopleSoft (component: Strategic Sourcing).   The supported version that is affected is 9.2. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise SCM Strategic Sourcing.  Successful attacks of this vulnerability can result in takeover of PeopleSoft Enterprise SCM Strategic Sourcing. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).","summary":"Oracle PeopleSoft Enterprise SCM Strategic Sourcing 9.2 has a flaw that lets a low-privileged authenticated user take over the application over HTTP (CVSS 8.8). Fixed in Oracle's October 2026 Critical Patch Update. No exploitation or public PoC found.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"PeopleSoft Enterprise SCM Strategic Sourcing","fixed":[],"affected":"9.2","ecosystem":"vendor"}],"ecosystems":[],"tags":["oracle","package","peoplesoft","scm","self-hosted","strategic-sourcing","vendor"],"not_affected_if":["managed-hosting","strategic-sourcing-not-deployed"],"how_to_check":"Check whether you run PeopleSoft Enterprise SCM Strategic Sourcing 9.2 (the Strategic Sourcing component of PeopleSoft SCM 9.2). Then check whether the October 2026 CPU patch for it is applied. Look up the patch in the Oracle CPU Oct 2026 PeopleSoft risk matrix and your My Oracle Support patch inventory.","fix":"Apply the PeopleSoft Strategic Sourcing patch from the Oracle October 2026 CPU through My Oracle Support. The exact patch number is unknown here; the CPU advisory's PeopleSoft section and the linked MOS patch document will settle it.","status":"open","published_at":"2026-10-20T22:20:51+00:00","first_seen_at":"2026-10-23T21:57:27+00:00","triaged_at":"2026-10-23T22:33:57+00:00","updated_at":"2026-10-23T23:54:26+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-10-23T22:33:57Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Oracle PeopleSoft Strategic Sourcing: low-privilege network user can take over","impact":"high","summary":"Oracle PeopleSoft Enterprise SCM Strategic Sourcing 9.2 has a flaw that lets a low-privileged user reach it over HTTP. Successful exploitation gives an attacker full takeover of the application, per the CVSS vector (high confidentiality, integrity and availability impact).","category":"vendor","who_cares":["oracle","peoplesoft","strategic-sourcing"],"confidence":0.7,"needs_auth":"yes","worst_case":"Attacker takes over the PeopleSoft Strategic Sourcing application and its data","analyst_note":"Find the Oracle Critical Patch Update advisory and patch list for PeopleSoft Strategic Sourcing 9.2 at https://nvd.nist.gov/vuln/detail/CVE-2026-91478 and confirm the fixed patch level.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["strategic-sourcing-not-deployed"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000527,"input_tokens":3116,"output_tokens":431,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the Oracle Critical Patch Update advisory and patch list for PeopleSoft Strategic Sourcing 9.2 at https://nvd.nist.gov/vuln/detail/CVE-2026-91478 and confirm the fixed patch level.","search":"'-2026':13A,16A '-91478':14A,17A '/av':146C '2026':65B '3.1':133C,145C '8.8':59B,136C '9.2':40B,97C 'access':107C 'affect':95C 'allow':101C 'applic':55B 'attack':104C,118C 'authent':50B 'avail':140C 'base':134C 'compon':87C 'compromis':111C 'confidenti':137C 'critic':66B 'cve':12A,15A 'cvss':58B,132C,142C,144C 'easili':98C 'enterpris':36B,79C,113C,128C 'enterprise':19A 'exploit':70B,99C 'fix':60B 'flaw':43B 'found':74B 'h':154C 'h/a':153C 'h/i':152C 'host':29B 'http':57B,109C 'impact':141C 'integr':138C 'l/pr':148C 'l/ui':149C 'let':45B 'low':6A,48B,102C 'low-privileg':5A,47B 'n/ac':147C 'n/s':150C 'network':8A,106C 'octob':64B 'oracl':1A,23B,34B,62B,85C 'packag':24B 'patch':67B 'peoplesoft':2A,18A,25B,35B,78C,86C,112C,127C 'poc':73B 'privileg':7A,49B,103C 'product':83C 'public':72B 'result':123C 'scm':20A,26B,37B,80C,114C,129C 'score':135C 'self':28B 'self-host':27B 'sourc':4A,32B,39B,82C,89C,116C,131C 'sourcing':22A 'strateg':3A,31B,38B,81C,88C,115C,130C 'strategic':21A 'strategic-sourc':30B 'success':117C 'support':91C 'take':11A,52B 'takeov':125C 'u/c':151C 'updat':68B 'user':9A,51B 'vector':143C 'vendor':33B 'version':92C 'via':108C 'vulner':75C,100C,121C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:20:51+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-91478","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91478","severity":null,"published_at":"2026-10-20T22:20:51+00:00","modified_at":"2026-10-23T04:18:19+00:00","first_seen_at":"2026-10-23T21:57:27+00:00","fetched_at":"2026-10-23T22:29:00+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-91478:543","url":null,"severity":null,"published_at":"2026-10-23T23:54:26+00:00","modified_at":"2026-10-23T23:54:26+00:00","first_seen_at":"2026-10-23T23:54:26+00:00","fetched_at":"2026-10-23T23:54:26+00:00","note":"Oracle October 2026 CPU (released 2026-10-20) lists PeopleSoft Strategic Sourcing 9.2 as affected; fix is the CPU patch via My Oracle Support. I could not read the risk-matrix row, so the exact patch ID/number is unconfirmed. No exploitation or PoC found; not in KEV."}],"documents":[{"id":1637,"url":"https://www.oracle.com/security-alerts/cpuoct2026.html","title":"Oracle Critical Patch Update Advisory - October 2026","kind":"advisory","source":"analyst","text":"Lists Oracle E-Business Suite, versions 12.2.3-12.2.15 as affected; patches via Patch Availability Document (MOS). Released 2026-10-20.","published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1639,"url":"https://www.oracle.com/security-alerts/cpuoct2026verbose.html","title":"Text Form of Oracle CPU October 2026 Risk Matrices","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}