---
id: "CVE-2026-91478"
kind: "vulnerability"
aliases: ["CVE-2026-91478"]
title: "Oracle PeopleSoft Strategic Sourcing: low-privilege network user can take over"
severity: "high"
cvss: 8.8
epss: 0.00389
exploited: false
status: "open"
category: "vendor"
products: [{"name": "PeopleSoft Enterprise SCM Strategic Sourcing", "fixed": [], "affected": "9.2", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["oracle", "package", "peoplesoft", "scm", "self-hosted", "strategic-sourcing", "vendor"]
not_affected_if: ["managed-hosting", "strategic-sourcing-not-deployed"]
published_at: "2026-10-20T22:20:51+00:00"
first_seen_at: "2026-10-23T21:57:27+00:00"
updated_at: "2026-10-25T12:38:51+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-91478", "first_seen_at": "2026-10-23T21:57:27+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T23:54:26+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-91478", "first_seen_at": "2026-10-25T12:38:51+00:00"}]
---

# Oracle PeopleSoft Strategic Sourcing: low-privilege network user can take over

Oracle PeopleSoft Enterprise SCM Strategic Sourcing 9.2 has a flaw that lets a low-privileged authenticated user take over the application over HTTP (CVSS 8.8). Fixed in Oracle's October 2026 Critical Patch Update. No exploitation or public PoC found.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:PeopleSoft Enterprise SCM Strategic Sourcing affected 9.2 fixed ?

## How to check

Check whether you run PeopleSoft Enterprise SCM Strategic Sourcing 9.2 (the Strategic Sourcing component of PeopleSoft SCM 9.2). Then check whether the October 2026 CPU patch for it is applied. Look up the patch in the Oracle CPU Oct 2026 PeopleSoft risk matrix and your My Oracle Support patch inventory.

## Fix

Apply the PeopleSoft Strategic Sourcing patch from the Oracle October 2026 CPU through My Oracle Support. The exact patch number is unknown here; the CPU advisory's PeopleSoft section and the linked MOS patch document will settle it.

## Timeline

- 2026-10-23T21:57:27+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-91478
- 2026-10-23T23:54:26+00:00 analyst — Oracle October 2026 CPU (released 2026-10-20) lists PeopleSoft Strategic Sourcing 9.2 as affected; fix is the CPU patch via My Oracle Support. I could not read the risk-matrix row, so the exact patch ID/number is unconfirmed. No exploitation or PoC found; not in KEV.
- 2026-10-25T12:38:51+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-91478

## Documents

- [advisory] Oracle Critical Patch Update Advisory - October 2026 https://www.oracle.com/security-alerts/cpuoct2026.html
- [advisory] Text Form of Oracle CPU October 2026 Risk Matrices https://www.oracle.com/security-alerts/cpuoct2026verbose.html

## From the sources

Vulnerability in the PeopleSoft Enterprise SCM Strategic Sourcing product of Oracle PeopleSoft (component: Strategic Sourcing).   The supported version that is affected is 9.2. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise SCM Strategic Sourcing.  Successful attacks of this vulnerability can result in takeover of PeopleSoft Enterprise SCM Strategic Sourcing. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_