{"id":"CVE-2026-91480","kind":"vulnerability","aliases":["CVE-2026-91480"],"related":[],"title":"Oracle PeopleSoft Strategic Sourcing: low-privilege users can read critical data","description":"Vulnerability in the PeopleSoft Enterprise SCM Strategic Sourcing product of Oracle PeopleSoft (component: Strategic Sourcing).   The supported version that is affected is 9.2. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise SCM Strategic Sourcing.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all PeopleSoft Enterprise SCM Strategic Sourcing accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).","summary":"Oracle PeopleSoft Enterprise SCM Strategic Sourcing 9.2 has a flaw that lets a low-privileged user with network access reach its data over HTTP. A successful attack gives access to critical data accessible to the application, with confidentiality impact only.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["erp","oracle","peoplesoft","strategic-sourcing","vendor"],"not_affected_if":["not-peoplesoft-scm"],"how_to_check":"- Confirm whether PeopleSoft Enterprise SCM Strategic Sourcing 9.2 is deployed, for example in the installed application list or with the PeopleSoft admin console\n- unknown for further detection steps; the sources do not say","fix":"- Apply the Oracle Critical Patch Update fix for PeopleSoft Enterprise SCM Strategic Sourcing 9.2 (patch identifier unknown from the sources)\n- unknown for the exact patch number and target version","status":"open","published_at":"2026-10-20T22:20:51+00:00","first_seen_at":"2026-10-23T21:57:27+00:00","triaged_at":"2026-10-25T03:49:23+00:00","updated_at":"2026-10-25T03:49:23+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-10-25T03:49:23Z","model":"claude-haiku-5-5","output":{"fix":"- Apply the Oracle Critical Patch Update fix for PeopleSoft Enterprise SCM Strategic Sourcing 9.2 (patch identifier unknown from the sources)\n- unknown for the exact patch number and target version","reach":"network","title":"Oracle PeopleSoft Strategic Sourcing: low-privilege users can read critical data","impact":"medium","summary":"Oracle PeopleSoft Enterprise SCM Strategic Sourcing 9.2 has a flaw that lets a low-privileged user with network access reach its data over HTTP. A successful attack gives access to critical data accessible to the application, with confidentiality impact only.","category":"vendor","nicknames":[],"who_cares":["peoplesoft","oracle","erp","strategic-sourcing"],"confidence":0.6,"needs_auth":"yes","worst_case":"Attacker reads critical data accessible to the application","analyst_note":"Check the Oracle Critical Patch Update advisory for the fixed patch and the exact affected component details; the NVD entry gives no patch information.","how_to_check":"- Confirm whether PeopleSoft Enterprise SCM Strategic Sourcing 9.2 is deployed, for example in the installed application list or with the PeopleSoft admin console\n- unknown for further detection steps; the sources do not say","needs_analyst":true,"not_affected_if":["not-peoplesoft-scm"],"who_is_affected":"Organizations running Oracle PeopleSoft Enterprise SCM Strategic Sourcing 9.2 with HTTP access reachable by low-privileged users. The sources do not say which configurations are exposed, so unknown whether internet-facing deployments are more at risk. Teams not running this PeopleSoft module can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000675,"input_tokens":3511,"output_tokens":648,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-91480':15A,18A '/av':144C '3.1':134C,143C '6.5':137C '9.2':32B,88C 'access':45B,55B,59B,98C,117C,123C,131C 'affect':86C 'allow':92C 'applic':62B 'attack':53B,95C,109C 'base':135C 'complet':122C 'compon':78C 'compromis':102C 'confidenti':64B,138C 'critic':11A,57B,119C 'cve':13A,16A 'cvss':133C,140C,142C 'data':12A,48B,58B,120C,132C 'easili':89C 'enterpris':28B,70C,104C,127C 'erp':19B 'exploit':90C 'flaw':35B 'give':54B 'h/i':150C 'http':50B,100C 'impact':65B,139C 'l/pr':146C 'l/ui':147C 'let':37B 'low':6A,40B,93C 'low-privileg':5A,39B 'n':152C 'n/a':151C 'n/ac':145C 'n/s':148C 'network':44B,97C 'oracl':1A,20B,26B,76C 'peoplesoft':2A,21B,27B,69C,77C,103C,126C 'privileg':7A,41B,94C 'product':74C 'reach':46B 'read':10A 'result':114C 'scm':29B,71C,105C,128C 'score':136C 'sourc':4A,24B,31B,73C,80C,107C,130C 'strateg':3A,23B,30B,72C,79C,106C,129C 'strategic-sourc':22B 'success':52B,108C 'support':82C 'u/c':149C 'unauthor':116C 'user':8A,42B 'vector':141C 'vendor':25B 'version':83C 'via':99C 'vulner':66C,91C,112C","nicknames":[],"mitigations":[],"who_affected":"Organizations running Oracle PeopleSoft Enterprise SCM Strategic Sourcing 9.2 with HTTP access reachable by low-privileged users. The sources do not say which configurations are exposed, so unknown whether internet-facing deployments are more at risk. Teams not running this PeopleSoft module can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:20:51+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-91480","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91480","severity":null,"published_at":"2026-10-20T22:20:51+00:00","modified_at":"2026-10-21T18:44:55+00:00","first_seen_at":"2026-10-23T21:57:27+00:00","fetched_at":"2026-10-23T22:29:00+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}