---
id: "CVE-2026-91480"
kind: "vulnerability"
aliases: ["CVE-2026-91480"]
title: "Oracle PeopleSoft Strategic Sourcing: low-privilege users can read critical data"
severity: "medium"
cvss: 6.5
epss: 0.00326
exploited: false
status: "open"
category: "vendor"
products: []
ecosystems: []
tags: ["erp", "oracle", "peoplesoft", "strategic-sourcing", "vendor"]
not_affected_if: ["not-peoplesoft-scm"]
published_at: "2026-10-20T22:20:51+00:00"
first_seen_at: "2026-10-23T21:57:27+00:00"
updated_at: "2026-10-25T12:38:51+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-91480", "first_seen_at": "2026-10-23T21:57:27+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-91480", "first_seen_at": "2026-10-25T12:38:51+00:00"}]
---

# Oracle PeopleSoft Strategic Sourcing: low-privilege users can read critical data

Oracle PeopleSoft Enterprise SCM Strategic Sourcing 9.2 has a flaw that lets a low-privileged user with network access reach its data over HTTP. A successful attack gives access to critical data accessible to the application, with confidentiality impact only.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Confirm whether PeopleSoft Enterprise SCM Strategic Sourcing 9.2 is deployed, for example in the installed application list or with the PeopleSoft admin console
- unknown for further detection steps; the sources do not say

## Fix

- Apply the Oracle Critical Patch Update fix for PeopleSoft Enterprise SCM Strategic Sourcing 9.2 (patch identifier unknown from the sources)
- unknown for the exact patch number and target version

## Timeline

- 2026-10-23T21:57:27+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-91480
- 2026-10-25T12:38:51+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-91480

## From the sources

Vulnerability in the PeopleSoft Enterprise SCM Strategic Sourcing product of Oracle PeopleSoft (component: Strategic Sourcing).   The supported version that is affected is 9.2. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise SCM Strategic Sourcing.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all PeopleSoft Enterprise SCM Strategic Sourcing accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_