Live › vulnerability › CVE-2026-91485
Go to dashboardOracle PeopleSoft Enterprise FIN Cash Management 9.2 has a flaw that lets an attacker who already holds high privileges on the host running it read, change or delete a subset of accessible data and partly disrupt the service. Exploitation is hard and needs a second person to take an action, per the CVSS vector.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Only organisations running PeopleSoft Enterprise FIN Cash Management 9.2 are named as affected. Exposure requires an attacker who already has high privileges and logon on the infrastructure where the application runs, so the risk sits with administrators and the internal hosts, not with external users. Teams not running PeopleSoft Cash Management can skip it.
No product ranges from the sources yet.
9.2, using the PeopleSoft installation or the application's version pageEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Vulnerability in the PeopleSoft Enterprise FIN Cash Management product of Oracle PeopleSoft (component: Cash Management). The supported version that is affected is 9.2. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where PeopleSoft Enterprise FIN Cash Management executes to compromise PeopleSoft Enterprise FIN Cash Management. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of PeopleSoft Enterprise FIN Cash Management accessible data as well as unauthorized read access to a subset of PeopleSoft Enterprise FIN Cash Management accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of PeopleSoft Enterprise FIN Cash Management. CVSS 3.1 Base Score 3.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:L).
This page as .md · .json · in your agent: get_signal("CVE-2026-91485")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.