---
id: "CVE-2026-91562"
kind: "vulnerability"
aliases: ["CVE-2026-91562"]
title: "Oracle PeopleSoft FIN Inventory Brazil: low-privilege users can alter data and degrade service"
severity: "medium"
cvss: 4.4
epss: 0.00103
exploited: false
status: "open"
category: "vendor"
products: []
ecosystems: []
tags: ["erp", "oracle", "peoplesoft", "self-hosted", "vendor"]
not_affected_if: ["no-local-logon-access-to-host", "not-running-peoplesoft-fin-inventory-brazil"]
published_at: "2026-10-20T22:20:59+00:00"
first_seen_at: "2026-10-23T21:57:27+00:00"
updated_at: "2026-10-25T12:38:51+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-91562", "first_seen_at": "2026-10-23T21:57:27+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-91562", "first_seen_at": "2026-10-25T12:38:51+00:00"}]
---

# Oracle PeopleSoft FIN Inventory Brazil: low-privilege users can alter data and degrade service

A flaw in the Inventory component of Oracle PeopleSoft Enterprise FIN Inventory Brazil 9.1 lets a low-privileged user who can log on to the underlying infrastructure modify or delete some accessible data. It also allows a partial denial of service against the application.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Confirm whether PeopleSoft Enterprise FIN Inventory Brazil 9.1 is installed in your environment
- Check the installed PeopleSoft patch level against Oracle's Critical Patch Update advisory for this CVE (unknown from the sources)

## Fix

- Apply the Oracle Critical Patch Update that addresses CVE-2026-91562 for PeopleSoft Enterprise FIN Inventory Brazil 9.1 (exact patch identifier unknown from the sources)

## Timeline

- 2026-10-23T21:57:27+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-91562
- 2026-10-25T12:38:51+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-91562

## From the sources

Vulnerability in the PeopleSoft Enterprise FIN Inventory Brazil product of Oracle PeopleSoft (component: Inventory).   The supported version that is affected is 9.1. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where PeopleSoft Enterprise FIN Inventory Brazil executes to compromise PeopleSoft Enterprise FIN Inventory Brazil.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of PeopleSoft Enterprise FIN Inventory Brazil accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of PeopleSoft Enterprise FIN Inventory Brazil. CVSS 3.1 Base Score 4.4 (Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_