CVE-2026-91471

Awaiting Analysis Awaiting Analysis - Queue

Unauthenticated Data Manipulation in PeopleSoft Enterprise CC

Publication date: 2026-10-20

Last updated on: 2026-10-24

Assigner: Oracle

Description

Vulnerability in the PeopleSoft Enterprise CC Common Application Objects product of Oracle PeopleSoft (component: BAM Framework). The supported version that is affected is 9.2. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise CC Common Application Objects. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of PeopleSoft Enterprise CC Common Application Objects accessible data. CVSS 3.1 Base Score 3.7 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-20

Last Modified

2026-10-24

Generated

2026-11-10

AI Q&A

2026-10-21

EPSS Evaluated

2026-11-08

NVD

CVE-2026-91471

EUVD

EUVD-2026-106717

Affected Vendors & Products

Vendor	Product	Version / Range
Oracle Corporation	PeopleSoft Enterprise CC Common Application Objects	9.2

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-284	The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Attack-Flow Graph

Executive Summary

This is a vulnerability in Oracle PeopleSoft Enterprise CC Common Application Objects version 9.2. It allows an unauthenticated attacker with network access via HTTP to potentially modify data in the application. The attack requires some level of difficulty to exploit.

Detection Guidance

Detection of this vulnerability requires monitoring HTTP traffic for unusual requests targeting the PeopleSoft Enterprise CC Common Application Objects component. Check Oracle PeopleSoft logs for unauthorized data modifications or unexpected network access patterns. No specific commands are provided in the available context.

Impact Analysis

An attacker could exploit this to make unauthorized changes to data in the PeopleSoft application, such as updating, inserting, or deleting records. This could lead to data corruption or integrity issues in the affected system.

Compliance Impact

This vulnerability could impact compliance by allowing unauthorized modifications to sensitive data, which may violate integrity requirements in regulations like GDPR or HIPAA. Unauthorized changes to personal or health data could lead to non-compliance penalties.

Mitigation Strategies

Apply the latest Oracle Critical Patch Update (CPU) for PeopleSoft Enterprise CC Common Application Objects version 9.2 to address the vulnerability. Ensure network access controls restrict HTTP traffic to trusted sources only.

Hi! I’m here to help you understand CVE-2026-91471. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...