PeopleSoft Enterprise CC CVE-2026-91331

Exploitation requires the attacker to already hold a high-privileged (administrative-level) account on the target PeopleSoft Enterprise CC Common Application Objects 9.2 instance and network access to it over HTTP; no user interaction is needed (UI:N) and attack complexity is low (AC:L). The dominant limiting factor is PR:H - without pre-existing privileged credentials the vulnerability cannot be triggered - which confines realistic risk to malicious or compromised privileged insiders rather than unauthenticated remote attackers. Only version 9.2 is reported affected, and impact is bounded to a subset of accessible data (C:L/I:L, no availability impact).

This is a low-priority vulnerability by every available signal. The CVSS 3.1 base score is 3.8 (Low) with vector AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N: although the attack vector is network-based over HTTP with low complexity and no user interaction, exploitation requires PR:H - an attacker who already holds high (administrative) privileges on the PeopleSoft instance. Impact is limited to partial confidentiality and integrity (C:L/I:L) with no availability impact, meaning an attacker gains unauthorized read of a subset of data and unauthorized insert/update/delete of some data, but no full compromise or scope change (S:U). No EPSS score was supplied, the CVE is not listed in CISA KEV, and no public exploit code was identified, so there is no public exploit identified at time of analysis. The practical ceiling on risk is the PR:H requirement: a high-privileged user abusing their access yields modest additional impact, which is why the vendor rated it Low. Note a conflicting signal in the input metadata: the 'Authentication Bypass' tag contradicts the CVSS vector, which explicitly requires high privileges (PR:H) rather than bypassing authentication - treat that tag as unreliable and verify against Oracle's advisory.

An attacker who has already obtained a high-privileged PeopleSoft account sends crafted HTTP requests to the Common Application Objects component to read a subset of accessible data and to insert, update, or delete some records beyond their intended authorization. No public exploit code is known, and the scenario is effectively a privileged-insider or post-compromise abuse rather than a remote break-in, given the PR:H requirement and the low (C:L/I:L) impact.