PeopleSoft FIN Argentina CVE-2026-91466

Exploitation requires an attacker to already hold a HIGH-privilege authenticated account on PeopleSoft Enterprise FIN Common Objects Argentina (per PR:H) AND requires separate human interaction from a victim other than the attacker (per UI:R), such as a legitimate user opening a crafted link or acting on an attacker-supplied request. The affected scope is limited to the Asset Management component of the Argentina FIN Common Objects localization in supported version 9.1 only. These two factors - mandatory elevated privileges and required second-party user interaction - are the primary limiters and prevent remote unauthenticated or fully automated exploitation; organizations not deploying the Argentina localization module are not exposed.

This is a moderate-priority issue (CVSS 3.1 6.4, Medium) best characterized as a high-CVSS-rated flaw with real-world limiting factors rather than an urgent emergency. The CVSS vector (AV:N/AC:L/PR:H/UI:R) shows that although the attack is delivered over the network (HTTP) with low complexity, it requires BOTH high privileges (PR:H - an already-trusted, highly-privileged PeopleSoft account) AND human interaction from a victim other than the attacker (UI:R). These two prerequisites substantially narrow the realistic attacker population to malicious or compromised privileged insiders, or an attacker who has already obtained admin-level credentials. No EPSS score was provided in the input, the CVE is NOT listed in CISA KEV, and no public proof-of-concept is referenced - so there is no public exploit identified at time of analysis. No SSVC decision data was supplied. The one notable data conflict: the input Tags include 'Authentication Bypass,' which directly contradicts the CVSS requirement for PR:H (high privileges) - a genuine authentication bypass would be PR:N. This tag appears mislabeled and should not drive prioritization. Net: patch in the normal Oracle CPU cycle; the privilege-and-interaction barrier makes mass exploitation unlikely.

A PeopleSoft user holding high-privilege access to the FIN Common Objects Argentina / Asset Management module crafts a malicious request or link and induces another legitimate user to interact with it over HTTP, causing unauthorized read, modification, or deletion of critical financial/asset data and a partial denial of service. Because the attacker must already possess elevated privileges and must trick a second human into acting, this is most realistic as an insider-abuse or post-credential-compromise scenario. No public exploit code is referenced in the available data.