PeopleSoft Enterprise CC CVE-2026-91471

Exploitation targets the BAM Framework component of Oracle PeopleSoft Enterprise CC Common Application Objects version 9.2, reachable over HTTP, and requires no authentication (PR:N) and no user interaction (UI:N). The key limiting factor is high attack complexity (AC:H): the vendor explicitly labels this 'difficult to exploit,' meaning the attacker must meet specific conditions outside their direct control to succeed. Impact is further bounded to unauthorized update/insert/delete access to only SOME data (I:L), with no confidentiality or availability impact. Realistic risk is reduced because the instance must be network-exposed and the difficult trigger conditions must be met.

This is a low-severity, low-priority issue despite being network-reachable and unauthenticated. The vendor-supplied CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N, base 3.7) is internally consistent with the description: remote via HTTP, no authentication, but 'difficult to exploit' (AC:H) and limited to partial integrity impact (unauthorized update/insert/delete to SOME accessible data) with no confidentiality or availability impact. The signals are not conflicting - they uniformly point to limited real-world risk. No EPSS score, no CISA KEV listing, and no public POC were provided, and the Oracle CPU advisory format does not indicate active exploitation. The combination of high attack complexity and a scope limited to low integrity impact means that even though the vector is theoretically remote and unauthenticated, exploitation is non-trivial and the payoff is modest. This should be patched on the normal Oracle Critical Patch Update cadence rather than treated as an emergency. Note: CWE is unspecified (N/A) in the input, so the precise flaw class cannot be stated with confidence.

A remote attacker without credentials sends specially crafted HTTP requests to an exposed PeopleSoft Enterprise CC Common Application Objects instance (BAM Framework component), exploiting a difficult-to-trigger flaw to make unauthorized modifications, insertions, or deletions to a subset of application data. The high attack complexity (AC:H) means the attacker must satisfy specific, hard-to-control conditions, so success is not reliable. No public exploit code was identified at time of analysis.