PeopleSoft FIN Common Objects Brazil CVE-2026-91474

Exploitation requires the attacker to (1) hold a high-privileged account on the PeopleSoft Enterprise FIN Common Objects Brazil 9.1 deployment (PR:H - not an unauthenticated or bypass scenario), and (2) have access to the physical communication segment attached to the hardware running the module (AV:A - adjacent network, not routable internet access). No user interaction is required (UI:N) and attack complexity is low (AC:L) once those prerequisites are met. The limiting factors are significant: the combined need for pre-existing high privileges and local/adjacent network proximity means only insiders or an attacker who has already established a strong foothold can exploit it, and only the eProcurement component of the Brazil financial localization module is affected.

This is a moderate-severity (CVSS 6.1) Oracle PeopleSoft flaw whose real-world risk is substantially constrained by its own access requirements. The vector (CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N) requires AV:A (adjacent - the attacker must be on the physical communication segment attached to the host) AND PR:H (an already high-privileged account), which together make opportunistic or remote mass exploitation implausible despite the 'easily exploitable' phrasing in Oracle's description. The high confidentiality and integrity impact (C:H/I:H) is real - full read and modify access to all data the module can reach - but an attacker who already holds high privileges on the system and local network proximity has largely already won, limiting the marginal risk this adds. No EPSS score, CISA KEV listing, or POC was provided in the input, so there is no signal of active or probable exploitation; absence of these is consistent with a vendor-disclosed (Oracle CPU) issue rather than an in-the-wild threat. Note a conflict in the input: the 'Authentication Bypass' tag contradicts the CVSS PR:H requirement - a genuine authentication bypass would be PR:N, so the tag appears mislabeled and should not drive prioritization. Overall this is a high-CVSS-component but low-real-world-urgency issue suitable for routine quarterly patch cycles, not emergency response.

An attacker who already holds a high-privileged PeopleSoft account and can reach the adjacent network segment of the host running the FIN Common Objects Brazil module (component: eProcurement) sends crafted requests to read or tamper with procurement/financial data. Because impact is C:H/I:H, they can exfiltrate or modify all data accessible to the module. No public exploit identified at time of analysis, and no user interaction is required (UI:N).