PeopleSoft eProcurement CVE-2026-91476

Requires a network-reachable PeopleSoft Enterprise FIN Common Objects Brazil 9.1 deployment exposing the eProcurement component over HTTP; per CVSS PR:N/UI:N no authentication or user interaction is needed and default configurations are reachable. The primary LIMITING factors are product-specific: this is the Brazilian financials localization module, so only PeopleSoft Financials installations that have deployed the Brazil Common Objects on version 9.1 are affected, and impact is confined to read-only disclosure of a subset of data (no write/modify or availability effect). Exposure is further limited where eProcurement is not internet-facing or sits behind access controls.

This is a moderate-severity information-disclosure flaw (CVSS 3.1 base 5.3) rather than a top-priority emergency. The vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N confirms a low-complexity, remote, unauthenticated attack over HTTP, which raises the practical ease of exploitation, but the impact is capped at low confidentiality only (C:L) with no integrity or availability impact, and Oracle explicitly scopes the result to 'unauthorized read access to a subset' of data. No EPSS score, SSVC decision, KEV listing, or POC indicator was supplied in the input, so exploitation probability and automatability cannot be quantified - these key signals are MISSING. There is a notable tension in the metadata: the input carries an 'Authentication Bypass' tag, yet Oracle describes the issue strictly as unauthorized read access and the CVSS reflects only a confidentiality leak, so the tag appears to overstate the vulnerability class - treat the flaw as an information-disclosure/unauthorized-read issue, not a full auth bypass, and verify against Oracle's CPU October 2026 advisory. Overall this is a 'patch in normal cycle' item: easily exploitable and unauthenticated, but low single-impact and tied to a narrow Brazil-localization module, so it is not a high-real-risk crisis absent evidence of active exploitation.

A remote, unauthenticated attacker sends crafted HTTP requests to an internet- or network-reachable PeopleSoft eProcurement endpoint running the FIN Common Objects Brazil 9.1 module and retrieves a subset of otherwise-protected PeopleSoft data without logging in. The low attack complexity (AC:L) and lack of required privileges or user interaction mean the request can be issued directly against a default-reachable HTTP service. No public exploit was identified in the provided data, so exploitation would currently require independent research or reverse-engineering of the October 2026 CPU fix.