PeopleSoft Strategic Sourcing CVE-2026-91478

Exploitation requires network reachability to the PeopleSoft Enterprise SCM Strategic Sourcing web interface over HTTP and a valid low-privilege PeopleSoft account (CVSS PR:L - authenticated). No user interaction is required and attack complexity is low, so any authenticated user with access to the Strategic Sourcing component can attempt it against the affected supported version 9.2. The primary limiting factors are the authentication requirement (a valid low-privilege credential must be obtained) and the need for network access to the application tier; environments that restrict Strategic Sourcing exposure to trusted networks and tightly control account provisioning reduce realistic risk.

This is a credible, high-priority vulnerability. The vendor-supplied CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 8.8) describes a network-reachable, low-complexity flaw requiring only low privileges and no user interaction, yielding full confidentiality, integrity and availability loss ('takeover'). All signals that are present align: easy exploitation over HTTP plus complete impact makes this attractive to authenticated insiders or anyone who can obtain any low-privilege PeopleSoft account (common in large ERP deployments with many users). However, several key exploitation signals are MISSING from the input: no EPSS probability was provided, KEV status is not indicated (treat as not listed), and no POC reference exists - so real-world exploitation likelihood cannot be quantified. There is also a tagging conflict: the only technique tag is 'Information Disclosure', yet the CVSS vector and description assert full I:H/A:H takeover, not mere disclosure - the tag understates impact and should not be used to downgrade priority. Net: prioritize patching based on impact and ease of exploitation, but note the absence of exploitation-probability data means the 'likelihood' dimension is unconfirmed.

An attacker holding any low-privilege PeopleSoft application account (or who has phished/obtained one) sends a crafted HTTP request to the Strategic Sourcing component over the network. Because attack complexity is low and no user interaction is needed, the request abuses the flaw to escalate to full control of the Strategic Sourcing application, reading and altering sourcing/procurement data and disrupting availability. No public exploit identified at time of analysis.