PeopleSoft Strategic Sourcing CVE-2026-91480

Exploitation requires the attacker to already hold a valid low-privilege account on the PeopleSoft Enterprise SCM Strategic Sourcing application (CVSS PR:L; description: 'low privileged attacker'), reachable over HTTP to the Strategic Sourcing component of version 9.2. No user interaction is needed (UI:N) and attack complexity is low (AC:L). The principal limiting factor is the authentication requirement - this is not exploitable by fully unauthenticated attackers - which narrows the threat to insiders or adversaries who have already compromised or provisioned a foothold account; impact is confined to confidentiality (reading accessible data), with no integrity or availability effect.

This is a moderate-priority issue, not a top-tier emergency. The CVSS 3.1 base score is 6.5 (Medium) with vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N: network-reachable over HTTP, low attack complexity, but requiring low-level privileges (PR:L) and no user interaction, with impact limited to confidentiality (C:H, I:N, A:N) - an authenticated user can read all data accessible to the Strategic Sourcing module but cannot modify data or disrupt availability. No EPSS score was provided in the input, so exploitation probability cannot be quantified. There is no CISA KEV listing and no public exploit identified at time of analysis, so this is not confirmed to be under active exploitation. A notable conflict exists: the input Tags include 'Authentication Bypass,' but both the Oracle description ('low privileged attacker') and the CVSS vector (PR:L) indicate exploitation requires an existing authenticated low-privilege account - this is NOT an unauthenticated authentication bypass, and the tag appears mislabeled (see data_quality_flags). The PR:L requirement meaningfully lowers real-world risk versus an unauthenticated flaw, confining exposure to attackers who already hold or can obtain a foothold account.

An attacker holding a low-privilege PeopleSoft Enterprise SCM Strategic Sourcing account (or who has phished/obtained such credentials) sends crafted HTTP requests to the Strategic Sourcing component to read data beyond their authorization, up to all data the module can access. Because attack complexity is low and no user interaction is needed, exploitation is straightforward once authenticated, though no public exploit code has been identified at time of analysis.