PeopleSoft SCM Purchasing CVE-2026-91481

Exploitation requires the attacker to hold a low-privileged authenticated account with access to the Supplier Registration component of PeopleSoft Enterprise SCM Purchasing 9.2 (PR:L), and it additionally requires human interaction from a different victim user who must view or interact with the attacker-supplied content (UI:R) - the attack cannot complete autonomously. The scope change (S:C) means successful exploitation can impact resources beyond the Purchasing component itself. Limiting factors that reduce realistic risk: no exploitation against a purely anonymous attacker (authentication needed), dependence on a victim interacting with the malicious content, and impact restricted to partial read plus partial update/insert/delete with no availability impact. Only version 9.2 with the Supplier Registration component is identified as affected.

This is a medium-severity issue (CVSS 3.1 base 5.4) that should be treated as a routine but non-urgent patch priority rather than an emergency. The CVSS vector (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) shows network reachability and low attack complexity, but two signals meaningfully dampen real-world risk: PR:L means the attacker must already hold a low-privileged account, and UI:R means a separate victim must interact with attacker-supplied content for the attack to land. The scope change (S:C) plus the combination of partial confidentiality and integrity impact with no availability impact, low privileges, and required user interaction is the classic fingerprint of a stored/reflected cross-site scripting (XSS) flaw in a self-service web component - note that the 'Authentication Bypass' tag is inconsistent with PR:L and with the described impact and appears mislabeled. No EPSS score, no CISA KEV listing, and no public POC were provided in the input, so there is no evidence of active exploitation or widespread automated attack interest. Net assessment: a legitimate but moderate vulnerability whose exploitation is gated by prior authentication and social engineering, not a high-urgency critical. No conflicting attack-vector/description signals were found; the main data gaps are the absent EPSS/KEV/POC telemetry and the absence of an assigned CWE.

A low-privileged user (for example, a supplier with a self-service account reaching the Supplier Registration component over HTTP) submits crafted input that is later rendered to another user such as a procurement or administrative staff member. When that victim views the attacker-controlled content, the payload executes in their session context, and because the vulnerability carries a scope change it can affect data or functionality beyond the Purchasing component. No public exploit code was identified in the provided intelligence at time of analysis.