PeopleSoft FIN GL CVE-2026-91486

Exploitation requires the attacker to have a valid low-privileged logon (PR:L) to the infrastructure/host where PeopleSoft Enterprise FIN General Ledger Brazil 9.1 executes - this is a local, authenticated prerequisite (AV:L), not remote network access. The affected feature is the General Ledger component of the Brazil financial localization module specifically on version 9.1. Limiting factors that reduce real-world risk: the need for a pre-existing authenticated foothold on the hosting environment, the narrow deployment of a Brazil-specific GL module, and the capped impact (only partial/some data modification and partial DoS, with no confidentiality exposure). No user interaction is required (UI:N).

This is a moderate-severity, low-real-priority issue. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L, base 4.4) tells a consistent story: exploitation requires local logon access to the infrastructure where PeopleSoft Enterprise FIN General Ledger Brazil runs, plus existing low-level privileges (PR:L), and yields only partial integrity impact (I:L) and partial denial of service (A:L) with no confidentiality loss (C:N). There is no scope change (S:U). No EPSS score, no CISA KEV listing, and no public POC were provided in the source data, so there is no signal of active or probable exploitation. The combination of a required authenticated local foothold plus limited impact means this is NOT a drop-everything priority; it should be patched in the normal Oracle Critical Patch Update (October 2026) cycle. Note: the description's phrase 'low privileged attacker with logon to the infrastructure' aligns with the AV:L/PR:L vector, so signals are internally consistent - no contradiction to flag. The main missing signals are EPSS and any exploit-maturity data, which are absent rather than conflicting.

An attacker who already has a low-privileged authenticated account or local logon to the server/environment hosting PeopleSoft Enterprise FIN General Ledger Brazil 9.1 abuses the General Ledger component to make unauthorized updates, inserts, or deletes to a subset of accessible financial data, and can also trigger a partial denial of service of the module. No public exploit code was identified at time of analysis, and the attack requires a pre-existing local foothold rather than remote network access.