PeopleSoft Financials CVE-2026-91541

The target must expose the PeopleSoft Enterprise application/web tier serving the FIN Common Objects Brazil module (version 9.1) over HTTP to the attacker; per CVSS PR:N/UI:N/AC:L no authentication, user interaction, or special configuration is required once that HTTP endpoint is reachable. The practical limiting factor is deployment scope rather than exploit difficulty: only organizations running PeopleSoft Financials with the Brazil localization are affected, and exposure further depends on whether the PeopleSoft web tier is reachable by the attacker (internet-facing versus internal-only). Impact is inherently capped to partial integrity changes to some data and a partial denial of service, with no confidentiality exposure.

This is a mid-severity (CVSS 3.1 base 6.5) issue whose vector (AV:N/AC:L/PR:N/UI:N) describes an easily exploitable, unauthenticated, network-reachable flaw over HTTP, which normally warrants attention. However, the impact is deliberately bounded: Oracle scopes it to C:N, I:L, A:L - no confidentiality loss, only partial/unauthorized update-insert-delete access to 'some' data and a partial denial of service. No EPSS score, KEV listing, or public POC is present in the provided data, so there is no evidence of active or imminent exploitation. The signals are therefore consistent rather than conflicting: a genuinely low-friction attack path paired with limited, partial impact, as is typical of Oracle Critical Patch Update web-tier findings. Net judgment: a real but moderate-priority issue - patch in the normal Oracle CPU cycle rather than as an emergency - with the important caveat that the affected component (PeopleSoft FIN Common Objects Brazil) is a region-specific financial localization module with a narrow deployment footprint, which further lowers real-world fleet exposure. No independent exploitation data was supplied to override the CVSS-derived assessment.

A remote, unauthenticated attacker reaches the internet- or intranet-facing PeopleSoft web/application tier over HTTP and sends a crafted request to the vulnerable Common Objects functionality, achieving limited unauthorized modification of some application data or triggering a partial denial of service against the Brazil financials module. No public exploit code was identified at time of analysis, and the low attack complexity (AC:L) means no special timing, configuration, or user interaction is needed once the HTTP endpoint is reachable.