PeopleSoft Product Configurator Brazil CVE-2026-91553

Exploitation requires the attacker to already have a valid low-privileged logon (PR:L) on the infrastructure/host where PeopleSoft Enterprise FIN Product Configurator Brazil 9.1 executes, and access is local (AV:L) - there is no remote or unauthenticated path. Impact is bounded to unauthorized insert/update/delete of only 'some' accessible data (I:L) and a partial denial of service (A:L), with no confidentiality exposure (C:N) and no user interaction needed (UI:N). Limiting factors: local access plus pre-existing credentials are both mandatory, the affected component is the Brazil FIN localization of the Product Configurator (only sites using that module are exposed), and only version 9.1 is listed as affected.

This is a low-to-moderate priority issue, not a high-urgency one. The CVSS 3.1 base score is 4.4 (Medium) with vector AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L, meaning exploitation requires local access to the infrastructure (AV:L) plus an existing authenticated low-privileged account (PR:L), and yields only partial integrity impact (I:L) and partial denial of service (A:L) with no confidentiality loss (C:N). Oracle labels it 'easily exploitable' (consistent with AC:L), but the local-vector and authentication prerequisites sharply limit real-world exposure compared to a network-facing flaw. No EPSS score, CISA KEV listing, or public POC was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation. No SSVC decision data was supplied. The signals are internally consistent (the description's 'low privileged attacker with logon to the infrastructure' aligns with AV:L/PR:L), so there is no conflict to flag - the main caveat is simply that this is a post-authentication, local-access, limited-impact bug affecting a niche localization module.

An attacker who already holds a low-privileged application or infrastructure account on the server running PeopleSoft Enterprise FIN Product Configurator Brazil 9.1 abuses the Product Configurator component to make unauthorized inserts, updates, or deletes to a subset of accessible data and to trigger a partial denial of service. Because the attack vector is local and requires valid credentials, it is most plausible as an insider or post-compromise lateral-movement action rather than a remote intrusion. No public exploit code is identified at time of analysis.