PeopleSoft Manufacturing Brazil EUVD-2026-106783

Exploitation requires the attacker to already have an authenticated low-privileged logon on the infrastructure where PeopleSoft Enterprise FIN Manufacturing Brazil 9.1 executes, and to reach the Integration component - this is local access (AV:L), not remote network exploitation, so it cannot be triggered by an anonymous internet attacker. No user interaction is needed (UI:N) and complexity is low (AC:L), but the dual requirement of local logon plus valid credentials is the primary limiting factor. Only the specific 9.1 version of this Brazil localization module is affected, further narrowing exposure.

This is a genuinely low-to-moderate priority issue, not a high-urgency flaw. The CVSS 3.1 base score is 4.4 (Medium), and the vector (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L) is internally consistent with the description: exploitation requires local logon access to the infrastructure where the product runs (AV:L) plus low-level authenticated privileges (PR:L), which substantially limits the attacker population to insiders or anyone who has already gained a foothold. Impact is capped at partial integrity (I:L - some unauthorized update/insert/delete) and partial availability (A:L - partial DOS), with no confidentiality impact (C:N) and no scope change (S:U). No EPSS score, KEV listing, SSVC decision, or POC was provided in the input; absence of exploitation data combined with the local-only vector and modest impact means there is no 'high-CVSS-but-low-real-risk' tension to reconcile - the signals all point the same direction (low real-world risk). The one caveat: the 'Denial Of Service' tag and the A:L metric agree, so no conflict there. No key signals are contradictory; the main gap is the lack of CWE classification (listed N/A) and no independent exploitation telemetry.

An attacker who already holds a low-privileged account on the server/infrastructure running PeopleSoft Enterprise FIN Manufacturing Brazil leverages a flaw in the Integration component to make unauthorized modifications (update/insert/delete) to a subset of application data and to trigger a partial denial of service of the module. No user interaction is required, but local logon access and valid low-level credentials are prerequisites. No public exploit identified at time of analysis.