PeopleSoft Inventory Brazil EUVD-2026-106784

Exploitation requires the attacker to possess a valid low-privileged logon to the infrastructure (host/application environment) where PeopleSoft Enterprise FIN Inventory Brazil 9.1 executes, specifically the Inventory component; this is a local-vector flaw (AV:L), so it cannot be triggered by a remote unauthenticated attacker over the network. No end-user interaction is needed (UI:N) and attack complexity is low (AC:L), but the mandatory authenticated local access (PR:L) is the primary limiting factor, confining realistic risk to insiders or attackers who have already gained a foothold on the system. Only version 9.1 is stated as affected.

This is a genuinely low-to-moderate priority issue, not a top-tier emergency, and the signals are internally consistent. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L, base 4.4 MEDIUM) describes a local-vector flaw requiring an attacker to already have a valid low-privileged logon to the infrastructure where PeopleSoft Enterprise FIN Inventory Brazil runs; it is not network-exploitable and has no confidentiality impact (C:N). The practical ceiling is limited: partial integrity impact (unauthorized update/insert/delete to SOME accessible data) and a partial denial of service (A:L). Exploitation status is 'no public exploit identified at time of analysis' - there is no CISA KEV listing, no POC indicator, and no EPSS score supplied in the input, so there is no evidence of active or widespread exploitation. The 'Denial Of Service' tag aligns with the A:L impact and does not indicate a full outage. No data signals conflict here, but note the absence of EPSS/KEV/POC is an absence of evidence rather than confirmation of low exploitation activity. The dominant risk-limiting factor is the required pre-existing authenticated local access, which makes this primarily an insider-threat / post-compromise privilege-abuse concern rather than a perimeter risk.

A low-privileged user who already holds a valid logon to the host/infrastructure running PeopleSoft Enterprise FIN Inventory Brazil 9.1 abuses the Inventory component to tamper with inventory records they should not be able to modify and to degrade availability of the module. No public exploit code has been identified, and the local attack vector means an external unauthenticated attacker cannot reach it directly - the actor must first obtain authenticated local access.