PeopleSoft Inventory Brazil EUVD-2026-79474

Exploitation requires (a) a logon to the infrastructure where PeopleSoft Enterprise FIN Inventory Brazil 9.1 executes - i.e. local/interactive host access, not remote network reachability - and (b) only low privileges on that host (CVSS AV:L/PR:L, UI:N). No special PeopleSoft feature flag, non-default configuration or administrative role is documented as a precondition, so the gate is essentially 'any low-privileged local account on the application host' rather than a specific module setting. Limiting factors are significant: the attack is not exploitable over the network, it does not work without valid credentials, and it does not affect PeopleSoft Enterprise FIN Inventory Brazil versions other than 9.1; because Oracle did not publish a CWE, whether database-level access or only OS-level application-server access is sufficient could not be confirmed from the available data.

The Oracle-published CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8) is internally consistent: exploitation is local and requires only a low-privileged logon, is automatable with no user interaction, and yields high impact across all three security objectives. This is a classic insider/shared-host risk profile - high severity but conditional on the attacker already having a foothold on the application host, which sharply narrows the exposed population compared with a network-vector (AV:N) flaw. No EPSS probability, no CISA KEV listing and no public POC were provided; absence of those signals means exploitation status is 'no public exploit identified at time of analysis' and should not be read as proof that exploitation is impossible. The supplied tag 'Information Disclosure' conflicts with the vendor description of full takeover and is treated as a metadata error, not as evidence of a confidentiality-only issue. Overall: prioritize patching alongside the rest of the Oracle CPU cycle, but treat as lower external urgency than an internet-reachable PeopleSoft flaw.

An attacker who already holds a low-privileged account on a host where the PeopleSoft Enterprise FIN Inventory Brazil 9.1 application server or its supporting OS/database service runs logs on interactively and triggers the vulnerable Inventory code path. Because the flaw requires no user interaction and has low attack complexity, the malicious action can be scripted or repeated at will, and the successful result is full compromise of the Inventory application's confidentiality, integrity and availability - enabling fraudulent inventory/financial entries or disruption of the module. Preconditions of an existing local foothold and a valid credential are the main practical barriers, so the realistic actor is an insider, a contractor, or an external attacker who has already pivoted onto the PeopleSoft host.