CVE-2026-91474: PeopleSoft Enterprise Privilege Escalation

CVE-2026-91474 Overview

CVE-2026-91474 affects Oracle PeopleSoft Enterprise FIN Common Objects Brazil version 9.1, specifically the eProcurement component. The flaw allows an attacker with high privileges and access to the adjacent network segment where the application runs to compromise confidentiality and integrity of application data. Successful exploitation enables unauthorized creation, deletion, or modification of critical data, along with full read access to all data accessible by the affected component. Oracle addressed the issue in the October 2026 Critical Patch Update.

Critical Impact
Attackers positioned on the adjacent network can read and modify all data accessible to PeopleSoft Enterprise FIN Common Objects Brazil, including financial and procurement records.

Affected Products

Oracle PeopleSoft Enterprise FIN Common Objects Brazil 9.1
PeopleSoft eProcurement component
Oracle PeopleSoft Financials deployments using the Brazil localization

Discovery Timeline

2026-10-20 - CVE-2026-91474 published to the National Vulnerability Database (NVD)
2026-10-21 - Last updated in the NVD database
October 2026 - Oracle releases the Critical Patch Update addressing the vulnerability

Technical Details for CVE-2026-91474

Vulnerability Analysis

The vulnerability resides in the eProcurement component of PeopleSoft Enterprise FIN Common Objects Brazil 9.1. An authenticated attacker with high privileges can exploit the flaw from the adjacent network segment attached to the hardware hosting the application. Exploitation does not require user interaction and has low attack complexity. The impact covers confidentiality and integrity, but not availability. Oracle classifies the issue as easily exploitable once the prerequisites of network adjacency and elevated privileges are met.

Root Cause

Oracle has not published root-cause specifics for CVE-2026-91474. Based on the CVSS metrics, the weakness permits a privileged user on the adjacent network to perform operations against the eProcurement component that bypass intended data-access boundaries. The scope is unchanged, indicating the attack affects only resources managed by the vulnerable component. Review the Oracle Security Advisory for authoritative technical context.

Attack Vector

An attacker must already hold high privileges within the PeopleSoft environment and reach the physical communication segment attached to the host system. From that position, the attacker issues requests to the eProcurement component to read, create, modify, or delete records across all data accessible to the FIN Common Objects Brazil application. No user interaction is required, which widens the window for automated post-compromise abuse by insiders or by attackers who have pivoted onto the application VLAN.

No public proof-of-concept exploit is available at the time of publication. The EPSS probability is approximately 0.228%, placing the CVE in the 12.78 percentile for likelihood of exploitation.

Detection Methods for CVE-2026-91474

Indicators of Compromise

Unexpected create, update, or delete operations against eProcurement tables performed by privileged accounts outside normal business windows.
Database audit entries showing bulk reads of financial or supplier records tied to the FIN Common Objects Brazil schema.
Network sessions to the PeopleSoft application tier originating from hosts on the adjacent segment that are not part of the approved administrative inventory.

Detection Strategies

Enable PeopleSoft application-level audit logging for the eProcurement module and forward records to a centralized analytics platform for correlation.
Baseline privileged account activity on PeopleSoft Financials and alert on deviations such as abnormal data export volume or off-hours administrative actions.
Inspect east-west traffic on the segment hosting the PeopleSoft application tier for unauthorized clients communicating with the eProcurement endpoints.

Monitoring Recommendations

Monitor Oracle database audit trails for the PS_PO_* and PS_REQ_* tables used by eProcurement.
Track authentication events for high-privilege PeopleSoft roles (PeopleSoft Administrator, eProcurement Administrator) and alert on new source hosts.
Review network access control lists quarterly to confirm only sanctioned systems share the adjacent segment with PeopleSoft application servers.

How to Mitigate CVE-2026-91474

Immediate Actions Required

Apply the October 2026 Oracle Critical Patch Update to PeopleSoft Enterprise FIN Common Objects Brazil 9.1 as soon as change windows permit.
Audit high-privilege PeopleSoft accounts and revoke access that is not required for current job functions.
Restrict the adjacent network segment hosting the PeopleSoft application tier to a minimal set of administrative endpoints.

Patch Information

Oracle released a fix for CVE-2026-91474 in the October 2026 Critical Patch Update. Patch binaries and installation guidance are available through My Oracle Support. Refer to the Oracle Security Advisory for the full matrix of affected products and corresponding patch identifiers.

Workarounds

Segment the PeopleSoft application tier using VLAN isolation and host-based firewalls to reduce the attack surface reachable from the adjacent network.
Enforce multi-factor authentication for all PeopleSoft administrative accounts to raise the cost of acquiring the high privileges required for exploitation.
Enable continuous monitoring of eProcurement transactions and configure alerting on anomalous mass-modification or mass-read operations until patching is complete.

bash

# Example: restrict access to the PeopleSoft application tier using iptables
# Allow only approved administrative subnet, drop other adjacent traffic
iptables -A INPUT -p tcp -s 10.10.20.0/28 --dport 7000:7999 -j ACCEPT
iptables -A INPUT -p tcp --dport 7000:7999 -j DROP