CVE-2026-91478: PeopleSoft Strategic Sourcing Auth Bypass

CVE-2026-91478 Overview

CVE-2026-91478 is a high-severity access control vulnerability in Oracle PeopleSoft Enterprise SCM Strategic Sourcing version 9.2. The flaw resides in the Strategic Sourcing component and allows a low-privileged attacker with network access over HTTP to compromise the application. Successful exploitation can result in full takeover of the PeopleSoft Enterprise SCM Strategic Sourcing instance, impacting confidentiality, integrity, and availability.

Oracle addressed this issue in the October 2026 Critical Patch Update. The underlying weakness is categorized as [CWE-284] Improper Access Control.

Critical Impact
An authenticated attacker with low privileges can take over the Strategic Sourcing application remotely over HTTP, gaining high impact on data confidentiality, integrity, and availability.

Affected Products

Oracle PeopleSoft Enterprise SCM Strategic Sourcing 9.2
Component: Strategic Sourcing
Oracle PeopleSoft (SCM product family)

Discovery Timeline

2026-10-20 - CVE CVE-2026-91478 published to the National Vulnerability Database (NVD)
2026-10-22 - Last updated in NVD database
October 2026 - Oracle releases fix in the Oracle Critical Patch Update

Technical Details for CVE-2026-91478

Vulnerability Analysis

The vulnerability affects the Strategic Sourcing component of Oracle PeopleSoft Enterprise Supply Chain Management (SCM). Oracle classifies the issue as easily exploitable, meaning an attacker needs only a basic authenticated session and standard HTTP access to the application.

Successful exploitation leads to a complete takeover of the Strategic Sourcing module. Because PeopleSoft SCM commonly stores supplier bids, contract pricing, procurement workflows, and vendor master data, a compromise exposes sensitive procurement information and allows unauthorized modification of sourcing events.

The scope remains unchanged, so the impact is contained within the vulnerable application boundary. However, within that boundary the attacker gains high confidentiality, integrity, and availability impact, enabling data exfiltration, bid manipulation, and service disruption.

Root Cause

The weakness maps to [CWE-284] Improper Access Control. The Strategic Sourcing component does not sufficiently restrict actions available to low-privileged users, allowing them to reach functionality that should be reserved for higher-privileged roles. Oracle has not published implementation details beyond the Critical Patch Update advisory.

Attack Vector

The attack is delivered over the network through standard HTTP requests to the PeopleSoft Strategic Sourcing application. The attacker must hold valid low-privileged credentials but requires no user interaction. Any authenticated user who can reach the application interface can attempt exploitation. Refer to the Oracle Critical Patch Update October 2026 for the official vendor advisory.

Detection Methods for CVE-2026-91478

Indicators of Compromise

Unexpected administrative actions performed by low-privileged PeopleSoft accounts within the Strategic Sourcing module
Unusual modifications to sourcing events, supplier bids, or contract records outside standard business hours
Access to Strategic Sourcing URLs or component interfaces by accounts that have not historically used them
New or modified privileged roles, permission lists, or user profile changes without a corresponding change ticket

Detection Strategies

Review PeopleSoft application and web server logs for anomalous HTTP requests targeting Strategic Sourcing endpoints
Correlate authentication events with sensitive sourcing transactions to identify privilege misuse
Baseline normal access patterns for Strategic Sourcing component URLs and alert on deviations

Monitoring Recommendations

Forward PeopleSoft application, PeopleTools, and web/application server logs to a centralized SIEM for correlation
Enable PeopleSoft audit flags on key sourcing records such as bid tables and contract tables
Monitor outbound data flows from the application server for unexpected bulk exports of procurement data

How to Mitigate CVE-2026-91478

Immediate Actions Required

Apply the fix delivered in the Oracle Critical Patch Update October 2026 to all PeopleSoft Enterprise SCM Strategic Sourcing 9.2 deployments
Inventory all PeopleSoft SCM instances, including non-production and disaster recovery environments, to confirm patch coverage
Audit user accounts with access to Strategic Sourcing and remove unnecessary privileges
Reset credentials for accounts with suspicious activity observed in application logs

Patch Information

Oracle has released a patch for CVE-2026-91478 as part of the October 2026 Critical Patch Update. Administrators should download and apply the Strategic Sourcing patch for PeopleSoft Enterprise SCM 9.2 using the standard PeopleSoft update process. Validate the patch in a staging environment before production deployment.

Workarounds

Restrict network access to the PeopleSoft Strategic Sourcing application using a web application firewall or reverse proxy allow-list until patching is complete
Enforce strong multi-factor authentication on all PeopleSoft user accounts to raise the cost of credential-based access
Temporarily disable or restrict the Strategic Sourcing component for non-essential users if business processes allow
Increase logging verbosity on the application tier and review activity daily until the patch is applied

bash

# Example: restrict access to Strategic Sourcing URLs at the reverse proxy
# (Apache httpd example — adjust to match your deployment)
<Location "/psc/EMPLOYEE/ERP/c/">
    Require ip 10.0.0.0/8
    Require ip 192.168.10.0/24
</Location>