CVE-2026-91541: PeopleSoft FIN Auth Bypass Vulnerability

CVE-2026-91541 Overview

CVE-2026-91541 is an access control vulnerability [CWE-284] in the Oracle PeopleSoft Enterprise FIN Common Objects Brazil product. The flaw resides in the Common Objects component and affects supported version 9.1. An unauthenticated attacker with network access over HTTP can exploit this issue without user interaction. Successful exploitation permits unauthorized update, insert, or delete operations against a subset of application data. Attackers can also trigger a partial denial of service in the affected product. Oracle disclosed the issue in the Oracle Critical Patch Update advisory for October 2026.

Critical Impact

Unauthenticated network attackers can tamper with PeopleSoft FIN Common Objects Brazil data and cause partial service disruption without any user interaction.

Affected Products

• Oracle PeopleSoft Enterprise FIN Common Objects Brazil, version 9.1
• Common Objects component within the PeopleSoft Enterprise FIN module
• Deployments exposing PeopleSoft HTTP interfaces to untrusted networks

Discovery Timeline

• 2026-10-20 - CVE-2026-91541 published to the National Vulnerability Database (NVD)
• 2026-10-22 - Last updated in the NVD database

Technical Details for CVE-2026-91541

Vulnerability Analysis

The vulnerability is categorized under [CWE-284] Improper Access Control. The Common Objects component in PeopleSoft Enterprise FIN Common Objects Brazil fails to enforce proper authorization on at least one HTTP-reachable interface. Attackers reach the vulnerable code path over the network without providing credentials. Exploitation does not require user interaction and does not change the privilege scope beyond the affected component.

The integrity and availability impacts are limited rather than full. Attackers can modify, insert, or delete a subset of application data and degrade service, but confidentiality is not affected. The partial denial of service is scoped to PeopleSoft Enterprise FIN Common Objects Brazil rather than the broader PeopleSoft deployment.

Root Cause

The root cause is missing or incorrectly enforced access control checks in the Common Objects component of PeopleSoft FIN Brazil 9.1. Oracle has not published implementation-level technical detail. The behavior is consistent with endpoints that accept HTTP requests and perform data operations without verifying caller authorization.

Attack Vector

The attack vector is network-based over HTTP. An unauthenticated remote attacker sends crafted HTTP requests to an exposed PeopleSoft instance running the affected version. Because privileges and user interaction are not required, exposure is proportional to the reachability of the HTTP interface from untrusted networks. No public proof-of-concept, exploit code, or evidence of exploitation in the wild has been published. Oracle references the issue in the Oracle Critical Patch Update – October 2026 advisory.

Detection Methods for CVE-2026-91541

Indicators of Compromise

• Unexpected insert, update, or delete operations in PeopleSoft FIN Common Objects Brazil tables with no originating authenticated session
• HTTP requests to PeopleSoft Common Objects endpoints originating from untrusted or unexpected source IP ranges
• Spikes of HTTP 4xx or 5xx responses from the PeopleSoft web tier correlating with partial service degradation

Detection Strategies

• Compare application-layer audit logs against web server access logs to flag data-changing requests that lack a corresponding authenticated session
• Alert on anomalous POST, PUT, or DELETE traffic patterns targeting PeopleSoft Common Objects URLs
• Enable PeopleSoft audit logging on Common Objects tables so that write operations are attributable to a user context

Monitoring Recommendations

• Forward PeopleSoft web server, application server, and database audit logs into a central analytics platform for correlation
• Monitor availability and latency of the FIN Common Objects Brazil interfaces to catch partial denial-of-service conditions
• Track outbound and inbound traffic baselines for the PeopleSoft web tier and alert on deviations

How to Mitigate CVE-2026-91541

Immediate Actions Required

• Apply the fixes from the Oracle Critical Patch Update – October 2026 to all affected PeopleSoft Enterprise FIN Common Objects Brazil 9.1 deployments
• Inventory internet-exposed PeopleSoft HTTP endpoints and restrict access to trusted networks until the patch is deployed
• Review Common Objects audit logs for suspicious write activity preceding the patch window

Patch Information

Oracle addresses CVE-2026-91541 in the Oracle Critical Patch Update advisory published in October 2026. Administrators should consult the Oracle Critical Patch Update – October 2026 advisory for the specific patch bundle covering PeopleSoft Enterprise FIN Common Objects Brazil 9.1 and apply it following Oracle's recommended deployment procedure.

Workarounds

• Place the PeopleSoft web tier behind a reverse proxy or web application firewall and block unauthenticated access to Common Objects endpoints
• Restrict HTTP access to the application to VPN or internal network ranges while patching is scheduled
• Enforce network segmentation so that only required business systems can reach the PeopleSoft FIN Brazil interfaces