CVE-2026-91553: PeopleSoft FIN Privilege Escalation Flaw

CVE-2026-91553 Overview

CVE-2026-91553 affects Oracle PeopleSoft Enterprise FIN Product Configurator Brazil version 9.1, specifically the Product Configurator component. A low-privileged attacker with local logon access to the infrastructure where the application executes can exploit this vulnerability. Successful exploitation grants unauthorized update, insert, or delete access to a subset of application data. The flaw also enables a partial denial-of-service condition against the Product Configurator component.

Oracle disclosed this issue in the Oracle Security Alert for October 2026.

Critical Impact
Low-privileged local users can modify PeopleSoft FIN Product Configurator Brazil data and trigger partial service disruption without user interaction.

Affected Products

Oracle PeopleSoft Enterprise FIN Product Configurator Brazil 9.1
Product Configurator component
Oracle PeopleSoft deployments running the FIN Product Configurator Brazil module

Discovery Timeline

2026-10-20 - CVE-2026-91553 published to NVD
2026-10-21 - Last updated in NVD database
October 2026 - Addressed in Oracle Security Alert (Oracle Security Alert - October 2026)

Technical Details for CVE-2026-91553

Vulnerability Analysis

The vulnerability resides within the Product Configurator component of Oracle PeopleSoft Enterprise FIN Product Configurator Brazil 9.1. An authenticated user with low privileges and local logon access to the host infrastructure can abuse the component to perform unauthorized write operations. The scope of impact is limited to integrity and availability, with no direct confidentiality consequences according to Oracle's published advisory.

The attack complexity is low, meaning no specialized conditions must be satisfied. User interaction is not required, and the attack scope remains unchanged. The impact profile indicates that an attacker can corrupt, insert, or delete a limited portion of application data accessible to the Product Configurator and partially disrupt its availability.

Oracle has not published a specific Common Weakness Enumeration (CWE) classification for this issue. Technical details beyond the advisory summary are not publicly disclosed by Oracle, which is standard practice for Critical Patch Update entries.

Root Cause

Oracle has not disclosed the underlying code defect or weakness class for CVE-2026-91553. The advisory indicates the vulnerability allows an authenticated local user to influence data operations within the Product Configurator component beyond their intended authorization boundary. This behavior is consistent with insufficient authorization enforcement or input handling within a privileged application code path.

Attack Vector

Exploitation requires local access to the server infrastructure hosting PeopleSoft Enterprise FIN Product Configurator Brazil. The attacker must already hold valid low-privilege credentials to the infrastructure. Once authenticated, the attacker interacts with the Product Configurator component to trigger unauthorized data modifications or induce a partial denial of service. Remote network exploitation is not applicable per Oracle's published vector.

No public proof-of-concept exploit code is available at the time of publication, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2026-91553

Indicators of Compromise

Unexpected inserts, updates, or deletes within PeopleSoft FIN Product Configurator Brazil tables performed by low-privileged accounts.
Partial service degradation or component unavailability affecting the Product Configurator module.
Anomalous session activity from accounts without a business need to access Product Configurator functionality.

Detection Strategies

Enable PeopleSoft application-level audit logging for the Product Configurator component and review for unauthorized data changes.
Correlate operating system logon events on PeopleSoft application servers with subsequent database write activity.
Baseline normal transaction volumes for the Product Configurator and alert on statistical deviations.

Monitoring Recommendations

Forward PeopleSoft application, web server, and database audit logs to a centralized analytics platform for correlation.
Monitor privileged and service account usage on PeopleSoft infrastructure for unexpected interactive logons.
Track process creation and child processes spawned by PeopleSoft runtime components on application servers.

How to Mitigate CVE-2026-91553

Immediate Actions Required

Apply the October 2026 Oracle Critical Patch Update to all affected PeopleSoft Enterprise FIN Product Configurator Brazil 9.1 deployments.
Inventory all PeopleSoft hosts and confirm patch status across production, staging, and disaster recovery environments.
Restrict interactive logon rights on PeopleSoft application servers to a minimal set of administrative accounts.
Review account entitlements within PeopleSoft to enforce least privilege for Product Configurator access.

Patch Information

Oracle addressed CVE-2026-91553 as part of the October 2026 Critical Patch Update. Administrators should review the Oracle Security Alert - October 2026 for patch availability, download instructions, and version-specific guidance for PeopleSoft Enterprise FIN Product Configurator Brazil 9.1.

Workarounds

Limit local logon access to PeopleSoft infrastructure using operating system group policy or equivalent controls until patching is complete.
Disable or restrict the Product Configurator component for user populations that do not require it.
Enforce multi-factor authentication for all accounts with logon rights to PeopleSoft application servers.
Audit and rotate credentials for any low-privilege accounts with access to PeopleSoft infrastructure.