Access Vulnerability in Oracle PeopleSoft SCM Purchasing Product
CVE-2026-21971

5.4MEDIUM

Key Information:

Vendor

Oracle
Status
Peoplesoft Enterprise Scm Purchasing
Vendor
CVE Published:
20 January 2026

What is CVE-2026-21971?

A vulnerability in the PeopleSoft Enterprise SCM Purchasing component of Oracle PeopleSoft permits low-privileged attackers to exploit the system remotely via HTTP. This could lead to unauthorized access for updating, inserting, or deleting essential data across PeopleSoft SCM Purchasing databases, as well as unauthorized reading of certain accessible datasets. Organizations using the affected version 9.2 of the product should review their security measures to mitigate potential risks arising from this flaw.

Affected Version(s)

PeopleSoft Enterprise SCM Purchasing 9.2

References

https://www.oracle.com/security-alerts/cpujan2026.html
vendor-advisory

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.