# CVE-2026-91481: Oracle PeopleSoft Enterprise SCM Purchasing CSRF in Supplier Registration

Source: https://junglewise.ai/threats/cve-2026-91481-vulnerability-in-the-peoplesoft-enterprise-scm-purchasing-product  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-20. Updated: 2026-10-20  
License: CC BY 4.0 with a link back

CVE-2026-91481 · Severity: medium · CVSS 5.4 · Published 2026-10-20

Oracle PeopleSoft Enterprise SCM Purchasing manages supplier relationships and procurement operations. A cross-site request forgery (CSRF) vulnerability in the Supplier Registration component allows an attacker to trick authorized users into modifying or deleting supplier data without their knowledge. An exploit could result in unauthorized changes to critical supplier records or exposure of sensitive procurement information.

Technologies: [Oracle PeopleSoft Enterprise SCM Purchasing](https://junglewise.ai/threats/technologies/peoplesoft-enterprise-scm-purchasing). Vendors: [Oracle](https://junglewise.ai/threats/vendors/oracle).

## Quick answers

**Is CVE-2026-91481 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-91481 being exploited in the wild.

**How severe is CVE-2026-91481?** Medium severity, with a CVSS score of 5.4, published 20 October 2026.

**Which products and versions are affected?** Oracle PeopleSoft Enterprise SCM Purchasing 9.2.

**Is there a fix for CVE-2026-91481?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-91481 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-91481?** Check whether you run Oracle PeopleSoft Enterprise SCM Purchasing at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A CSRF vulnerability in the Supplier Registration component of PeopleSoft Enterprise SCM Purchasing version 9.2 allows a low-privileged, network-adjacent attacker to perform unauthorized data modification via HTTP. The attack requires user interaction (a victim must click a malicious link), and changes may propagate across other PeopleSoft modules (scope change). Successful exploitation enables unauthorized read access to some data and unauthorized update/insert/delete operations on accessible records.

## Affected products

- Oracle PeopleSoft Enterprise SCM Purchasing 9.2

## Timeline

- 2026-10-20: disclosed

## References

- [https://www.oracle.com/security-alerts/cpuoct2026.html](https://www.oracle.com/security-alerts/cpuoct2026.html)

## Related threats

- [Oracle PeopleSoft Enterprise SCM Purchasing data manipulation vulnerability](https://junglewise.ai/threats/cve-2026-61205-oracle-peoplesoft-enterprise-scm-purchasing-data-manipulation)
- [Vulnerability in the PeopleSoft Enterprise SCM Purchasing product of Oracle PeopleSoft (component: Purchasing). The…](https://junglewise.ai/threats/cve-2026-34295-vulnerability-in-the-peoplesoft-enterprise-scm-purchasing-product)