VDB
CVE-2026-21971
CVE-2026-21971
PUBLISHED
CVSS 5.400000095367432 MEDIUM
Vulnerability in the PeopleSoft Enterprise SCM Purchasing product of Oracle PeopleSoft (component: Purchasing). The supported version that is affected is 9.2. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise SCM Purchasing. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of PeopleSoft Enterprise SCM Purchasing accessible data as well as unauthorized read access to a subset of PeopleSoft Enterprise SCM Purchasing accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N).
EPSS 0.04% · 13.1th percentile
Risk Scores
CVSS v3.1
5.400000095367432
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
EPSS Score
0.04%
13.1th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| oracle | peoplesoft_enterprise_scm_purchasing | |
| Oracle Corporation | PeopleSoft Enterprise SCM Purchasing | 9.2 |
| oracle | peoplesoft_supply_chain_management_purchasing | 9.2 |
Timeline
- Jan 20, 2026 CVE Published
- Jan 20, 2026 PoC Published
- Jan 21, 2026 EPSS Score
- Jan 21, 2026 PoC Published
- Jan 21, 2026 PoC Published
- Jan 21, 2026 CVE Updated
- Jan 21, 2026 PoC Published
- Jan 24, 2026 EPSS Score
- Jan 26, 2026 EPSS Score
- Jan 29, 2026 EPSS Score
- Feb 1, 2026 EPSS Score
- Feb 3, 2026 EPSS Score