Security readout for executives and security teams
Plain-English summary
CVE-2026-21971 affects Oracle PeopleSoft Enterprise SCM Purchasing 9.2. A low-privileged authenticated attacker with HTTP network access could read some purchasing data and make unauthorized changes to some accessible data. This is not described as a system takeover, but it can affect procurement data integrity and confidentiality.
Executive priority
Treat as a business-data integrity issue for procurement operations. Prioritize patch review and access control validation for PeopleSoft SCM Purchasing 9.2, particularly if many internal users have HTTP access. Urgency is moderate absent evidence of active exploitation.
Technical view
Oracle describes an easily exploitable PeopleSoft Enterprise SCM Purchasing vulnerability in the Purchasing component. Attack requirements are network access over HTTP and low privileges, with no user interaction. CVSS 3.1 is 5.4: AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N. Impacts are limited confidentiality and integrity; availability is not impacted.
Likely exposure
Organizations running Oracle PeopleSoft Enterprise SCM Purchasing version 9.2 are potentially exposed, especially where authenticated users can reach PeopleSoft over HTTP. Exposure depends on deployment, access controls, user privileges, and whether Oracle’s January 2026 CPU guidance has been applied.
Exploitation context
The source bundle does not indicate active exploitation, and the CVE is not listed as CISA KEV. The vulnerability is considered easy to exploit by Oracle, but it requires low-privileged access rather than being fully unauthenticated.
Researcher notes
Public details are limited to Oracle and CVE metadata. No CWE, proof-of-concept, or detailed vulnerable function is provided in the source bundle. Avoid assuming affected versions beyond PeopleSoft Enterprise SCM Purchasing 9.2 or exploit activity without additional cited evidence.
Mitigation direction
- Review Oracle’s January 2026 Critical Patch Update for this CVE.
- Apply Oracle-provided PeopleSoft fixes for affected 9.2 environments.
- Restrict HTTP access to PeopleSoft to trusted networks and users.
- Review low-privileged accounts with Purchasing access.
- Monitor purchasing data changes for unusual insert, update, or delete activity.
Validation and detection
- Identify PeopleSoft Enterprise SCM Purchasing instances and confirm version 9.2 exposure.
- Verify whether the January 2026 Oracle CPU remediation is applied.
- Confirm HTTP access paths and authentication requirements.
- Review role assignments for low-privileged Purchasing users.
- Check audit logs for unusual Purchasing data reads or modifications.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2026-21971 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 5.4 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N2.82.5Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
5.4MediumVector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Source materials
- CVE List V5 sourceCVE List V5
- Oracle AdvisoryCVE reference · vendor-advisory
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.