CVE-2026-21934: 
Oracle Peoplesoft Enterprise Peopletools vulnerability analysis and mitigation

CVE-2026-21934 is an authorization bypass vulnerability in the Push Notifications component of Oracle PeopleSoft Enterprise PeopleTools. It affects versions 8.60, 8.61, and 8.62 and was disclosed as part of Oracle's January 2026 Critical Patch Update (CPU), released on January 20, 2026. The vulnerability allows a low-privileged attacker with network access via HTTP to perform unauthorized read and write operations on accessible PeopleSoft data. It carries a CVSS v3.1 base score of 5.4 (Medium) (Oracle CPU Jan 2026).

The vulnerability is classified as an authorization bypass (CWE not explicitly specified by Oracle, but consistent with improper access control) in the Push Notifications component of PeopleSoft Enterprise PeopleTools. An attacker with low privileges and network access over HTTP can exploit insufficient authorization checks to read a subset of accessible data and perform unauthorized update, insert, or delete operations. No user interaction is required, and the attack complexity is low, making it straightforward to exploit for any authenticated low-privileged user with HTTP access to the affected system (Oracle CPU Jan 2026).

Successful exploitation results in partial confidentiality and integrity impacts: an attacker can read a subset of PeopleSoft Enterprise PeopleTools accessible data and perform unauthorized data modification (update, insert, or delete) within the Push Notifications component. There is no availability impact. The scope is unchanged, meaning the impact is confined to the vulnerable component itself, limiting the risk of broad lateral movement, though unauthorized data manipulation in an enterprise HR/ERP platform could have significant business consequences (Oracle CPU Jan 2026).

Oracle has released patches for this vulnerability as part of the January 2026 Critical Patch Update. Organizations running PeopleSoft Enterprise PeopleTools versions 8.60, 8.61, or 8.62 should apply the relevant CPU patches immediately. As a temporary measure, Oracle recommends restricting network access to PeopleSoft systems via HTTP to authorized users and networks only, and implementing additional monitoring on the Push Notifications component for anomalous data access or modification activity. Oracle strongly advises against relying on network-level workarounds as a long-term solution (Oracle CPU Jan 2026).