BRIEFAccess salehighP78
Pre-auth RCE exploit for Oracle PeopleSoft up for sale
Oracle PeopleSoft
Detected26 September 2026 · 16:16 UTC
ShinyHunters is selling a pre-authentication RCE plus WAF bypass for Oracle PeopleSoft, an ERP widely deployed across government agencies, ministries, universities and banks. This kind of unauthenticated exploit enables initial access without credentials and is highly relevant to public-sector targets in Latin America. Defenders running PeopleSoft should urgently hunt for exposed internet-facing instances and review WAF/DB logs for exploitation attempts.
CategoryAccess sale
Severityhigh
Priority score78
Detected26 September 2026 · 16:16 UTC
Access salePriority 66
Venta de acceso root y VPN a una pasarela corporativa de VietnamA seller on BreachForums' Access Market is offering a root shell on a Vietnamese corporate gateway together with working VPN accounts. This is a concrete initial-access sale combining privileged shell access and valid VPN credentials, which can be used for lateral movement, data theft or ransomware staging. Defenders should treat it as an active intrusion capability against exposed enterprise gateways.Access salePriority 42
Venta de acceso a un proveedor de software como servicio (SaaS)A seller on BreachForums' access marketplace is offering initial access to an unnamed software-as-a-service provider. The listing does not disclose the tenant, scale or access method, but SaaS footholds are often used to pivot into customer data and downstream client organizations. Because the target is unidentified, the item is worth monitoring rather than treating as a confirmed high-value compromise.Access salePriority 45
Acceso a la base de datos del sitio español Andanar.com a la ventaDatabase access for the Spanish site Andanar.com is being sold on DarkForums by a seller using the handle PrimeVendor. Selling live database access to a Spanish company's site risks exposure of customer records and personal data. Spanish organizations and the site's users should monitor for data exposure.
Access salePriority 72
Venta de acceso al sistema de nómina de las Fuerzas Armadas de MalasiaA seller is offering access to the payroll system of the Malaysian Armed Forces, a sensitive military human-resources and payment platform. Compromise can expose service members' personal and financial data and serve as a foothold for deeper intrusion into defense networks. This government/military initial-access sale warrants urgent verification by regional defense authorities.Access salePriority 40
Tienda vende servidores RDP validados y logs de stealer recientesAn RDP shop advertising on BlackBones offers validated RDP server access and freshly harvested stealer logs with automated bot delivery. Ready-to-use remote access lowers the barrier for ransomware and intrusions, and stealer logs fuel credential-based attacks. Organizations should harden exposed RDP and monitor for stolen credentials in circulation.Access salePriority 40
Acceso al panel de administración de turedinmobiliaria.com (España)A DarkForums user is advertising administrative access to the website of Spanish real estate firm turedinmobiliaria.com, which typically means control over content, forms and stored client inquiries. Although the target is a small company, such access is frequently used for phishing against clients and for pivoting into hosting or CRM infrastructure. The post provides no confirmed proof of scale or persistence.