ShinyHunters bypasses WAF rules to resume Oracle PeopleSoft CVE-2026-35273 exploitation

What happened

Google’s Mandiant and Threat Intelligence Group say the ShinyHunters extortion crew — tracked by Google as UNC6240 — has modified its exploit for the Oracle PeopleSoft flaw CVE-2026-35273 so that it evades the web application firewall rules widely deployed as a stopgap [1][2].

The flaw allows unauthenticated remote code execution in Oracle PeopleSoft Enterprise PeopleTools [1][2]. NVD records the affected component as Updates Environment Management, lists supported versions 8.61 and 8.62 as affected, and gives a CVSS 3.1 base score of 9.8. It was first exploited as a zero-day: BleepingComputer reported the campaign on 10 June, with data stolen from around 100 organisations, and Oracle issued a fix the following day [1][2]. CISA added the CVE to its Known Exploited Vulnerabilities catalogue on 12 June with a 15 June remediation deadline, and flags it as known to be used in ransomware activity.

When the flaw was disclosed, Mandiant’s advice was tiered: install the security updates, or failing that disable the Environment Management Hub, and only if neither was possible block external access to the /PSEMHUB/* endpoint [1]. Many operators went straight to the WAF route. The new exploit variant targets exactly that gap [1].

The bypass

Instead of requesting the literal path, the attackers percent-encode a character in it — for example sending /%50SEMHUB/ rather than /PSEMHUB/, where %50 is the encoded form of P [1].

According to Mandiant, many WAFs and reverse proxies evaluate the raw request path before URL decoding, so a rule matching /PSEMHUB/ never fires. Oracle WebLogic then decodes the request and routes it to the vulnerable endpoint. The result is a reachable endpoint on hosts whose operators believed the exposure was mitigated [1].

Google warns that %50 is only one option. Other percent-encoded forms, mixed-case variants, or further path mutations are available to the attacker, which makes signature-based blocking on this path unreliable as a control [1].

Who is affected

Any internet-reachable PeopleSoft Enterprise PeopleTools deployment on an affected version that has not applied Oracle’s update, including deployments sitting behind a WAF rule that matches the literal /PSEMHUB/ path.

Google says the renewed wave has planted web shells on dozens of systems worldwide across higher education, technology, IT services, healthcare, agriculture, transportation and government [1].

Post-exploitation

Mandiant describes a quiet reconnaissance step first: typically five to fifteen POST requests to /%50SEMHUB/hub carrying serialised Java objects. On a vulnerable host these return information about the operating system without writing files or interrupting the service, letting the attacker confirm exploitability before doing anything noisy [1].

After confirmation, the group either runs commands in memory or drops JSP web shells — x.jsp for command execution, u.jsp and u2.jsp for uploading larger files [1].

On compromised Windows servers, the shells were used to deploy Ple64.exe. The file carries the signed appearance of an installer for the Light Alloy media player; what it actually installs is a backdoor Google tracks as SIDEEYE. SIDEEYE handles credential theft, process and file management, interactive reverse shells and reverse proxying [1].

The attackers also deployed the open-source Neo-reGeorg tunnelling toolkit as tunnel.jsp and tunnel.jspx, which tunnels SOCKS5 traffic over ordinary HTTP and HTTPS and turns the PeopleSoft server into a pivot into the internal network. On Linux hosts, Mandiant observed the legitimate MeshAgent remote management tool used for persistence [1].

The FBI claim

Separately, ShinyHunters told BleepingComputer on 22 September that it had breached the FBI Jobs platform using what it described as a new PeopleSoft zero-day, moved laterally into FBI AWS GovCloud infrastructure, and taken 2–3 TB of data on current and former employees and job applicants. BleepingComputer could not independently verify the vulnerability, the lateral movement or the volume [1].

The FBI confirmed it was investigating claims of unauthorised activity affecting FBIjobs.gov, but did not confirm a breach or data theft [1].

The group has since told BleepingComputer that it used the WAF bypass against FBI Jobs, while continuing to claim a second, unknown vulnerability in the same PSEMHUB component [1]. That second flaw is an unverified attacker claim; no source shows Oracle or Google acknowledging it. Treat it as unconfirmed, and assume PSEMHUB exposure is risky regardless.

What to do

• Apply Oracle’s update for CVE-2026-35273. Mandiant is explicit that patching, not WAF filtering, is the fix [1].
• Stop treating a path-matching WAF rule as mitigation. If you have been relying on one, assume the endpoint was reachable.
• If you cannot patch now, disable the Environment Management Hub rather than filtering requests to it [1].
• Search WebLogic access logs for requests to /PSEMHUB/ and encoded variants such as /%50SEMHUB/, including a run of five to fifteen POSTs to the hub path [1].
• Hunt for the named artefacts: x.jsp, u.jsp, u2.jsp, tunnel.jsp, tunnel.jspx, Ple64.exe, and unexpected MeshAgent installations on Linux hosts [1].
• If you find any of these, treat it as a network intrusion, not a single-host web shell: Neo-reGeorg tunnelling and SIDEEYE credential theft imply lateral movement and credential exposure [1].
• Normalise and decode request paths before applying WAF rules, and review other literal-path rules in your ruleset for the same weakness.