Meta News

Attackers linked to the ShinyHunters extortion ecosystem have modified their exploitation techniques to bypass web application firewalls and continue attacking vulnerable Oracle PeopleSoft environments.

Google’s Mandiant says the latest campaign targets CVE-2026-35273, a critical Oracle PeopleSoft Enterprise PeopleTools vulnerability with a CVSS score of 9.8 that enables unauthenticated remote code execution.

The vulnerability was originally exploited as a zero-day earlier in 2026. The latest activity demonstrates a different problem: organizations that attempted to protect vulnerable systems using WAF rules instead of eliminating the underlying vulnerability could still be compromised.

The bypass used by the attackers is technically simple.

Organizations had created WAF rules designed to block requests targeting the vulnerable PeopleSoft Environment Management Hub endpoint:

/PSEMHUB/

Attackers associated with the group tracked by Mandiant as UNC6240 discovered that they could instead request:

/%50SEMHUB/

The sequence%50is the URL-encoded representation of the uppercase letterP.

Many WAF and reverse-proxy configurations evaluated the literal request path before URL decoding it. As a result, the security control did not recognize/%50SEMHUB/as the blocked/PSEMHUB/endpoint.

PeopleSoft behaved differently.

The application server decoded the URL before routing the request and therefore interpreted both forms as effectively targeting the same vulnerable servlet.

The result created a normalization mismatch:

WAF sees: /%50SEMHUB/

PeopleSoft sees: /PSEMHUB/

That difference was enough to bypass some defensive rules.

After reaching the vulnerable endpoint, attackers send POST requests containing a serialized Java object.

CVE-2026-35273 involves the PSEMHUB servlet and can be abused to achieve remote code execution without requiring authentication.

The attackers use the vulnerability to deploy web shells and execute commands on the underlying system.

This makes the vulnerability particularly dangerous for internet-accessible PeopleSoft deployments.

An attacker does not need credentials or interaction from an employee. Network access to the vulnerable service can be sufficient.

The complete attack path can therefore be summarized as:

Internet → Encoded URL → WAF bypass → PSEMHUB → Java deserialization → RCE → Web shell

Once the web shell is established, the attack moves from vulnerability exploitation into conventional post-exploitation.

Mandiant observed attackers deploying two JSP web shells into thePSEMHUB.wardirectory.

One, named x.jsp, provides cross-platform command execution.

The second,u.jsp, supports chunked file uploads and can execute commands throughcmd.exeon Windows systems.

Using small web shells provides attackers with a lightweight mechanism for maintaining remote access while reducing their dependence on repeatedly exploiting the original vulnerability.

The attackers subsequently useu.jspto upload additional tooling.

One payload observed by researchers was a legitimate signed installer named Ple64.exe that had been trojanized to execute a C++ backdoor called SIDEEYE.

Once running, SIDEEYE communicates with attacker-controlled infrastructure over TCP.

The malware provides capabilities including browser and desktop credential theft, process management, file manipulation, interactive reverse shells, and reverse proxy functionality.

The attackers also deploy the open-source Neo-reGeorg tunneling framework.

Tunneling tools allow attackers to route traffic through a compromised server, effectively transforming the victim into a pivot point for accessing systems that may not be directly reachable from the internet.

On Linux PeopleSoft systems, UNC6240 has additionally deployed the legitimate MeshAgent remote management tool for persistent access.

This mixture of custom malware, web shells and legitimate administrative software makes detection more complicated because not every component used during the intrusion is inherently malicious.

The privileges available after exploitation are particularly concerning.

Mandiant says roughly 25% of observed attacker commands executed as root on Linux or NT Authority\SYSTEM on Windows.

Those identities provide essentially complete control over the operating system.

The remaining commands generally executed using PeopleSoft or WebLogic service accounts.

This gives attackers opportunities to search for credentials, access databases, steal files, establish additional persistence and move laterally into other systems.

Earlier exploitation of CVE-2026-35273 involved attackers using SSH to move between internal PeopleSoft servers using known username and password combinations.

The renewed exploitation is not restricted to a single sector.

Google has identified victims across higher education, technology, IT services, healthcare, agriculture, transportation and government.

Attackers have successfully installed web shells on dozens of systems during the latest campaign.

When the vulnerability was initially exploited as a zero-day, Mandiant notified more than 100 organizations whose internet-facing infrastructure appeared to match vulnerable endpoints, with most located in the United States.

The breadth of the current campaign suggests attackers are continuing to search for organizations that either have not patched or attempted to mitigate the vulnerability using perimeter controls.

Mandiant associates UNC6240 with the wider ShinyHunters ecosystem.

The group has an established pattern of stealing corporate information and then threatening to publish it unless victims pay.

That means organizations discovering exploitation should not limit their investigation to determining whether the PeopleSoft server was compromised.

They should also investigate whether attackers reached databases or other systems containing sensitive information.

PeopleSoft deployments can contain particularly valuable datasets, including HR, payroll and student information.

Mandiant recommends reviewing database audit logs for unusual bulk queries or exports involving these records.

The most important security lesson from the campaign is the limitation of compensating controls.

A WAF can reduce exposure while administrators prepare an emergency patch, but it should not normally become a permanent substitute for remediation when a security update exists.

String-based rules are especially fragile when different layers interpret HTTP requests differently.

The attacker only needed to transform:

PSEMHUB

into:

%50SEMHUB

to exploit the difference between how the WAF and the backend application normalized the URL.

This belongs to a broader category of parser and normalization discrepancies that have repeatedly enabled WAF bypasses, request smuggling and access-control failures.

Security controls and backend applications need to agree about what a request actually means.

Oracle PeopleSoft administrators should apply the available patches for CVE-2026-35273.

Mandiant also recommends disabling the Environment Management Hub service in multi-server environments when it is unnecessary, or removing the PSEMHUB application entirely in applicable single-server configurations.

Because exploitation is already occurring, organizations should also search historical WebLogic access logs for both conventional/PSEMHUB/requests and percent-encoded variations.

ThePSEMHUB.wardirectory should be inspected for JSP files and other unexpected artifacts.

Credentials accessible to the PeopleSoft service account should be rotated, and defenders should investigate PeopleSoft and database servers for suspicious archives, unusual outbound connections and evidence of bulk data extraction.

This distinction is critical:

patching prevents future exploitation; threat hunting determines whether exploitation has already happened.

The latest PeopleSoft campaign demonstrates why relying exclusively on a WAF against a critical RCE vulnerability can create a dangerous sense of protection.

A firewall rule may block one representation of a malicious request.

The application behind it may understand many others.