The renewed exploitation of Oracle PeopleSoft CVE-2026-35273 shows how quickly threat actors adapt once defenders publish mitigation guidance. Google’s Mandiant and Threat Intelligence Group say the ShinyHunters-linked cluster UNC6240 modified its exploit to bypass web application firewall rules that were blocking access to the vulnerable PeopleSoft Environment Management Hub endpoint. Instead of requesting /PSEMHUB/, the attackers simply encoded the first character and used /%50SEMHUB/. Many WAFs and reverse proxies evaluated the literal path before URL decoding, while PeopleSoft decoded the request normally and routed it to the vulnerable servlet.

That small change was enough to defeat defensive rules that matched only the literal string /PSEMHUB. The PeopleSoft application server still interpreted /%50SEMHUB/ as the same endpoint, but perimeter controls failed to recognize it as such. The result was renewed mass exploitation against organizations across higher education, technology, IT services, healthcare, agriculture, transportation, and government, with web shells deployed on dozens of systems.

CVE-2026-35273 is a critical PeopleSoft vulnerability with a CVSS score of 9.8 that can lead to unauthenticated remote code execution. The flaw was originally exploited as a zero-day between May 27 and June 9, 2026, primarily against academic institutions. Oracle released an out-of-band security alert on June 10. Mandiant subsequently warned more than 100 organizations whose exposed endpoints appeared vulnerable. The latest campaign demonstrates what happens when organizations implement compensating WAF rules but fail to eliminate the underlying vulnerability through patching or service removal.

The attackers begin by probing the encoded endpoint with several POST requests to /%50SEMHUB/hub, typically containing a serialized Java object. On vulnerable systems, those requests can reveal the host operating system without immediately writing a file or disrupting the service. That gives the attacker a low-noise way to confirm whether exploitation is likely to succeed before moving deeper into the environment.

Once the target is validated, the threat actor abuses Java deserialization in the PSEMHUB hub servlet. Mandiant observed two exploitation paths: deployment of JSP web shells and fileless command execution. The latter is particularly important because defenders looking only for newly created JSP files may miss successful exploitation entirely. In fileless cases, shell processes such as cmd.exe or /bin/sh are spawned directly by the WebLogic Java process, and command output is returned through the HTTP response.

The attackers also deploy two complementary web shells designed to reduce detection during post-exploitation. The first, x.jsp, provides cross-platform command execution and accepts hex-encoded commands through POST requests rather than exposing obvious plaintext commands in query strings. The second, u.jsp, supports chunked file uploads and command execution, allowing larger binaries to be reconstructed on the compromised server without exceeding normal HTTP request-size limits.

On Windows systems, the attackers used the upload shell to deliver a signed trojanized installer called Ple64.exe, which ultimately loads a C++ backdoor tracked as SIDEEYE into memory. According to Mandiant, SIDEEYE supports credential theft from browsers and desktop applications, file and process management, interactive reverse shells, and reverse proxy functionality. The analyzed file was signed with a valid Extended Validation certificate, demonstrating once again that a valid digital signature does not automatically mean the software is trustworthy.

The operators also staged Neo-reGeorg, an open-source tunneling tool that creates a SOCKS5 proxy through HTTP or HTTPS. This allows attackers to use the compromised PeopleSoft host as a pivot point for internal discovery and lateral movement. On Linux systems, UNC6240 deployed the legitimate MeshAgent remote-management software to maintain interactive access after the initial compromise. This combination of web shells, tunneling tools, legitimate remote-management software, and custom malware gives the attackers several independent paths for maintaining control.

Mandiant observed that around a quarter of post-exploitation commands ran with root or NT AUTHORITY\SYSTEM privileges, effectively giving the attackers complete operating-system control. Other commands executed under PeopleSoft or WebLogic service accounts, which may still provide access to database connection strings, PeopleSoft configuration files, application credentials, and business data. This is why a PeopleSoft compromise should not be treated merely as an application-layer incident.

The platform often contains highly sensitive information. Depending on deployment, PeopleSoft systems may hold HR records, payroll information, student records, employee data, financial information, and authentication material. A successful server compromise can therefore lead directly to large-scale data theft even before the attacker attempts lateral movement.

Mandiant specifically warns organizations to review database audit logs for bulk queries or exports involving HR, payroll, and student-record tables. Defenders should also inspect PeopleSoft and database hosts for large archive files such as .tar, .tar.gz, or .zst appearing in temporary or web-accessible directories, along with suspicious use of utilities such as tar, zstd, rsync, sshpass, and curl.

The campaign is especially important because UNC6240 has an established pattern of data-theft extortion. The group typically steals information first and then threatens to publish it unless the victim pays. Organizations that identify evidence of exploitation should therefore prepare not only for technical containment but also for potential extortion communications and public disclosure of stolen data.

The WAF bypass itself is almost embarrassingly simple, but that simplicity is exactly what makes the lesson important. Defenders blocked /PSEMHUB/. Attackers requested /%50SEMHUB/. The application decoded the URL. The WAF did not. One encoded character reopened the attack path.

This is a classic canonicalization problem. Security controls and backend applications must agree on what a request actually means. If the WAF evaluates one representation of the URL while the application normalizes and interprets another, attackers can manipulate the difference between those two views.

Defenders should therefore assume that attackers may use not only %50, but also other percent-encoded, mixed-case, double-encoded, or otherwise non-normalized representations of sensitive paths. Blocking rules should operate on canonicalized paths after proper decoding rather than relying on literal string matching.

The incident also demonstrates the limitation of compensating controls. A WAF can provide useful temporary protection when an organization cannot patch immediately, but it should never become a substitute for remediation. Oracle and Mandiant both emphasize that organizations should apply the patch for CVE-2026-35273 and, where possible, disable the Environment Management Hub service in multi-server configurations or remove the PSEMHUB application entirely in single-server deployments.

This is especially important because administrative and system-to-system components such as EMHub and the Integration Broker listener generally do not need to be publicly exposed for standard PeopleSoft Internet Architecture user sessions. Reducing exposure removes an entire class of attack opportunities rather than depending on signatures to catch every possible encoding variation.

Organizations should also search WebLogic access logs for both /PSEMHUB/ and encoded variants such as /%50SEMHUB/, particularly POST requests to /hub and requests to unexpected .jsp or .jspx files. All nodes behind load balancers should be examined because Mandiant observed attackers sending repeated exploitation attempts specifically to ensure web shells were deployed across multiple backend nodes.

The PSEMHUB.war and PORTAL.war directories should be inspected for unfamiliar files, including x.jsp, u.jsp, u2.jsp, tunnel.jsp, tunnel.jspx, and Ple64.exe. However, defenders should avoid relying only on those exact filenames because attackers can rename them easily. More durable detection comes from identifying unexpected JSP or executable files in PeopleSoft application directories and suspicious shell processes spawned from WebLogic.

Credential rotation is equally important. Mandiant recommends rotating secrets readable by the PeopleSoft application service account, including database connection strings in psappsrv.cfg, Integration Broker credentials, and any cloud credentials reachable from the web tier. Once an attacker has command execution on the server, every secret available to that process should be considered potentially exposed.

The broader lesson is that WAFs reduce risk, but they do not remove vulnerabilities. Signature-based controls are particularly fragile when they depend on literal strings and attackers can modify URL representations without changing what the backend application ultimately receives.

The attack chain can be summarized as: unpatched PeopleSoft → WAF blocks /PSEMHUB/ → attacker changes path to /%50SEMHUB/ → WAF misses the request → PeopleSoft decodes it → Java deserialization exploit succeeds → web shell or fileless execution → SIDEEYE / tunneling / MeshAgent → credential theft and data exfiltration.

There is nothing especially sophisticated about encoding the letter “P” as %50. The sophistication lies in recognizing that the defensive stack and the application interpret the same request differently and then exploiting that gap at scale.

For defenders, the message is straightforward: normalize before filtering, patch the underlying vulnerability, remove unnecessary administrative endpoints from the Internet, and do not assume that a WAF rule means the system is safe.

The PeopleSoft campaign is a useful reminder that a compensating control buys time. It does not buy immunity.

Google is warning of renewed mass exploitation of a known security vulnerability in Oracle PeopleSoft as part of a campaign targeting multiple sectors globally. The ShinyHunters-linked activity involves the weaponization of CVE-2026-35273 (CVSS score: 9.8), a critical security flaw that could result in unauthenticated remote code execution. The vulnerability was first exploited as a zero-day

Source: Attackers Bypass WAFs to Exploit Oracle PeopleSoft Flaw and Deploy Web Shells via The Hacker News — published 26 Sep 2026.