Attackers Bypass WAFs to Exploit Oracle PeopleSoft Flaw and Deploy Web Shells

Summary

Google warns of renewed mass exploitation of a critical Oracle PeopleSoft vulnerability (CVE-2026-35273) by the ShinyHunters-linked threat actor UNC6240. Attackers are bypassing Web Application Firewalls (WAFs) by URL-encoding characters in requests to the Environment Management Hub endpoint, enabling them to deploy web shells, backdoors like SIDEEYE, and gain persistent access using tools like MeshAgent. The campaign targets multiple global sectors, including education, technology, and healthcare.

Full text

Attackers Bypass WAFs to Exploit Oracle PeopleSoft Flaw and Deploy Web Shells Ravie LakshmananSep 26, 2026Vulnerability / Web Security Google is warning of renewed mass exploitation of a known security vulnerability in Oracle PeopleSoft as part of a campaign targeting multiple sectors globally. The ShinyHunters-linked activity involves the weaponization of CVE-2026-35273 (CVSS score: 9.8), a critical security flaw that could result in unauthenticated remote code execution. The vulnerability was first exploited as a zero-day in attacks against academic institutions to conduct reconnaissance, deploy remote access software like MeshCentral agent for persistence, move laterally over SSH, run a shell script to connect via SSH to other internal PeopleSoft machines using known username/password combinations, and steal data. At that time, Google-owned Mandiant said it initiated notifications to over 100 global organizations whose IP addresses matched vulnerable endpoints, most of them located in the U.S. "This new wave of activity stems from UNC6240 modifying its exploit to bypass web application firewall (WAF) rules blocking the vulnerable Environment Management Hub (PSEMHUB) endpoint," Mandiant said. "The threat actor bypassed these string-based WAF rules by URL-encoding a single character in the request path, requesting /%50SEMHUB/ in place of /PSEMHUB/. Many WAF and reverse proxy rules match the literal path before URL decoding, while the PeopleSoft application server decodes the request and routes it to the vulnerable servlet." Targets of the latest activity include entities spanning higher education, technology, IT services, healthcare, agriculture, transportation, and government sectors, with the attackers deploying web shells on dozens of systems. The entire attack chain is as follows - Identify susceptible targets by sending POST requests to "/%50SEMHUB/hub" containing a serialized Java object. Bypass WAF rules by using an encoded form of the character P (i.e., "%50") in the POST requests: "/%50SEMHUB/hub." Abuse Java deserialization in the PSEMHUB hub servlet to deploy web shells and achieve fileless command execution. Drop two JSP web shells in the PSEMHUB.war directory with an aim to minimize WAF detections during post-exploitation: "x.jsp" enables cross-platform command execution, while "u.jsp" allows chunked file uploads to the server and command execution via "cmd.exe." Use "u.jsp" to upload a valid, signed trojanized installer ("Ple64.exe") that loads in memory SIDEEYE, a C++ backdoor that communicates with an external server ("162.219.30[.]165") over TCP to facilitate browser and desktop application credential theft, process and file management, interactive reverse shell and reverse proxy capabilities. "Alongside the deployment of Ple64.exe, the threat actor staged the open-source Neo-reGeorg tunneling toolkit," Google said. "To establish persistent access after web shell placement on Linux systems, UNC6240 deployed the legitimate RMM tool MeshAgent." About a quarter of the threat actor's commands are said to have been executed as root or NT Authority\SYSTEM, granting them full control of the operating system. The remaining commands have been found to be run under PeopleSoft or WebLogic service accounts. To counter the threat, organizations are required to perform the following steps - Apply patches for CVE-2026-35273. Disable the Environment Management Hub (EMHub) service in multi-server configurations, or, remove the PSEMHUB application entirely in single-server configurations. Search WebLogic access logs for requests to "/PSEMHUB/" and any percent-encoded variant. Inspect the "PSEMHUB.war" directory for JSP web shells and other malicious artifacts. Rotate credentials readable by the PeopleSoft application service account. Hunt PeopleSoft and database hosts for large archive files in temporary or web-accessible directories. Review database audit logs for bulk queries or exports against HR, payroll, and student records tables. Monitor outbound traffic from PeopleSoft hosts. "UNC6240 has a well-established pattern of data theft extortion, that is, stealing data and threatening to release it on a data leak site unless the victim pays a ransom," Google said. "Affected organizations should prepare for extortion communications and monitor for potential public exposure of stolen data." The disclosure comes as the ShinyHunters group broke into the U.S. Federal Bureau of Investigation's FBIJobs.gov portal (which remains inaccessible as of writing) and stole about 2-3 TB of sensitive data to contest allegations made by the agency against the group in a May 2026 alert. "We want to reiterate and emphasise that we are NOT extorting the FBI," a ShinyHunters spokesperson told The Hacker News. "This is NOT financially motivated. This is NOT a ransom or extortion. All we seek to do is set the record straight and protect the image of our organisation." The spokesperson also told the publication that the FBI jobs portal was breached using a zero-day vulnerability in Oracle PeopleSoft that's different from CVE-2026-35273. In a separate statement shared with The Register, the group said they started off as GnosticPlayers before rebranding to ShinyHunters in 2020. Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post. SHARE     Tweet Share Share Share SHARE  Cybercrime, Malware, oracle, Vulnerability, Web Security ⚡ Top Stories This Week Roundcube Pre-Auth SQL Injection Flaw Actively Exploited in the Wild Cloudflare Fixes Flaw That Let One Container Read Another Customer's Leftover Disk Data Unpatched OnePlus Flaws Let Installed Android Apps Gain Root Without Permissions ThreatsDay: AI Search Poisoning, AI Coding Tool Leaking Repos, One-Click Code Execution and 13 More Stories Placeholder third-party[.]com Referenced Across 1,700+ Repositories Now Serves Malicious Content OpenAI Agent Bypassed Australian Medicare Portal Controls to Access Non-Public Files A Leaked GitLab Issue Email Address Lets Anyone Push Code and Run CI Jobs as You MikroTrick Chain Let Attackers Take Over MikroTik Routers Without a Password or SSH Key New cPanel Flaw Lets a Hosting Account Run Code as Root, Take Full Server Control Exploit Released for Unpatched Ubuntu Linux Flaw Enabling Host-Root Container Escape F5 Patches Critical BIG-IP APM Zero-Day Exploited for Unauthenticated RCE on OAuth Servers Critical Next.js ImageResponse Flaw Can Lead to Server Code Execution via Crafted SVG Input ShinyHunters Claims FBI Breach, Says It Stole Data on Agents and Job Applicants Check Point Warns of Management Server Zero-Day Exploited in Targeted Attacks WordPress Issues Patch for Critical Flaw That Can Enable Code Execution on Some Servers Researcher Drops BigDiskBuster Zero-Day PoC That Blocks Microsoft Defender Updates New CVSS 10.0 VeloCloud Orchestrator Flaw Actively Exploited in Certificate-Based Setups New Linux Kernel Flaw Gives ARM64 KVM Guests Read-Write Access to Host Memory SharePoint Flaw Initially Listed as Spoofing by Microsoft Enables Authenticated RCE One Hidden Meta Muse Setting Could Let Attackers Turn the AI Assistant Into a Backdoor WordPress Comment2Shell Flaw Can Turn Anonymous Comment XSS Into RCE via Admin Session Zyxel and Veeam Flaws Under Active Exploitation With Command and SYSTEM Access Beyond ISO 27001: Building a Risk Program That Can Keep Up With AI Secrets Sprawl Is an Identity Problem That AI Just Made Impossible to Ignore ⭐ Featured Resources Validation Summit ’26: See How Pen Testing, Exposure Validation and BAS Work Together Red Teams: Learn How Attack Path Chaining Changes Automated Security Testing Turn Threat Intelligence Into Verified Risk With Threat-Led Penetration Testing Deploy Browser Security Monitoring in Minutes With a Single Header

Indicators of Compromise

• cve — CVE-2026-35273
• ip — 162.219.30.165
• malware — SIDEEYE
• malware — MeshAgent
• malware — Ple64.exe
• malware — x.jsp
• malware — u.jsp

Entities