Vulnerabilities
Oracle PeopleSoft CVE-2026-35273 Exploitation: WAF Bypass and Web Shell Deployment
Attackers have resumed mass exploitation of Oracle PeopleSoft’s critical CVE‑2026‑35273, bypassing WAFs by URL‑encoding the PSEMHUB path to deploy JSP web shells. The campaign spans higher education, healthcare, IT services, and government, enabling unauthenticated remote code execution. Defenders should patch immediately, verify WAF rules, and monitor for shell uploads.
What Happened
Attackers weaponized CVE‑2026‑35273, a critical deserialization flaw in Oracle PeopleSoft’s Environment Management Hub (PSEMHUB), to gain unauthenticated remote code execution. By URL‑encoding the “P” character (e.g., “/%50SEMHUB/”) in POST requests to the /hub endpoint, they bypassed many WAFs that match literal paths before decoding.
The exploit payload is a serialized Java object that triggers the vulnerable servlet, allowing the attacker to drop two JSP web shells into the PSEMHUB.war directory and execute file‑less commands.
Impact
Defenders across higher education, healthcare, IT services, agriculture, transportation, and government have reported successful shell deployments on dozens of systems. The attack chain also includes reconnaissance, persistence via MeshCentral agents, lateral movement over SSH, and data exfiltration.
What to Do
- Apply the latest Oracle PeopleSoft patch that addresses CVE‑2026‑35273.
- Verify that your WAF or reverse‑proxy rules decode URLs before matching; update rules to block requests to /PSEMHUB/ and its encoded variants.
- Scan for JSP files in the PSEMHUB.war directory and other web application roots; remove any unknown shells.
- Enable logging of deserialization attempts and monitor for abnormal POST traffic to /hub endpoints.
- Conduct a thorough post‑exploitation review for persistence mechanisms such as MeshCentral agents and SSH credentials.
Related vulnerabilities
ShinyHunters Exploits CVE-2026-35273 with WAF Bypass
ShinyHunters (UNC6240) is actively exploiting CVE-2026-35273 in Oracle PeopleSoft, bypassing WAF rules via URL encoding. Defenders should prioritize patching and consider disabling the Environment Management Hub (EMHub).
Read briefing
FBI Removes Accenture Contractor After Patch Failure Exposes Thousands of Employees in ShinyHunters Breach
The FBI terminated an Accenture contractor after a failure to apply an Oracle PeopleSoft patch enabled the ShinyHunters group to exfiltrate personal data of thousands of bureau employees. The breach exploited CVE‑2026‑35273 via a URL‑encoding trick that bypassed the WAF protecting the Environment Management Hub endpoint. Defenders should verify patch status, harden PeopleSoft deployments, and audit WAF rules for similar bypasses.
Read briefing
ShinyHunters Resumes Oracle PeopleSoft Exploitation via WAF Bypass
The extortion group ShinyHunters has re‑opened attacks on Oracle PeopleSoft servers by applying a URL‑encoding trick that evades WAF rules protecting the PSEMHUB endpoint. Vulnerable systems that have not applied the CVE‑2026‑35273 patch remain at risk of unauthenticated remote code execution. Defenders should verify WAF configurations, apply the Oracle patch, and monitor for suspicious access patterns.
Read briefing
Jordanian Teen Detained as ShinyHunters Extorted Boeing Spin‑Off
A 17‑year‑old from Amman, Jordan, suspected of leading the ShinyHunters hacking gang, was arrested while the group was extorting a Boeing divestiture. The gang exploited a zero‑day in Oracle PeopleSoft (CVE‑2026‑35273) to breach the FBI and other targets. Defenders should patch PeopleSoft immediately, deploy Mandiant WAF rules, and monitor for similar extortion tactics.
Read briefing