Vulnerabilities
ShinyHunters Exploits CVE-2026-35273 with WAF Bypass
ShinyHunters (UNC6240) is actively exploiting CVE-2026-35273 in Oracle PeopleSoft, bypassing WAF rules via URL encoding. Defenders should prioritize patching and consider disabling the Environment Management Hub (EMHub).
What Happened
ShinyHunters (tracked as UNC6240) has resumed mass exploitation of CVE-2026-35273, a vulnerability in Oracle PeopleSoft's Environment Management Hub (PSEMHUB). This campaign expands beyond the initial targeting of academic institutions in June 2026, now affecting organizations across diverse sectors globally.
Impact
The threat actor is successfully bypassing web application firewall (WAF) rules designed to block access to the vulnerable endpoint. They achieve this by URL-encoding a single character in the request path – specifically, requesting /%50SEMHUB/ instead of /PSEMHUB/. This bypass allows them to deploy web shells on compromised systems. Affected sectors include higher education, technology, IT services, healthcare, agriculture, transportation, and government.
What to Do
- Patch Immediately: Apply the Oracle Security Alert patch for CVE-2026-35273. This is the primary mitigation.
- Disable EMHub: In multi-server configurations, disable the Environment Management Hub (EMHub) service.
- Do Not Rely on WAFs Alone: Path-based WAF rules are insufficient. The current campaign demonstrates a successful bypass technique.
Technical Details
Many WAF and reverse proxy rules match the literal path before URL decoding. However, the PeopleSoft application server correctly decodes the request, allowing access to the vulnerable servlet.
Related vulnerabilities
FBI Removes Accenture Contractor After Patch Failure Exposes Thousands of Employees in ShinyHunters Breach
The FBI terminated an Accenture contractor after a failure to apply an Oracle PeopleSoft patch enabled the ShinyHunters group to exfiltrate personal data of thousands of bureau employees. The breach exploited CVE‑2026‑35273 via a URL‑encoding trick that bypassed the WAF protecting the Environment Management Hub endpoint. Defenders should verify patch status, harden PeopleSoft deployments, and audit WAF rules for similar bypasses.
Read briefing
Oracle PeopleSoft CVE-2026-35273 Exploitation: WAF Bypass and Web Shell Deployment
Attackers have resumed mass exploitation of Oracle PeopleSoft’s critical CVE‑2026‑35273, bypassing WAFs by URL‑encoding the PSEMHUB path to deploy JSP web shells. The campaign spans higher education, healthcare, IT services, and government, enabling unauthenticated remote code execution. Defenders should patch immediately, verify WAF rules, and monitor for shell uploads.
Read briefing
ShinyHunters Resumes Oracle PeopleSoft Exploitation via WAF Bypass
The extortion group ShinyHunters has re‑opened attacks on Oracle PeopleSoft servers by applying a URL‑encoding trick that evades WAF rules protecting the PSEMHUB endpoint. Vulnerable systems that have not applied the CVE‑2026‑35273 patch remain at risk of unauthenticated remote code execution. Defenders should verify WAF configurations, apply the Oracle patch, and monitor for suspicious access patterns.
Read briefing
Jordanian Teen Detained as ShinyHunters Extorted Boeing Spin‑Off
A 17‑year‑old from Amman, Jordan, suspected of leading the ShinyHunters hacking gang, was arrested while the group was extorting a Boeing divestiture. The gang exploited a zero‑day in Oracle PeopleSoft (CVE‑2026‑35273) to breach the FBI and other targets. Defenders should patch PeopleSoft immediately, deploy Mandiant WAF rules, and monitor for similar extortion tactics.
Read briefing