Threat Intel
ShinyHunters Resumes Oracle PeopleSoft Exploitation via WAF Bypass
The extortion group ShinyHunters has re‑opened attacks on Oracle PeopleSoft servers by applying a URL‑encoding trick that evades WAF rules protecting the PSEMHUB endpoint. Vulnerable systems that have not applied the CVE‑2026‑35273 patch remain at risk of unauthenticated remote code execution. Defenders should verify WAF configurations, apply the Oracle patch, and monitor for suspicious access patterns.
What Happened
ShinyHunters, tracked as UNC6240, has begun exploiting Oracle PeopleSoft’s CVE‑2026‑35273 vulnerability again. The gang uses a URL‑encoding technique to slip past web application firewall rules that were designed to block traffic to the vulnerable PSEMHUB endpoint.
Impact
Unpatched PeopleSoft installations—particularly those still exposing the PSEMHUB service—are susceptible to unauthenticated remote code execution. The attack vector allows attackers to exfiltrate data from affected organizations, many of which are in the education sector.
Mitigation Steps
- Apply Oracle’s CVE‑2026‑35273 patch immediately.
- Re‑evaluate WAF rule sets to ensure they detect and block encoded URLs targeting the PSEMHUB endpoint.
- Disable or restrict external access to the PSEMHUB service until the patch is confirmed.
- Implement network segmentation so that PeopleSoft traffic is isolated from other critical assets.
Additional Recommendations
Conduct a rapid audit of all PeopleSoft instances to confirm patch status. Deploy continuous monitoring for anomalous request patterns, such as repeated encoded URL attempts. Coordinate with Oracle support for any configuration guidance related to the patch. Finally, maintain an up‑to‑date inventory of all web application firewalls to verify rule coverage.
Related vulnerabilities
ShinyHunters Exploits CVE-2026-35273 with WAF Bypass
ShinyHunters (UNC6240) is actively exploiting CVE-2026-35273 in Oracle PeopleSoft, bypassing WAF rules via URL encoding. Defenders should prioritize patching and consider disabling the Environment Management Hub (EMHub).
Read briefing
FBI Removes Accenture Contractor After Patch Failure Exposes Thousands of Employees in ShinyHunters Breach
The FBI terminated an Accenture contractor after a failure to apply an Oracle PeopleSoft patch enabled the ShinyHunters group to exfiltrate personal data of thousands of bureau employees. The breach exploited CVE‑2026‑35273 via a URL‑encoding trick that bypassed the WAF protecting the Environment Management Hub endpoint. Defenders should verify patch status, harden PeopleSoft deployments, and audit WAF rules for similar bypasses.
Read briefing
Jordanian Teen Detained as ShinyHunters Extorted Boeing Spin‑Off
A 17‑year‑old from Amman, Jordan, suspected of leading the ShinyHunters hacking gang, was arrested while the group was extorting a Boeing divestiture. The gang exploited a zero‑day in Oracle PeopleSoft (CVE‑2026‑35273) to breach the FBI and other targets. Defenders should patch PeopleSoft immediately, deploy Mandiant WAF rules, and monitor for similar extortion tactics.
Read briefing
Oracle PeopleSoft CVE-2026-35273 Exploitation: WAF Bypass and Web Shell Deployment
Attackers have resumed mass exploitation of Oracle PeopleSoft’s critical CVE‑2026‑35273, bypassing WAFs by URL‑encoding the PSEMHUB path to deploy JSP web shells. The campaign spans higher education, healthcare, IT services, and government, enabling unauthenticated remote code execution. Defenders should patch immediately, verify WAF rules, and monitor for shell uploads.
Read briefing