ShinyHunters Bypasses WAF Rules to Resume Oracle PeopleSoft Attacks Across 7 Sectors

CVE-2026-35273 is an unauthenticated server-side request forgery to remote code execution vulnerability in the Oracle PeopleSoft PeopleTools Environment Management Hub (PSEMHUB) servlet. The PSEMHUB endpoint accepts serialized Java objects via POST requests and processes them without authentication. An attacker who reaches the endpoint can supply a crafted payload that triggers the SSRF chain and achieves code execution on the PeopleSoft application server.

After Oracle patched the vulnerability in June 2026 and public reporting drove widespread deployment of WAF rules blocking requests to /PSEMHUB/, ShinyHunters researchers tested URL-encoding variants of the path. HTTP servers and Java servlet containers normalize percent-encoded characters in URL paths before routing requests to backend servlets. /PSEMHUB/hub and /%50SEMHUB/hub are functionally identical from the application's perspective because %50 decodes to the uppercase letter P.

WAF rules that block based on literal string matching against the raw request URI do not normalize URLs before matching. The WAF evaluates /%50SEMHUB/hub, sees no match for PSEMHUB, and passes the request to the backend. The backend servlet receives /PSEMHUB/hub after URL normalization and processes it. The exploit executes.

Before launching the exploit, UNC6240 sends five to fifteen POST requests to /PSEMHUB/hub as a reconnaissance fingerprint to confirm the endpoint is reachable and the application server version. Detection systems that alert on this reconnaissance phase can catch the attack before the payload stage.

Google's Threat Intelligence Group warns that the %50 encoding of P is the first observed variant and that UNC6240 is likely to rotate through other encodings including lowercase p (%70), double encoding, and mixed-case variants. Effective WAF coverage requires regex normalization, not an expanded list of blocked strings.

Google's Mandiant team tracked the current exploitation wave to web shell deployments across higher education, technology, IT services, healthcare, agriculture, transportation, and government sectors worldwide. The sector breadth reflects the deployment footprint of Oracle PeopleSoft, which serves as the student information and human capital management backbone for universities, hospital systems, and public-sector agencies.

Higher education has been the dominant target since ShinyHunters first weaponized CVE-2026-35273 as a zero-day in June 2026. PeopleSoft-based student information systems are frequently internet-facing with known predictable URL structures, making them discoverable through search engines and mass scanning. Many universities also delayed patching during the June-August 2026 academic break period, leaving a large pool of unpatched servers available at the start of the September semester.

The agriculture and transportation victims in the current wave reflect that PeopleSoft is also the dominant enterprise resource planning platform for large non-educational organizations. A compromised PeopleSoft installation at a logistics company or agricultural processor provides access to payroll data, supply chain integrations, and employee identity credentials that have value for extortion and data sale.

The ShinyHunters group has a documented track record of large-scale data theft followed by extortion. In prior campaigns the group exfiltrated data and listed it for sale on dark web forums before approaching victims with ransom demands. Organizations with confirmed compromise should assume data exfiltration is in scope and initiate breach notification procedures rather than waiting for the group to make contact.

After achieving code execution via the PSEMHUB endpoint, UNC6240 follows a consistent post-exploitation sequence tracked by Mandiant across the June and September 2026 campaigns.

The first stage drops web shells into the PeopleSoft web application directories. The primary shells are x.jsp for interactive command execution and u.jsp for file upload. These provide the attacker with a persistent interactive foothold that survives application restarts.

The second stage establishes tunneling infrastructure using Neo-reGeorg. The toolkit's servlet files (tunnel.jsp and tunnel.jspx) are deployed into accessible web directories and used to create SOCKS5 proxy channels. Lateral movement traffic routed through these tunnels appears as ordinary HTTPS connections to the web server and bypasses traditional network segmentation controls.

The third stage deploys SIDEEYE, the group's custom C++ backdoor, via a trojanized installer named Ple64.exe disguised as a Light Alloy media player. The installer is signed with a certificate that has since been revoked. Inside the installer is a three-stage loader chain where stage two is protected with VMProtect 3 obfuscation. The final SIDEEYE payload communicates with a command-and-control server at 162.219.30.165 over TCP.

For persistence on Linux PeopleSoft hosts, the group deploys MeshAgent, a legitimate remote monitoring and management agent. The binaries and configuration files are dropped directly into /tmp as meshagent, meshagent.msh, and meshagent.db. The MeshAgent installation routes outbound connections to attacker-controlled infrastructure masquerading as Microsoft Azure services using the domains azurenetfiles.net, microsoft-entra.net, and enroll.azuredevice.cloud.

Block the following indicators at your perimeter firewall and EDR immediately. The C2 IP and masquerade domains are active. Web shell filenames should trigger alerts on any PeopleSoft host.

These rules detect the WAF bypass pattern in web server access logs and web shell creation in PeopleSoft application directories. Both carry experimental status; validate against your environment's log format before enabling automatic blocking.

Organizations that deployed WAF rules as their primary mitigation for CVE-2026-35273 need to act now. The bypass confirms that WAF rules are a temporary measure, not a substitute for patching. Follow these steps in priority order.

The ShinyHunters Oracle PeopleSoft WAF bypass illustrates a failure mode that extends well beyond this specific CVE. Organizations that accept WAF rules as a permanent substitute for patching are operating on the assumption that the attacker has not tested obvious evasion techniques. In this case, the bypass required encoding a single character. The attacker did not need to find a new vulnerability or defeat a cryptographic control; they needed to know that WAF rules typically match on literal strings rather than normalized URIs.

PeopleSoft is deployed in more than 7,000 organizations worldwide, predominantly in higher education, government, and large enterprise. Many of these deployments are internet-facing because PeopleSoft serves as the student information system for universities, the HR platform for government agencies, and the ERP backbone for enterprise operations. A compromised PeopleSoft installation gives an attacker access to payroll data, identity credentials, benefits enrollment, and supply chain integrations. ShinyHunters monetizes this access through data extortion.

The two lessons from today's campaign are universal. First, WAF rules that depend on literal string matching will always be bypassable through encoding, case variation, or parameter pollution; they must be treated as supplementary controls, not primary defenses. Second, the three months between Oracle's June 2026 patch release and today's renewed exploitation wave represent the patching window that organizations who chose WAF-only remediation are now paying for.

If your PeopleSoft environment is unpatched, today's campaign confirms that attackers are testing every WAF rule you have deployed. Apply CPU187, update the WAF regex, and verify your environment has not already been compromised using the indicators above.