Attackers Bypass WAFs to Exploit an Oracle PeopleSoft Flaw

Google, through its subsidiary Mandiant, reports renewed mass exploitation of the critical Oracle PeopleSoft flaw CVE-2026-35273 (CVSS 9.8). The campaign, tied to the ShinyHunters group, hits organizations worldwide.

The bug allows unauthenticated remote code execution. It was first used as a zero-day against academic institutions: attackers ran reconnaissance, installed the MeshCentral agent for persistence, moved laterally over SSH to other internal PeopleSoft machines using known username/password pairs, and stole data. At the time, Mandiant notified more than a hundred organizations whose IP addresses matched vulnerable endpoints — most of them in the U.S.

Beating the WAF with one character

The new wave comes from the group UNC6240 tweaking its exploit to bypass web application firewall rules that block the vulnerable Environment Management Hub (PSEMHUB) endpoint. The trick is simple: one character in the request path is URL-encoded, so /%50SEMHUB/ is sent instead of /PSEMHUB/. Many WAF and reverse-proxy rules match the literal path before decoding, while the PeopleSoft application server decodes the request and routes it to the vulnerable servlet.

The chain follows a familiar path. POST requests carrying a serialized Java object to /%50SEMHUB/hub abuse insecure deserialization in the servlet for fileless command execution. Two JSP web shells are dropped into the PSEMHUB.war directory: x.jsp for cross-platform command execution and u.jsp for chunked file uploads. Through u.jsp, a signed, trojanized installer Ple64.exe is uploaded; it loads the C++ backdoor SIDEEYE into memory. That backdoor talks to an external server over TCP and can steal browser and application credentials, manage processes and files, and open an interactive reverse shell and proxy.

Attackers also staged the Neo-reGeorg tunneling toolkit and, for persistence on Linux hosts, deployed the legitimate RMM tool MeshAgent. About a quarter of the commands ran as root or NT Authority\SYSTEM.

What to do

Victims span higher education, technology, IT services, healthcare, agriculture, transportation, and government. Defenders should apply the CVE-2026-35273 patch, disable or remove PSEMHUB, scan WebLogic logs for requests to /PSEMHUB/ and any encoded variant, inspect the PSEMHUB.war directory, rotate the service account's credentials, and watch outbound traffic.

UNC6240 has a track record of data-theft extortion with threats to leak stolen files. Meanwhile, ShinyHunters claimed they breached the FBIJobs.gov portal and stole 2–3 TB of data — not for a ransom, they insist, but to "set the record straight." That portal, they say, was hit through a different PeopleSoft zero-day.

Source: The Hacker News