Mandiant says UNC6240, also tracked as ShinyHunters, has renewed mass exploitation of Oracle PeopleSoft CVE-2026-35273 after changing its request path by one URL-encoded character. The new wave moved beyond the June focus on higher education and now includes dozens of web shells on systems across multiple sectors worldwide.
The trick is simple: the attacker asks for /%50SEMHUB/ instead of /PSEMHUB/, so a path-based WAF sees a different string and lets it through, while the PeopleSoft application server decodes the path and still routes the request to the vulnerable servlet. That means perimeter rules that only match the literal URL can look effective while the backend remains reachable.
For organizations using PeopleSoft Environment Management Hub controls, the exposure sits at the boundary between filtering and application routing, not just in the product version list. If the request is decoded after the filter checks it, a blocked endpoint can still be hit and turned into a web shell foothold.
ShinyHunters Renewed Mass Exploitation Campaign Targeting Oracle PeopleSoft | Google Cloud Blog
This follow-up report details how UNC6240 (ShinyHunters) is mass-exploiting Oracle PeopleSoft (CVE-2026-35273) by bypassing WAF rules via a single URL-encoded character, providing full analysis of the attack pipeline, observed post-exploitation activity, IOCs, and remediation steps.