Vulnerabilities · 20h ago
Mandiant says UNC6240, also tracked as ShinyHunters, has renewed mass exploitation of Oracle PeopleSoft CVE-2026-35273 after changing its request path by one URL-encoded character. The new wave moved beyond the June focus on higher education and now includes dozens of web shells on systems across multiple sectors worldwide.
The trick is simple: the attacker asks for /%50SEMHUB/ instead of /PSEMHUB/, so a path-based WAF sees a different string and lets it through, while the PeopleSoft application server decodes the path and still routes the request to the vulnerable servlet. That means perimeter rules that only match the literal URL can look effective while the backend remains reachable.
For organizations using PeopleSoft Environment Management Hub controls, the exposure sits at the boundary between filtering and application routing, not just in the product version list. If the request is decoded after the filter checks it, a blocked endpoint can still be hit and turned into a web shell foothold.
Known exploited · CISA KEV
CVSS 9.8 CRITICAL: vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Updates Environment Management). Known ransomware campaign use. EPSS 9% (95th percentile).
CISA federal remediation date Jun 15 · date passed
1 source covering this story
ShinyHunters Renewed Mass Exploitation Campaign Targeting Oracle PeopleSoft | Google Cloud Blog
This follow-up report details how UNC6240 (ShinyHunters) is mass-exploiting Oracle PeopleSoft (CVE-2026-35273) by bypassing WAF rules via a single URL-encoded character, providing full analysis of the attack pipeline, observed post-exploitation activity, IOCs, and remediation steps.
Part of the PlainSec briefing for 2026-09-26