ShinyHunters Bypasses WAFs to Renew Mass Exploitation of PeopleSoft CVE-2026-35273

ShinyHunters (UNC6240) has resumed mass exploitation of CVE-2026-35273, a CVSS 9.8 unauthenticated RCE in Oracle PeopleSoft's Environment Management Hub, after modifying its exploit to slip past WAF rules that were supposed to have closed the hole. The bypass works because many WAFs match the literal request path before decoding, so URL-encoding one character in /PSEMHUB/ as /%50SEMHUB/ reaches the vulnerable servlet untouched. What started in June as targeted zero-day attacks on academic institutions has now expanded into a global campaign spanning multiple sectors.</br> Organizations that believed a WAF rule mitigated this flaw are still exposed if the underlying servlet wasn't patched.

• CVE-2026-35273 (CVSS 9.8) allows unauthenticated remote code execution against PeopleSoft's Environment Management Hub (PSEMHUB) endpoint.
• Bypass technique: attackers request /%50SEMHUB/ instead of /PSEMHUB/, exploiting WAFs that pattern-match the raw path before URL decoding while the app server decodes and routes it anyway.
• Post-exploitation includes deploying MeshCentral remote access agents, lateral movement over SSH using known username/password pairs across internal PeopleSoft hosts, and data theft.
• Mandiant previously notified over 100 organizations with vulnerable IPs (mostly U.S.-based) after the June zero-day wave against education; the new campaign has broadened well beyond that sector.
• Caveat: the technical bypass details and victim scope come from a single Mandiant/Google threat-intel report, corroborated by one news outlet summarizing it, with no independent CVE advisory cited.

Bottom line If you run Oracle PeopleSoft, verify the PSEMHUB servlet is actually patched (not just WAF-blocked) and audit your WAF's URL-decoding order this week.