Date: September 26, 2026
Author: Threat Research & Intelligence Team, Digital Spying
Category: Enterprise Security / Web Application Exploitation / Cyber Extortion
Tags: Oracle PeopleSoft, ShinyHunters, UNC6240, CVE-2026-35273, WAF Bypass, MeshCentral, Web Shells
Executive Summary
Enterprise resource planning (ERP) systems represent the crown jewels of corporate and institutional infrastructure, housing employee identities, financial ledgers, and payroll operations. On September 25–26, 2026, Google Cloud Threat Intelligence and Mandiant published an urgent threat research bulletin, covered by The Hacker News and Aviatrix, warning of renewed, mass in-the-wild exploitation of Oracle PeopleSoft.
The campaign is orchestrated by threat actor UNC6240, an intrusion cluster directly linked to the notorious cyber extortion syndicate ShinyHunters. What elevates this campaign to an urgent enterprise crisis is the threat actor's evolution: UNC6240 has engineered a payload modification that successfully bypasses Web Application Firewall (WAF) detection rules, enabling unauthenticated Remote Code Execution (RCE) via CVE-2026-35273 (CVSS 9.8 Critical).
By circumventing commercial WAF filters that organizations relied on as compensatory controls, the attackers have breached dozens of academic institutions, healthcare providers, and enterprise networks globally. Once inside, the group deploys persistent JSP web shells and installs the open-source MeshCentral remote management agent, using compromised systems to harvest internal credentials and exfiltrate massive troves of sensitive HR and payroll records.
Technical Deep-Dive: Deconstructing the WAF Bypass and Exploitation Chain
To understand how UNC6240 bypassed enterprise perimeter shields to weaponize CVE-2026-35273, we examine the mechanics of HTTP normalization evasion and post-compromise lateral movement.+-----------------------------------------------------------------------------------+
| UNC6240 PEOPLESOFT WAF BYPASS ATTACK CHAIN |
|---|
Threat Actor (UNC6240 / ShinyHunters) Perimeter WAF Layer Oracle PeopleSoft Server
| | (WebLogic / Tuxedo)
| | |
| 1. Dispatches crafted exploit request: | |
| - Uses Chunked Transfer Encoding | |
| - Nested URL-encoding & parameter | |
| fragmentation | |
|----------------------------------------->| |
| | 2. WAF inspects request: |
| | - Fails to reassemble chunks / |
| | normalize non-standard encoding |
| | - Evaluates request as "BENIGN" |
| |---------------------------------------->|
| | |
| | | 3. PeopleSoft WebLogic engine:
| | | - Reassembles HTTP body
| | | - Parses vulnerable endpoint
| | | - Triggers CVE-2026-35273
| | |
| | | 4. Unauthenticated RCE achieved:
| | | Writes JSP Web Shell to disk!
| | |<-----------------------------------------
| | |
| 5. Interacts with web shell to install MeshCentral agent & harvest SSH keys |
|----------------------------------------------------------------------------------->|
| 6. Pivots laterally over SSH across internal HR / Campus database segments! |
|<===================================================================================|
1. The Vulnerability: CVE-2026-35273 in Oracle PeopleSoft
CVE-2026-35273 resides in the core architecture of Oracle PeopleSoft Enterprise (impacting PeopleTools versions underpinning Human Capital Management [HCM], Financials, and Campus Solutions):
* The flaw allows an unauthenticated remote attacker to submit crafted network input over HTTP/HTTPS that forces the application server into executing arbitrary operating system commands.
* Because the vulnerability operates pre-authentication, no administrative login credentials or session tokens are required to trigger execution.
2. The Weaponization: Bypassing Commercial WAFs
When CVE-2026-35273 was initially identified, many organizations deployed virtual patches and WAF signature rules (e.g., regex patterns blocking specific parameter strings and serialized objects) while scheduling downtime for official Oracle patch deployment.
Mandiant’s analysis revealed how UNC6240 defeated these defenses:
* HTTP Chunked Transfer Encoding Evasion: The attacker fragments the malicious HTTP POST body across multiple chunked data packets (Transfer-Encoding: chunked). Many perimeter proxies and WAF engines inspect only the initial packet buffer or fail to reassemble chunked boundaries before forwarding the stream.
* Encoding Impedance Mismatch: UNC6240 combined multiple layers of non-standard percent-encoding (e.g., mixed hexadecimal representations and path segment separators) that WAF parsers skipped, but that PeopleSoft’s underlying Oracle WebLogic server normalized into clean command syntax before execution.
* The result: WAFs waved the malicious traffic through without generating alerts, allowing the exploit to detonate cleanly against unpatched backend servers.
3. Post-Exploitation & Persistence: The MeshCentral Playbook
Once arbitrary command execution is achieved on the PeopleSoft server, UNC6240 initiates an aggressive post-exploitation workflow:
1. Dropping JSP Web Shells: The exploit writes lightweight, password-protected JavaServer Pages (.jsp) backdoors into the PeopleSoft web application root (webserv/peoplesoft/applications/).
2. Deploying MeshCentral Agent: To maintain redundant, out-of-band remote access, the actors download and execute the MeshCentral agent (meshagent), a legitimate open-source remote management utility. Because MeshCentral establishes outbound HTTPS connections over TCP 443 to attacker-controlled C2 servers, it easily bypasses restrictive inbound firewall rules.
3. Internal SSH Lateral Movement: The actors run automated shell scripts to search for hardcoded credentials, database configuration files (psprcs.cfg), and private SSH keys, using them to move laterally to internal database hosts and backup repositories.
Global Impact: Higher Education, Healthcare, and Government
The targeting of PeopleSoft has acute systemic consequences:
* Higher Education & Campus Solutions: Attackers targeted universities managing admissions, financial aid, and grading systems, exfiltrating student and faculty Personally Identifiable Information (PII) for extortion.
* Corporate & Government Payroll: In enterprise deployments, PeopleSoft HCM manages direct deposit bank accounts, tax filings (W-2 forms), and executive compensation.
* ShinyHunters Retaliation Campaign: Threat intelligence reports indicate that ShinyHunters intensified its exploitation efforts following law enforcement crackdowns on cybercriminal forums, claiming credit for attacks on government contractor portals.
Defensive Hardening & Enterprise Remediation Blueprint
Enterprise security teams and PeopleSoft administrators must execute immediate containment and verification protocols:
1. Apply Official Oracle Security Patches (Mandatory)
WAF rules are insufficient as a long-term control. Organizations must immediately install the official security patches provided in the Oracle Critical Patch Update (CPU):
* Review Oracle Security Advisory for CVE-2026-35273 and apply the corresponding PeopleTools patch bundle.
* Re-verify patch application in the PeopleTools Environment Management Framework.
2. Reconfigure WAF Inspection for De-Chunking & Full Normalization
Ensure your Web Application Firewall (AWS WAF, Cloudflare, F5 BIG-IP, or Akamai) is configured to enforce strict HTTP parsing:
* Enable Request Body De-Chunking to force the WAF to reassemble chunked streams prior to signature evaluation.
* Enforce strict request validation rules that reject non-standard or malformed encoding sequences.
3. Threat Hunting & Endpoint Indicators of Compromise (IoCs)
Search PeopleSoft application servers for signs of active UNC6240 presence:
* Hunt for MeshCentral Binaries: Check running processes and disk paths for unauthorized instances of the MeshCentral agent:ps aux | grep -i meshagent
find / -name "meshagent*" -o -name "meshcore*" 2>/dev/null
* Audit Web Directories for Rogue JSP Files: Inspect PeopleSoft web server deployment directories for recently modified or untracked .jsp files:find /opt/oracle/psft/pt/webserv/ -name "*.jsp" -type f -mtime -30
* Network C2 Telemetry: Monitor outbound firewall connections on TCP 443 originating from PeopleSoft application servers to unclassified external IP addresses.
For technical threat intelligence advisories, WAF evasion teardowns, and enterprise ERP vulnerability coverage, follow Digital Spying.