Date: September 27, 2026
Author: Threat Research & Intelligence Team, Digital Spying
Category: Web Application Security / Enterprise ERP / Zero-Day & Active Exploits
Tags: Oracle PeopleSoft, CVE-2026-35273, WAF Bypass, ShinyHunters, UNC6240, Web Shells, Remote Code Execution, Mandiant
Executive Summary
Relying on perimeter web application firewalls (WAFs) as a substitute for vendor security patches has once again proven to be a catastrophic defense strategy. In an urgent threat intelligence advisory released on September 25–26, 2026, Google Threat Intelligence and Mandiant warned of an aggressive renewed mass-exploitation campaign targeting Oracle PeopleSoft instances worldwide.
The campaign, attributed to the cybercriminal threat group tracked as UNC6240 (linked to the notorious ShinyHunters syndicate), weaponizes CVE-2026-35273—a maximum-severity unauthenticated Remote Code Execution (RCE) vulnerability in Oracle PeopleSoft Enterprise PeopleTools carrying a CVSS score of 9.8 (Critical). While Oracle issued an out-of-band security patch earlier this year, hundreds of global organizations opted to implement virtual patching via WAF block rules targeting the vulnerable /PSEMHUB/ URL path instead of upgrading their backend applications.
In this latest offensive wave, UNC6240 bypassed literal string-matching WAF rules using a trivial URL-encoding variation (/%50SEMHUB/). Once the request bypasses edge filters, the backend PeopleSoft application server decodes the URL and processes the malicious payload without authentication. Adversaries have successfully breached dozens of high-value targets across higher education, healthcare, technology, and government sectors, dropping JSP web shells, deploying the custom SIDEEYE backdoor, and installing MeshCentral remote access tooling for internal network pivoting.
Technical Deep-Dive: Deconstructing the WAF Bypass & RCE Exploit Chain
To understand why simple URL transformation defeats enterprise-grade perimeter shields, we examine the request parsing discrepancies between reverse proxies/WAFs and the underlying Oracle WebLogic / PeopleSoft servlet engine.+-----------------------------------------------------------------------------------+
| ORACLE PEOPLESOFT WAF BYPASS ATTACK ARCHITECTURE |
|---|+-----------------------------------------------------------------------------------+
Attacker (UNC6240) Edge WAF / Reverse Proxy Target PeopleSoft Server
| | |
| 1. Dispatches HTTP POST request | |
| Path: `/%50SEMHUB/...` | |
| Payload: Malicious serialized | |
| Java object in request body | |
|--------------------------------->| |
| | 2. WAF Rule Evaluation: |
| | - Rule matches literal |
| | `/PSEMHUB/*` path |
| | - `%50` is NOT normalized |
| | before evaluation |
| | - Rule check: PASS (Allowed) |
| |--------------------------------->|
| | | 3. PeopleSoft Servlet Engine:
| | | - URL decodes `%50` to `P`
| | | - Resolves `/PSEMHUB/`
| | | - Invokes Environment Hub
| | |
| | | 4. CVE-2026-35273 Exploited:
| | | - Deserializes untrusted input
| | | - Executes arbitrary code
| | | - Drops JSP Web Shells
| | | (`x.jsp`, `u.jsp`)
| | |
| 5. Establishes Interactive Command Access |
| and Deploys SIDEEYE Backdoor & MeshCentral Agents |
|<====================================================================|
| |
| 6. Lateral Movement via SSH across Internal Database & HR Subnets |
|-------------------------------------------------------------------->|
1. The Flaw: Pre-Authentication Deserialization in PSEMHUB
The root cause of CVE-2026-35273 resides in the PeopleSoft Environment Management Hub (PSEMHUB), an administrative component packaged with PeopleSoft Enterprise PeopleTools:
* Exposed Management Endpoint: PSEMHUB communicates with distributed environment management agents across enterprise networks over HTTP/HTTPS, typically exposed under the web context /PSEMHUB/.
* Unauthenticated Ingestion: The endpoint accepts inbound serialized Java objects without enforcing prior session authentication or cryptographic origin verification.
* Remote Code Execution: By supplying a weaponized serialization gadget chain in the body of an HTTP POST request, an unauthenticated attacker triggers arbitrary command execution within the security context of the WebLogic service account operating PeopleSoft.
2. The WAF Normalization Mismatch
When organizations learned of active zero-day exploitation of CVE-2026-35273 earlier in 2026, many deployed perimeter WAF rules designed to reject requests matching:^/PSEMHUB/.*
However, the architecture of modern web application stacks introduces subtle parsing ambiguities between HTTP proxies and Java-based application servers:
* Literal Inspection Failure: Many cloud WAFs and Layer-7 reverse proxies inspect incoming requests using literal path matching or single-pass decoding without performing canonical URL path normalization.
* URL Encoding Evasion: The ASCII hexadecimal representation of uppercase ASCII letter 'P' is %50. When an attacker requests /%50SEMHUB/, the perimeter inspection engine compares the literal string /%50SEMHUB/ against the signature /PSEMHUB/ and determines there is no match.
* Backend Decoding: When the forwarded HTTP request reaches Oracle WebLogic and the PeopleSoft servlet filter, the application server automatically performs URI decoding on the request path. The path transforms into /PSEMHUB/, mapping directly to the vulnerable Environment Management Hub handler.
3. Post-Exploitation: Web Shells, SIDEEYE, and Lateral Infiltration
According to technical forensic reports from The Hacker News and BleepingComputer:
1. Web Shell Staging: Attackers drop lightweight JSP web shells (frequently named x.jsp, u.jsp, or obfuscated variants) directly into publicly accessible web document roots.
2. Backdoor Deployment: The attackers establish persistent access by deploying the SIDEEYE backdoor and launching open-source MeshCentral agents, which establish outbound encrypted management tunnels to threat actor infrastructure.
3. Internal Pivoting: Because PeopleSoft servers are deeply integrated into enterprise backplanes, adversaries harvest stored database credentials and SSH keys, executing lateral movement scripts against payroll, human resources, and campus student information systems.
Industry Impact & Enterprise Risk
The resurgence of PeopleSoft exploitation represents an existential risk for organizations with public-facing enterprise resource planning (ERP) systems:
* High-Value Sector Targeting: PeopleSoft is overwhelmingly deployed by large universities, healthcare networks, financial institutions, and government agencies to administer employee compensation, student financial aid, and core accounting records.
* Ransomware & Extortion: UNC6240 / ShinyHunters operates primarily as a data exfiltration and extortion cartel. Compromised instances provide direct access to personally identifiable information (PII), banking details, and intellectual property.
* The Virtual Patch Fallacy: This campaign illustrates the inherent peril of relying on perimeter regex rules rather than binary patching. Whenever application logic is exposed to untrusted traffic, subtle encoding variations (double URL encoding, Unicode overlong sequences, path normalization quirks) will inevitably bypass perimeter filters.
Defensive Hardening & Remediation Blueprint
Security operations centers and PeopleSoft systems administrators must immediately implement the following defense-in-depth measures:
1. Apply Vendor Security Patches Immediately (Mandatory)
Virtual patching cannot substitute for underlying code fixes. Apply Oracle's official security update for CVE-2026-35273 across all PeopleSoft PeopleTools installations immediately.
2. Disable or Restrict Access to PSEMHUB
Unless explicitly required for inter-system communication across public boundaries, access to the Environment Management Hub should never be exposed to the public internet:
* Restrict /PSEMHUB/ access strictly to internal management networks or trusted bastion hosts via network security groups (NSGs) or firewall access control lists (ACLs).
* If PSEMHUB is not actively utilized in your environment, disable the hub servlet within the WebLogic console.
3. Update WAF Signatures for Encoded and Transformed Paths
If an immediate maintenance window for patching is unavailable, immediately update WAF blocking rules to normalize URLs before matching, and explicitly block encoded variants:
* Block all regex patterns matching: ^/(%50|%70|P|p)(%53|%73|S|s)(%45|%65|E|e)(%4D|%6D|M|m)(%48|%68|H|h)(%55|%75|U|u)(%42|%62|B|b)/.*
* Enforce strict URL normalization and reject requests with non-canonical URL encoding before routing to backend servers.
4. Forensic Hunting & Compromise Assessment
Conduct immediate forensic sweeps across all PeopleSoft web server logs and filesystem directories:
* Log Review: Search access logs for requests containing /PSEMHUB/, /%50SEMHUB/, or any case/encoding permutation over the past 90 days.
* Web Shell Detection: Inspect WebLogic application deployment directories (e.g., webapps or applications) for recently created .jsp files, particularly single-letter filenames (x.jsp, u.jsp, test.jsp).
* Process Monitoring: Audit host process trees for unexpected child processes spawned by WebLogic (e.g., cmd.exe, powershell.exe, /bin/sh, or unauthorized node/meshagent binaries).
________________
For technical vulnerability breakdowns, ERP defense guides, and web application threat research, subscribe to Digital Spying.