ShinyHunters Bypasses WAF Rules to Exploit Oracle PeopleSoft Flaw

The ShinyHunters extortion group is using URL-encoding tricks to bypass web application firewall (WAF) rules designed to mitigate the Oracle PeopleSoft CVE-2026-35273 vulnerability. The technique allows attackers to resume widespread exploitation against vulnerable servers.

According to Google’s Mandiant and Threat Intelligence Group (GTIG), the new method targets PeopleSoft servers that have not been updated and rely on a WAF to block access to vulnerable PSEMHUB endpoints.

On June 10, BleepingComputer reported that ShinyHunters was using a zero-day vulnerability to target Oracle PeopleSoft servers and steal data from 100 organizations.

The following day, Oracle disclosed and patched the PeopleSoft zero-day as CVE-2026-35273, a vulnerability that allows unauthenticated remote code execution.

Google also reported that ShinyHunters, tracked by Mandiant as UNC6240, was exploiting CVE-2026-35273 in attacks against the education sector, confirming BleepingComputer’s report.

At the time, Mandiant advised organizations that could not immediately install the security updates or disable the Environment Management Hub to block external access to vulnerable /PSEMHUB/* endpoints.

However, according to a new report from Google, ShinyHunters has modified its exploit to bypass WAF rules that look for the literal /PSEMHUB/ path.

How the PeopleSoft WAF bypass works

Instead of sending a request to the standard path:

/PSEMHUB/

Attackers send an encoded version:

/%50SEMHUB/

The %50 sequence is the URL-encoded representation of the letter “P.”

Mandiant said many WAFs and reverse proxies compare the literal request path before decoding it. As a result, rules designed to block /PSEMHUB/ may fail to detect the encoded variation.

Oracle WebLogic, however, decodes the encoded character and routes the request to the vulnerable endpoint, allowing the request to bypass the WAF rules.

“This allows attackers to reach endpoints on systems where the operator may have believed the WAF rules were mitigating the risk,” Mandiant explained.

Google warned that ShinyHunters may not always use the %50 variation. The group could also use other percent encodings, mixed case, or additional variations of /PSEMHUB/ to bypass WAF protections.

Rather than relying on web application firewalls, Mandiant recommends that organizations install the latest security updates to protect against CVE-2026-35273.

Organizations should also search WebLogic access logs for requests to /PSEMHUB/ and encoded variants such as /%50SEMHUB/ to identify possible exploitation attempts.

WAF bypass enables new data theft attacks

Google said the latest attack wave introduced web shells to dozens of systems in higher education, technology, IT services, healthcare, agriculture, transportation, and government organizations around the world.

“Mandiant recommends that organizations running Oracle PeopleSoft take the following actions immediately. Additional remediation and hardening guidance is provided later in this post,” the company warned.

An attacker typically sends between five and 15 POST requests containing serialized Java objects to /%50SEMHUB/hub before attempting exploitation.

On a vulnerable system, these requests return information about the host operating system without writing files or disrupting service. This allows ShinyHunters to determine whether the server can be exploited silently.

After confirming that a system is vulnerable, the attackers can exploit the flaw to execute commands directly in memory or deploy a JSP web shell.

According to Google, the attackers deploy the x.jsp web shell for command execution and the u.jsp and u2.jsp shells to upload larger files.

ShinyHunters used these shells to deploy an executable named Ple64.exe on compromised Windows servers. The file masquerades as a signed Light Metal Media Player installer but installs a backdoor tracked by Google as SIDEEYE.

SIDEEYE can manage processes and files, create interactive reverse shells, and steal credentials for reverse proxy functionality.

The attackers also used the open-source Neo-ReGeorg tunneling toolkit through the tunnel.jsp and tunnel.jspx files.

The toolkit tunnels SOCKS5 proxy traffic over regular HTTP and HTTPS connections, allowing attackers to move laterally into internal networks through compromised PeopleSoft servers.

Mandiant also observed ShinyHunters using the legitimate MeshAgent remote management software to maintain access to compromised Linux systems.

ShinyHunters claims another PeopleSoft zero-day

The latest attacks follow ShinyHunters’ claim that it infiltrated FBI systems using what it described as a new zero-day vulnerability in Oracle PeopleSoft.

On September 22, ShinyHunters told BleepingComputer that the vulnerability allowed remote code execution. The group claimed it used the flaw to access the FBI Jobs platform and then move laterally into the FBI’s AWS GovCloud infrastructure.

The group also claimed to have stolen 2 TB to 3 TB of data related to the internal systems of current and former FBI employees, job applicants, and others.

BleepingComputer could not independently verify the alleged zero-day, the claimed lateral movement, or the amount of data reportedly stolen.

The FBI confirmed that it was investigating allegations of fraud affecting FBIjobs.gov but did not confirm that the system had been compromised or that data had been stolen.

ShinyHunters confirmed to BleepingComputer that it used the WAF bypass against FBI Jobs but continued to claim that it also exploited “a new, unknown vulnerability in the same PSEMHUB component.”

Join Mikko Hypponen and security leaders from the NFL, Chanel, and Atlassian for a two-hour digital summit about what will change with AI-speed attacks, what defenders should stop doing, and how to verify, decide, fix, and revalidate at machine speed.

Please reserve your seat