Attackers Bypass WAFs to Exploit Oracle PeopleSoft Flaw and Deploy Web Shells
UNC6240 bypasses WAFs to mass-exploit Oracle PeopleSoft CVE-2026-35273 and deploy web shells and SIDEEYE.
Google-owned Mandiant warns that ShinyHunters-linked UNC6240 is again mass-exploiting CVE-2026-35273, a CVSS 9.8 unauthenticated remote-code-execution flaw in Oracle PeopleSoft. The group bypasses web-application firewalls by URL-encoding a single character in the PSEMHUB path, then uses Java deserialization to plant JSP web shells, a signed Ple64.exe loader for the SIDEEYE backdoor, MeshAgent, and Neo-reGeorg tunnels. The flaw was first used as a zero-day against academic institutions; Mandiant previously notified more than 100 organizations, mostly in the United States, and the new wave hits education, technology, healthcare, government, and other sectors. Separately, ShinyHunters claim they breached FBIJobs.gov with a different PeopleSoft zero-day and took about 2-3 TB of data, saying it was not for ransom.
- CVE-2026-35273 is a CVSS 9.8 unauthenticated RCE flaw in PeopleSoft PSEMHUB.
- UNC6240 URL-encodes one path character to bypass string-based WAF rules.
- Intruders deploy JSP shells, SIDEEYE, MeshAgent, and Neo-reGeorg tunnels.
- Targets include education, healthcare, technology, and government, largely in the U.S.
- ShinyHunters claim a different PeopleSoft zero-day hit FBIJobs.gov, taking 2-3 TB.
- CVEs
- CVE-2026-35273
- ATT&CK
- T1190 Exploit Public-Facing ApplicationT1505.003 Web ShellT1219 Remote Access SoftwareT1021.004 SSHT1078 Valid Accounts
- Vendors
- Oracle
- Threat actors
- UNC6240ShinyHuntersGnosticPlayers
- Malware
- SIDEEYENeo-reGeorg
- Victims
- FBI
- Countries
- United States
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-35273 | Unauthenticated Takeover Flaw in Oracle PeopleSoft Enterprise PeopleTools | 9.8 | 97% | KEVRansomwarePoC | KEV |
From the original article
3 min read at thehackernews.com
Google is warning of renewed mass exploitation of a known security vulnerability in Oracle PeopleSoft as part of a campaign targeting multiple sectors globally. The ShinyHunters-linked activity involves the weaponization of CVE-2026-35273 (CVSS score: 9. 8), a critical security flaw that could result in unauthenticated remote code execution.
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.