ShinyHunters uses WAF bypass trick in Oracle PeopleSoft attacks
ShinyHunters bypasses WAF rules blocking PeopleSoft CVE-2026-35273 via percent-encoding, resuming RCE attacks deploying web shells and SIDEEYE backdoors.
Mandiant and Google Threat Intelligence report ShinyHunters (UNC6240) is abusing percent-encoding ('/%50SEMHUB/') to evade WAF rules blocking the vulnerable '/PSEMHUB/' endpoint on unpatched Oracle PeopleSoft servers, because WebLogic decodes the path and routes it to the flaw. CVE-2026-35273 is an unauthenticated RCE previously used to steal data from 100 organizations. The new wave deployed JSP web shells on dozens of systems across education, healthcare, government, and other sectors, plus the SIDEEYE backdoor, Neo-reGeorg tunneling, and MeshAgent for persistence. ShinyHunters claims the same bypass was used against FBI Jobs along with a new unknown PSEMHUB zero-day.
- '/%50SEMHUB/' percent-encoding bypasses WAF rules; WebLogic decodes and routes to vulnerable endpoint
- CVE-2026-35273 is unauthenticated RCE; install the security update instead of relying on WAFs
- Web shells and SIDEEYE backdoor (Ple64.exe) deployed on dozens of systems worldwide
- Neo-reGeorg SOCKS tunneling and MeshAgent enable lateral movement and persistence
- Group claims FBI Jobs breach using bypass plus new unknown PSEMHUB zero-day
- CVEs
- CVE-2026-35273
- ATT&CK
- T1190 Exploit Public-Facing ApplicationT1505.003 Server Software Component: Web ShellT1090.001 Internal ProxyT1555.003 Credentials from Web Browsers
- Threat actors
- ShinyHuntersUNC6240
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-35273 | Unauthenticated Takeover Flaw in Oracle PeopleSoft Enterprise PeopleTools | 9.8 | 97% | KEVRansomwarePoC | KEV |
From the original article
4 min read at bleepingcomputer.com
The ShinyHunters extortion gang is using a URL-encoding trick to bypass web application firewall rules that mitigate the Oracle PeopleSoft CVE-2026-35273 flaw, allowing the threat actors to resume widespread exploitation of a flaw on vulnerable servers. [...]
By Lawrence Abrams · bleepingcomputer.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.