ShinyHunters(UNC6240) has resumed mass exploitation of CVE-2026-35273, a critical unauthenticated remote code execution vulnerability in Oracle PeopleSoft. The new campaign bypasses WAF rules and targets organizations that did not patch.
CVE-2026-35273 is a critical vulnerability in PeopleSoft Enterprise People Tools. Unauthenticated attackers can exploit it remotely to achieve remote code execution. The same group first exploited it as a zero-day between May 27 and June 9, 2026, mainly against universities and colleges. Those attacks led to data theft, persistence, and extortion. Oracle released an out-of-band patch on June 10.
In September 2026, the group returned. Attackers modified the exploit to bypass WAF rules that block the vulnerable endpoint. The new wave targets organizations that relied on those rules and did not patch. Victims now span technology, healthcare, government, and other sectors. Read on to understand how the exploit and WAF bypass work, and how AppTrana protects against both.
What is CVE-2026-35273?
CVE-2026-35273 is a critical vulnerability affecting Oracle PeopleSoft Enterprise PeopleTools versions 8.61.x and 8.62.x. Oracle assigned it a CVSS score of 9.8. Attackers can exploit it remotely without authentication or user interaction.
The vulnerability has been classified as a Server-Side Request Forgery (SSRF) vulnerability in the Environment Management component. Mandiant’s latest analysis shows attackers achieving code execution through Java deserialization in the PSEMHUB hub servlet. A separate pre-authentication vulnerability, CVE-2026-35278, was also disclosed in PeopleSoft People Tools. Successful exploitation leads to Remote Code Execution (RCE) and full control of the underlying server.
Oracle released an out-of-band Security Alert on June 10, 2026. The July 2026 Critical Patch Update delivers the permanent fix for both CVE-2026-35273 and CVE-2026-35278. Any PeopleTools instance still unpatched should be treated as potentially compromised.
The campaign shows how attackers adapt to published defensive guidance. Organizations that deployed WAF rules in place of patches became the next target within months.
September 2026 Update: WAF Bypass Enables Renewed Exploitation
In June, Mandiant advised organizations that could not patch immediately to block external access to /PSEMHUB/* at the perimeter. Many teams did this with path-based WAF or reverse proxy rules. UNC6240 then modified its exploit to evade these rules and target the servers that were still unpatched.
The attackers now request /%50SEMHUB/hub in place of /PSEMHUB/hub. %50 is the URL-encoded form of the letter P. A rule that matches the raw request path finds no match and passes the request. WebLogic decodes the path and routes the request to the vulnerable servlet.
This is a URL normalization mismatch. The security control and the application read the same request differently. Any rule that inspects the path before decoding is exposed. Attackers can also use mixed-case or other non-normalized forms of the path.
The campaign targets organizations that deployed WAF rules and did not patch. Web shells have been confirmed on dozens of systems across higher education, technology, IT services, healthcare, agriculture, transportation, and government.
How CVE-2026-35273 Works: SSRF to RCE Attack Chain
Security researchers have described CVE-2026-35273 as an SSRF-to-RCE vulnerability chain.
Server-Side Request Forgery vulnerabilities occur when attackers can manipulate a server into making requests on their behalf. In many cases, SSRF vulnerabilities are used to access internal services, cloud metadata endpoints, or otherwise inaccessible resources.
In the case of CVE-2026-35273, the SSRF capability appears to act as the initial stage of a broader exploitation chain that ultimately enables remote code execution.
Researchers identified two PeopleSoft endpoints that play a central role in exploitation:
/PSEMHUB/hub/PSIGW/HttpListeningConnector
These components are associated with PeopleSoft’s Environment Management infrastructure and Integration Gateway functionality. Attackers leveraged these exposed interfaces to execute the attack chain and gain unauthorized access to targeted environments.
The involvement of these management components is significant because administrative and integration services often operate with elevated privileges and broad access across enterprise environments.
In the September campaign, attackers reached the same servlet through an encoded path, /%50SEMHUB/hub. Security teams should treat any encoded, mixed-case, and other non–normalized varients of the /PSEMHUB/hub path as equivalent.
How the September Campaign Unfolds
Mandiant observed a consistent sequence across targeted PeopleSoft environments.
Attackers send 5 to 15 POST requests to /%50SEMHUB/hub containing a serialized Java object. Unpatched servers respond with the host operating system. No files are written and the service is not disrupted. This lets attackers quietly confirm a server is exploitable. Some organizations may see these requests in logs with no follow-on activity.
Attackers use two methods. Both abuse Java deserialization in the hub servlet.
- Web shell deployment. Attackers send a burst of POST requests, then create new JSP files in the
PSEMHUB.wardirectory. The repetition likely places a web shell on every node behind a load balancer.
- Fileless command execution. Command output returns directly in the HTTP response. No file is written to disk. On the host, the WebLogic Java process spawns
cmd.exeor/bin/sh.
Attackers deploy two single-line JSP web shells built to evade detection:
- x.jsp runs commands on Windows and Linux. It accepts hex-encoded commands over POST and hides the Linux shell path from static signatures.
- u.jsp (and a variant, u2.jsp) uploads files in 150 KB Base64 chunks. This bypasses request-size limits. It can also run commands once the upload is complete.
On Windows servers, attackers upload and run Ple64.exe. The file poses as a signed installer for the Light Alloy media player. It carries a valid Extended Validation certificate. The installer runs a three-stage chain that loads the SIDEEYE backdoor in memory.
SIDEEYE communicates with its command-and-control server over raw TCP on ports 3333 and 3334. It supports browser and application credential theft, process and file management, and interactive reverse shell and reverse proxy access.
SMB-Based Credential Exposure Risks
Researchers observed that exploitation attempts may trigger outbound SMB connections from vulnerable servers. When a vulnerable server initiates outbound SMB connections, attackers may capture Windows machine-account NetNTLM hashes.
Captured authentication material can be used in relay attacks, credential abuse, or lateral movement.
Organizations that permit unrestricted outbound SMB traffic from application servers face increased risk. They should review network controls as part of their mitigation strategy.
Post-Exploitation Activity Following Initial Access
Persistence via Remote Management Agents
Attackers deployed Mesh Agent, a remote management agent associated with the Mesh Central platform, to maintain access to affected systems. Some were disguised as Microsoft Azure-related services to avoid detection. In the September campaign, they also used JSP web shells, the SIDEEYE backdoor, and Neo-ReGeorg for tunneling.
Internal Reconnaissance and Lateral Movement
Attackers searched for additional systems and accounts within the environment. Evidence of lateral movement shows attempts to extend access beyond the compromised PeopleSoft server.
Data Exfiltration
Attackers compressed stolen data before transferring it out of victim environments. This indicates a structured effort to collect and remove information after gaining access.
How to Detect CVE-2026-35273 Exploitation
Detection requires reviewing network, host, and application logs for signs of unauthorized activity.
Review WebLogic access logs for POST requests to /PSEMHUB/hub, /PSIGW/HttpListeningConnector, and any percent-encoded or mixed-case variant such as /%50SEMHUB/hub. Treat a burst of 5 to 15 POST requests to the hub servlet as a likely exploitability check. Requests containing localhost, loopback, or internal IP references may indicate SSRF abuse.
On affected systems, look for unexpected files in the PSEMHUB.war directory, including x.jsp, u.jsp, u2.jsp, tunnel.jsp, tunnel.jspx, and Ple64.exe. Watch for the WebLogic Java process spawning cmd.exe or /bin/sh. This catches fileless execution, which leaves no JSP file behind. Check every WebLogic node behind a load balancer.
Review outbound traffic from PeopleSoft servers. Look for SMB connections to external systems and connections to TCP ports 3333 and 3334. Mandiant identified 162[.]219[.]30[.]165 as a SIDEEYE command-and-control server. Look for unexpected MeshCentral or MeshAgent processes.
Review historical logs across both attack windows: May 27 to June 9 and September 2026 onward. Organizations that relied on WAF rules without patching should assume exposure and investigate.
How to Mitigate CVE-2026-35273
Organizations running PeopleTools 8.61 or 8.62 should patch immediately. Confirmed exploitation across two campaigns makes any delay high risk.
Apply Oracle’s Security Update
Apply Oracle’s June 10 Security Alert patch and the July 2026 Critical Patch Update. WAF rules and path-based blocking are not a substitute for patching.
Review and Disable EMHub Where Not Required
Review whether the Environment Management Hub (EMHub) service is required. Oracle recommends disabling the service in multi-server deployments. In single-server environments, remove the PSEMHUB application where it is not needed.
Restrict Access to Vulnerable Endpoints
Block external access to /PSEMHUB/* and /PSIGW/HttpListeningConnector as a temporary control. Rules must match the decoded, normalized path. Rules that match the literal string can be bypassed with encoding. Monitor outbound SMB traffic and connections to TCP ports 3333 and 3334 from PeopleSoft servers.
Conduct a Post-Patch Compromise Assessment
Exploitation occurred before and after Oracle’s patch. Conduct a compromise assessment after remediation. Review web application directories, recently modified files, unexpected JSP files, unauthorized directories, and outbound network connections. Inspect all WebLogic nodes, since attackers repeated requests to plant web shells on every node behind a load balancer.
Rotate Exposed Credentials
Rotate credentials readable by the PeopleSoft service account. This includes database connection strings in psappsrv.cfg, Integration Broker credentials, and cloud credentials reachable from the web tier.
How AppTrana Reduces Exposure to CVE-2026-35273
AppTrana helps protect against exploitation attempts associated with CVE-2026-35273 by detecting and blocking malicious requests targeting vulnerable PeopleSoft endpoints, including SSRF and remote code execution attack patterns.
It also decodes and normalizes request paths before rule evaluation. Requests to /%50SEMHUB/hub and other encoded forms of the PSEMHUB path are evaluated as /PSEMHUB/hub and blocked.
AppTrana reduces exposure while teams apply Oracle’s patches. Autonomous protection, with expert-backed operations built in, blocks exploit attempts at the edge while you patch and complete your compromise assessment.
The screenshots below show AppTrana successfully detecting and blocking CVE-2026-35273 exploitation attempts, returning an HTTP 406 (Not Acceptable) response:
AppTrana blocking encoded /%50SEMHUB/hub bypass attempt, CVE-2026-35273
