ShinyHunters WAF bypass technique revives mass exploitation of critical Oracle PeopleSoft vulnerability

The notorious extortion syndicate known as ShinyHunters has launched a sophisticated resurgence of its exploitation campaign against Oracle PeopleSoft servers, successfully bypassing protective web application firewall (WAF) configurations. By utilizing a URL-encoding obfuscation technique, the threat actors—tracked by Google’s Mandiant and Threat Intelligence Group (GTIG) as UNC6240—have successfully circumvented security rules intended to mitigate the critical CVE-2026-35273 remote code execution vulnerability. This development has forced security teams across multiple industries, including government and healthcare, to re-evaluate their reliance on perimeter defenses and prioritize long-overdue patching.

The vulnerability, CVE-2026-35273, centers on the Environment Management Hub (PSEMHUB) component of Oracle PeopleSoft. When left unpatched, the flaw allows unauthenticated remote attackers to execute arbitrary code with the privileges of the underlying service. While Oracle issued a security update to address the flaw in June 2026, many organizations opted for the temporary, albeit less robust, mitigation of blocking access to the /PSEMHUB/ endpoint via WAF rules. The latest intelligence confirms that this reliance on perimeter filtering has become a point of failure, as ShinyHunters has adapted its exploit chain to bypass these literal path-matching rules.

The Mechanism of the WAF Bypass

The technical elegance of the ShinyHunters bypass lies in the discrepancy between how WAFs and backend servers interpret HTTP requests. Many WAF solutions and reverse proxies are configured to inspect incoming requests for literal strings, such as /PSEMHUB/. If an attacker submits a request for /%50SEMHUB/, the WAF often fails to identify the target because the ‘P’ has been replaced by its URL-encoded equivalent, %50.

When the request reaches the target Oracle WebLogic server, the application layer automatically decodes the URI. The server interprets /%50SEMHUB/ as the legitimate and vulnerable /PSEMHUB/ path, executing the command without the WAF ever triggering an alert. Mandiant researchers caution that this is not a static tactic; the attackers are likely to iterate on this method, potentially employing mixed-case variations or alternative encoding schemes to remain undetected by traditional signature-based detection systems.

A Chronology of Escalation

The threat posed by UNC6240 has evolved rapidly since the initial discovery of the exploit. The following timeline outlines the progression of the campaign:

• Early June 2026: Initial reports emerge of widespread exploitation targeting PeopleSoft infrastructure. Preliminary analysis suggests that over 100 organizations are affected, with data exfiltration being the primary objective.
• June 10, 2026: BleepingComputer reports the first instance of ShinyHunters using the zero-day to target PeopleSoft, prompting immediate concern across the enterprise software sector.
• June 11, 2026: Oracle releases an official patch for CVE-2026-35273. Mandiant formally links the attacks to the threat group UNC6240 and advises that if patching is not immediate, organizations must block the /PSEMHUB/ endpoint.
• September 2026: ShinyHunters publicly claims to have breached the FBI’s job application portal, citing a "new" PeopleSoft vulnerability. While the FBI confirms an investigation into unauthorized activity, the specific nature of the exploit remains a subject of intense scrutiny.
• Late 2026/Early 2027: Security researchers observe a renewed wave of attacks. ShinyHunters is now actively using the URL-encoding bypass to re-target organizations that previously believed they were protected by WAF rules.

Technical Breakdown of the Exploitation Flow

The current attack chain is highly methodical, designed to identify and exploit vulnerable hosts with minimal noise. Before launching a full-scale compromise, the attackers send a series of five to 15 POST requests to the /%50SEMHUB/hub endpoint. These requests contain serialized Java objects that probe the host operating system. This reconnaissance phase allows the attackers to confirm the server’s vulnerability without triggering traditional file-based integrity alerts or disrupting the service, effectively "testing the waters" before moving to the next stage of the attack.

Once a target is confirmed as vulnerable, the attackers move to establish persistence. They deploy JSP-based web shells—specifically x.jsp for command execution and u.jsp or u2.jsp for uploading secondary payloads. On Windows-based systems, the attackers have been observed deploying an executable, Ple64.exe, which uses a legitimate-looking digital signature to disguise itself as a media player installer. This binary installs the SIDEEYE backdoor, a sophisticated tool designed for persistent access, process manipulation, and credential harvesting.

Furthermore, the attackers have demonstrated a focus on lateral movement. By deploying the open-source Neo-reGeorg tunneling toolkit, ShinyHunters can tunnel SOCKS5 proxy traffic through standard HTTP/HTTPS channels. This turns the compromised PeopleSoft server into a bridgehead, enabling the threat actors to traverse internal networks and reach high-value targets that are otherwise shielded from the public internet.

Broader Impact and Implications

The resurgence of these attacks serves as a stark reminder of the limitations inherent in perimeter-based defense strategies. While WAFs are essential components of a layered security architecture, they are not a substitute for proper patch management. The "virtual patching" provided by a WAF is intended to be a stopgap, not a permanent solution, and this incident highlights the dangers of allowing temporary mitigations to become long-term security policies.

The impact of this campaign is widespread, spanning sectors that hold highly sensitive information. Education, government, healthcare, and IT services are among the most affected industries. The theft of data, such as that reported by the FBI regarding employee and applicant records, underscores the severe risk to personal privacy and national security when enterprise middleware is left exposed.

Moreover, the use of legitimate remote management software, such as MeshAgent on Linux systems, complicates detection. By blending in with authorized administrative tools, attackers can maintain persistence for extended periods, making the incident response process significantly more difficult.

Recommended Defensive Actions

Mandiant and other security agencies are urging organizations to move beyond simple WAF rules. The most effective defense remains the installation of Oracle’s official security updates for CVE-2026-35273. For organizations currently auditing their environments, the following steps are highly recommended:

1. Log Analysis: Security teams should conduct a deep dive into WebLogic access logs. A search for both literal /PSEMHUB/ strings and encoded variants (such as /%50SEMHUB/ or other hex-encoded patterns) is essential to identify potential signs of prior compromise.
2. Environment Hardening: Disable the Environment Management Hub if it is not strictly required for business operations. If it must remain active, ensure it is restricted to internal, authenticated access only.
3. Threat Hunting: Organizations should monitor for the presence of the identified JSP shells (x.jsp, u.jsp, tunnel.jsp) and investigate any unauthorized usage of remote management tools like MeshAgent.
4. Endpoint Protection: Deploy robust EDR (Endpoint Detection and Response) solutions that can identify the execution of suspicious binaries like Ple64.exe and detect the behavioral patterns associated with the SIDEEYE backdoor.

As ShinyHunters continues to refine its techniques, the cybersecurity community must prioritize proactive vulnerability management. The transition from a static zero-day exploit to a dynamic WAF-bypass campaign illustrates the agility of modern threat actors. Organizations that rely on legacy mitigation strategies are effectively leaving the door open to attackers who are increasingly adept at turning the tools meant for defense into instruments for exploitation. In the current threat landscape, technical diligence and the timely application of vendor-supplied patches are the only reliable defenses against such sophisticated incursions.