ShinyHunters Bypasses WAF Rules to Revive Oracle PeopleSoft Attacks

ShinyHunters Finds a One-Character Detour Around PeopleSoft's WAF Shield

Google's Threat Intelligence Group (GTIG) and Mandiant disclosed on September 25, 2026 that the extortion-focused threat cluster UNC6240 — linked to the ShinyHunters collective — has resumed mass exploitation of CVE-2026-35273, a CVSS 9.8 unauthenticated remote code execution flaw in Oracle PeopleSoft's Environment Management Hub (PSEMHUB) servlet. The twist: attackers didn't need a new vulnerability. They needed one encoded character.

Instead of requesting the blocked path /PSEMHUB/hub, the group now sends /%50SEMHUB/hub — replacing the literal letter "P" with its URL-encoded equivalent, %50. Many web application firewalls and reverse proxies evaluate the request path before decoding it, so the encoded string slides past string-match block rules while Oracle's WebLogic application server decodes it normally and routes the request straight to the vulnerable servlet. According to Mandiant, the renewed campaign has deployed web shells on dozens of systems worldwide, and — notably — is disproportionately hitting organizations that deployed WAF rules as a stopgap but never actually patched.

Incident Details

How It Worked

The Original Flaw, and Why WAF Rules Weren't Enough

When CVE-2026-35273 first surfaced in June, Mandiant's guidance for organizations that couldn't immediately patch or disable the Environment Management Hub was to block external access to /PSEMHUB/* at the perimeter — while explicitly cautioning that string-based WAF body-inspection rules alone were not a substitute for patching. That caveat turned out to be prescient. Four months later, UNC6240 adapted its exploit specifically to defeat those perimeter rules, targeting the population of organizations that took the WAF shortcut instead of the patch.

The Encoding Trick

The bypass itself is deceptively simple. A WAF rule written to block requests containing the literal string /PSEMHUB/ never triggers on /%50SEMHUB/, because the rule engine is matching on the raw, undecoded request path. Oracle WebLogic, however, percent-decodes the path before routing it internally — so %50 resolves back to P, and the request lands on the exact same vulnerable servlet the WAF rule was written to stop. It requires no new exploit primitive, no additional vulnerability, and no elevated sophistication — just a single-character transformation that exposes a gap between how the firewall and the application interpret the same bytes.

From Fingerprinting to Web Shell

Once past the WAF, UNC6240's attack chain follows a consistent pattern:

1. Fingerprinting — 5 to 15 POST requests to the encoded endpoint (e.g., /%50SEMHUB/hub) carrying serialized Java objects, used to confirm the target is exploitable before committing to a full attack
2. Deserialization exploitation — a crafted serialized payload triggers remote code execution via the same insecure deserialization path patched (but now reachable again) in June
3. Web shell deployment — JSP web shells dropped into the PeopleSoft application directory, most commonly named x.jsp (command execution) and u.jsp / u2.jsp (file upload)
4. Extended tooling — a trojanized Ple64.exe installer (masquerading as a Light Alloy media player installer) delivers SIDEEYE, a C++ backdoor; the group also deploys Neo-reGeorg for SOCKS5 tunneling and abuses the legitimate MeshAgent remote-management tool for persistence and lateral movement

Impact Assessment

Recommendations

For PeopleSoft Administrators

• Patch immediately if you haven't — Mandiant is explicit that installing Oracle's June security update is the only durable fix; WAF rules alone do not close the vulnerability
• Disable or remove the Environment Management Hub where the service isn't required, reducing attack surface regardless of patch status
• Inspect the PSEMHUB.war directory and broader PeopleSoft application paths for unexpected .jsp or executable files
• Rotate credentials accessible from any system suspected of compromise, and review database audit logs for anomalous activity

For Security Teams

• Hunt in WebLogic access logs for both the literal /PSEMHUB/ path and encoded variants such as /%50SEMHUB/, /%2550SEMHUB/, and other percent-encoding permutations
• Look for the known IOCs: JSP web shells named x.jsp, u.jsp, u2.jsp; a trojanized Ple64.exe; SIDEEYE backdoor behavior; Neo-reGeorg tunnel traffic; unexpected MeshAgent installations
• Monitor outbound connections to 162.219.30[.]165 and flag any PeopleSoft host communicating with it
• Retain and review archive/backup files on affected hosts — Mandiant's guidance calls out hunting for staged archive files as part of the compromise-assessment process

For WAF and Perimeter Teams

• Normalize before you match — WAF rules that inspect the literal, undecoded request path will always be vulnerable to this class of bypass; rule sets need to decode (including double-encoding) before pattern matching
• Treat perimeter blocking as a bridge, not a destination — if a WAF rule was your only mitigation for CVE-2026-35273, assume it has already been probed or bypassed and prioritize the underlying patch

Key Takeaways

1. CVE-2026-35273 is back in active exploitation four months after Oracle's patch, not because of a new vulnerability, but because attackers found a gap between WAF pattern-matching and application-layer decoding.
2. The bypass costs the attacker nothing — encoding one character (P → %50) is enough to route a blocked request straight to the vulnerable servlet.
3. UNC6240/ShinyHunters is deliberately targeting the "patched the rule, not the software" population — organizations that relied on WAF blocking as their sole mitigation are now the priority target set.
4. The toolkit has matured since June — beyond JSP web shells, the group now deploys a dedicated C++ backdoor (SIDEEYE), a SOCKS5 tunneling tool (Neo-reGeorg), and abuses legitimate RMM software (MeshAgent) for persistence.
5. Sectors affected span far beyond higher education — technology, IT services, healthcare, agriculture, transportation, and government organizations are all confirmed targets in the renewed wave.
6. Patching remains the only durable fix. WAF rules blocking /PSEMHUB/ bought time in June; they do not substitute for applying Oracle's security update.

Related Reading

• Oracle Mitigates PeopleSoft Zero-Day Exploited in Data-Theft Attacks
• Google Confirms Exploitation of Oracle PeopleSoft Zero-Day by ShinyHunters

Sources

• BleepingComputer: ShinyHunters uses WAF bypass trick in Oracle PeopleSoft attacks
• The Hacker News: Attackers Bypass WAFs to Exploit Oracle PeopleSoft Flaw and Deploy Web Shells
• Google Cloud Blog: ShinyHunters Renewed Mass Exploitation Campaign Targeting Oracle PeopleSoft