ShinyHunters Bypasses WAFs to Exploit Critical Oracle PeopleSoft RCE

Google Threat Intelligence and Mandiant reported renewed mass exploitation of CVE-2026-35273, a critical CVSS 9.8 unauthenticated remote-code-execution flaw in Oracle PeopleSoft Environment Management Hub's PSEMHUB servlet. The UNC6240 cluster, linked to ShinyHunters, bypassed literal URL WAF and reverse-proxy rules by encoding the leading P in the affected path as /%50SEMHUB/; Oracle WebLogic decodes the path before routing it to the vulnerable Java-deserialization endpoint. Dozens of organizations worldwide, including entities in higher education, technology, IT services, healthcare, agriculture, transportation, and government, have been compromised.

Attackers deployed JSP web shells, the SIDEEYE backdoor, Neo-reGeorg tunneling tooling, and MeshAgent for persistence and remote access. Oracle released an emergency update for the vulnerability on June 10; defenders should apply it, disable PSEMHUB where operationally feasible, review web and application logs and files for compromise, and rotate potentially exposed credentials. Google warned that UNC6240's history of data theft and extortion creates a risk of follow-on extortion and public data leaks. ShinyHunters separately claimed an FBIJobs.gov breach involving another alleged PeopleSoft zero-day and 2–3 TB of data, but no evidence links that claim to CVE-2026-35273.