Attackers Bypass WAFs to Exploit Oracle People Soft Flaw and Deploy Web Shells

Summary: Google is warning of renewed mass exploitation of CVE-2026-35273, a critical Oracle PeopleSoft flaw (CVSS 9.8) allowing unauthenticated remote code execution, with the ShinyHunters-linked group UNC6240 bypassing WAF rules by URL-encoding one character to request /%50SEMHUB/ instead of /PSEMHUB/. The campaign targets higher education, technology, IT services, healthcare, agriculture, transportation, and government, deploying web shells on dozens of systems and using MeshAgent and the Neo-reGeorg tunneling toolkit for persistence, with about a quarter of commands run as root or SYSTEM.
What's compelling: A single URL-encoded character defeated string-based WAF rules protecting the PSEMHUB endpoint, and UNC6240's established pattern is data theft extortion - so affected organizations should prepare for extortion communications and monitor for public exposure of stolen data.

Read the original at The Hacker News ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2026-35273
Related: CVE-2026-35273: Oracle People Soft Enterprise People Tools Missing Authentication for Critical Function Vulnerability Known Exploited Vulnerabilities · Jun 12, 2026
⚡ Weekly Recap: Chrome 0-Day, Uni Fi Exploits, macOS Stealers, VPN Flaw and More Cyber Risks ·
Shiny Hunters Renewed Mass Exploitation Campaign Targeting Oracle People Soft Cyber Risks · Sep 25, 2026