Renewed Exploitation Campaign

The notorious extortion group known as ShinyHunters has ramped up its malicious activities by identifying a method to bypass security mitigations previously put in place for a critical Oracle zero-day. By circumventing these protections, the group is not only reusing an older exploit but has also broadened its target base to include a significantly wider range of global organizations.


Technical Background: CVE-2026-35273

In June 2026, researchers identified a dangerous Java deserialization vulnerability within the Oracle PeopleSoft Environment Management Hub (PSEMHUB) servlet. This flaw allows attackers to deploy web shells or execute fileless commands on compromised servers. Oracle PeopleSoft is widely utilized by major corporations, government bodies, and educational institutions for managing core business functions, including HR, finance, and supply chain operations.


The vulnerability, tracked as CVE-2026-35273, carries a critical severity score of 9.8/10. While Oracle released an official patch on June 10, 2026, many organizations initially relied on temporary mitigation measures due to patch deployment challenges.


The WAF Bypass Technique

According to research from Mandiant and Google’s Threat Intelligence Group (GTIG), the threat actor, identified as UNC6240, has modified its exploit to sidestep Web Application Firewall (WAF) rules that were meant to protect the PSEMHUB endpoint.


«The threat actor bypassed these string-based WAF rules by URL-encoding a single character in the request path, requesting /%50SEMHUB/ in place of /PSEMHUB/. Many WAF and reverse proxy rules match the literal path before URL decoding, while the PeopleSoft application server decodes the request and routes it to the vulnerable servlet,» the report explained.

Widespread Global Impact

While the initial campaign primarily targeted higher education, the current wave of attacks is far more expansive. The hackers are now deploying web shells across dozens of global systems, affecting industries such as:

  • Technology and IT services
  • Healthcare
  • Agriculture
  • Transportation
  • Government sectors

Recommendations for Mitigation

Security experts emphasize that the official patch provided by Oracle remains effective against this threat. The current bypass only impacts systems relying solely on WAF-based mitigations rather than the software update. Organizations are advised to take the following steps to secure their environments:

  • Apply the Patch: Prioritize installing the official Oracle security update immediately.
  • Disable Services: Disable the Environment Management Hub (EMHub) in multi-server setups or remove the PSEMHUB application entirely if using a single-server configuration.
  • Forensic Inspection: Audit PIA WebLogic access logs for requests involving /PSEMHUB or percent-encoded variations. Inspect /webserv/applications/peoplesoft/PSEMHUB.war/ for any unauthorized files.
  • Credential Hygiene: Rotate all credentials accessible by the PeopleSoft application service account and monitor for suspicious outbound network traffic.