Mandiant and the Google Threat Intelligence Group (GTIG) have identified renewed exploitation of a critical Oracle PeopleSoft vulnerability, with attackers using a simple URL trick to bypass web application firewall (WAF) rules deployed against the flaw.
The activity is linked to UNC6240, aka ShinyHunters. The group exploited CVE-2026-35273 as a zero-day between May 27 and June 9. Oracle released an emergency security update on June 10; however, the latest activity is a continuation of this earlier campaign.
URL Encoding Defeats WAF Rules
The vulnerability affects PeopleSoft’s Environment Management Hub (PSEMHUB). In the latest campaign, attackers changed /PSEMHUB/ to /%50SEMHUB/, replacing the letter “P” with its URL-encoded equivalent.
For context, many WAF and reverse-proxy rules match the path before URL decoding, so they may not recognize the altered request. WebLogic then decodes the path and routes it to the vulnerable servlet, allowing exploitation to proceed.
Mandiant found web shells on dozens of compromised systems across higher education, technology, IT services, healthcare, agriculture, transportation and government.
Hackread.com reported on the earlier campaign in June, when Mandiant and GTIG identified more than 100 organizations with potentially exposed PeopleSoft systems. 68% of the identified organizations were in higher education, with most of them based in the US.
Web Shells and SIDEEYE Backdoor
After exploitation, attackers deployed JSP web shells including x.jsp and u.jsp inside the PeopleSoft application directory. The first provides command execution, while the second can upload larger files in 150 KB chunks to avoid HTTP request-size limits.
On Windows systems, attackers also uploaded a 5.2 MB file named Ple64.exe, a trojanized Light Alloy media player installer that delivers the SIDEEYE backdoor. Mandiant found that the installer was signed with a valid certificate.
SIDEEYE can steal browser and desktop application credentials, manage files and processes, and provide reverse-shell and reverse-proxy capabilities. Attackers also used the open-source Neo-reGeorg tunneling tool and legitimate MeshAgent remote-management software to maintain access to compromised environments.
The findings come days after ShinyHunters told Hackread.com that it used an Oracle PeopleSoft zero-day to gain initial access to the FBI through its job application portal. The group said it then moved laterally into other FBI systems, including AWS GovCloud infrastructure, and claimed to have downloaded between 2TB and 3TB of data.
ShinyHunters did not identify the PeopleSoft vulnerability used against the FBI as CVE-2026-35273, and there is currently no evidence linking the FBI intrusion to the vulnerability described in Mandiant’s latest research.
Patch Instead of Relying on WAF Rules
Mandiant recommends applying Oracle’s security update rather than relying on WAF filtering. Organizations should also disable the Environment Management Hub where possible, inspect WebLogic logs for normal and encoded /PSEMHUB/ requests, check the PeopleSoft application directory for unexpected JSP or executable files, and rotate credentials accessible from compromised systems.
