Encoded Requests Let ShinyHunters-Linked Attackers Breach Oracle PeopleSoft Servers

Google has reported renewed, widespread exploitation of CVE-2026-35273, a critical Oracle PeopleSoft Enterprise PeopleTools vulnerability affecting versions 8.61 and 8.62.

The activity, attributed to UNC6240 and described as linked to ShinyHunters, has targeted organizations across higher education, healthcare, technology, government and other sectors. Attackers altered request paths to bypass some web application firewall rules, exploited the PeopleSoft Environment Management Hub, and installed JSP web shells on dozens of systems.

Oracle rates the vulnerability at CVSS 9.8. It is remotely exploitable over HTTP or HTTPS without authentication, user interaction or prior privileges, and successful exploitation can provide remote code execution.

A critical flaw in PeopleTools 8.61 and 8.62

CVE-2026-35273 affects the Updates Environment Management component of Oracle PeopleSoft Enterprise PeopleTools. Exploitation observed in the wild focuses on the Environment Management Hub and its PSEMHUB endpoint.

The Oracle Security Alert, initially released on June 10, 2026, identifies PeopleTools 8.61 and 8.62 as affected. Oracle also warns that customers running Oracle PeopleSoft Enterprise Applications may be exposed because those applications rely on PeopleTools.

The vulnerability carries the following CVSS 3.1 vector:

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

This means an attacker can reach the flaw over a network, exploitation has low complexity, and no credentials or victim action are required. A successful compromise can have a high impact on confidentiality, integrity and availability.

NVD classifies the issue as CWE-306, or missing authentication for a critical function. Its description says an unauthenticated attacker with HTTP access can compromise and potentially take over the product.

There is a discrepancy in NVD’s version data: its affected-products entry lists only PeopleTools 8.61, while the NVD description mentions both 8.61 and 8.62. Oracle’s advisory identifies both releases, making that the authoritative affected-version scope.

Oracle lists HTTP as the relevant protocol. Its risk-matrix guidance states that a listed protocol also includes its secure variant, so HTTPS deployments are affected as well.

Percent encoding defeats literal WAF rules

The current campaign demonstrates why blocking one exact URL string is not a sufficient defense.

Attackers changed POST request paths from:

/PSEMHUB/

to:

/%50SEMHUB/

The sequence %50 is the URL-encoded representation of the uppercase letter P. Some WAFs and reverse proxies inspect the literal path before decoding it and therefore fail to match rules written specifically for /PSEMHUB/.

The PeopleSoft application server subsequently decodes the request, reconstructs the expected path and sends it to the vulnerable servlet. The encoded request can therefore bypass an upstream filter while still reaching the same application component.

Observed attacks began with POST requests to /%50SEMHUB/hub. These contained a serialized Java object used to identify susceptible servers and exploit Java deserialization behavior in the PSEMHUB hub servlet.

Once code execution was achieved, the attackers wrote two JSP web shells into the PSEMHUB.war directory:

• x.jsp, which supports command execution across multiple operating systems.
• u.jsp, which provides chunked file uploads and command execution through cmd.exe.

The path manipulation does not remove the need to patch. It instead shows that defensive rules based solely on an undecoded string can be circumvented with a minor request variation.

Web shells lead to SIDEEYE and persistent access

After deploying the JSP files, the attackers used u.jsp to upload Ple64.exe. The file is described as a valid, signed but trojanized installer that loads a C++ backdoor called SIDEEYE into memory.

SIDEEYE communicated over TCP with the IP address 162.219.30[.]165. Reported functions include:

• Stealing credentials from browsers and desktop applications.
• Managing processes and files.
• Opening an interactive reverse shell.
• Providing reverse-proxy capabilities.

The operators also staged Neo-reGeorg, an open-source tunnelling toolkit, alongside Ple64.exe. On compromised Linux systems, they installed the legitimate MeshAgent remote-management tool after placing the web shell, using it to maintain access.

Privilege levels varied by victim environment. Roughly one-quarter of the observed commands ran as root or NT Authority\SYSTEM, giving the attackers operating-system-level control. Other commands executed through PeopleSoft or WebLogic service accounts.

The campaign affected organizations in higher education, technology, IT services, healthcare, agriculture, transportation and government. Mandiant notified more than 100 organizations worldwide after their IP addresses matched vulnerable endpoints; most were located in the United States.

Earlier zero-day activity against academic institutions also involved reconnaissance, MeshCentral agents, SSH-based lateral movement and attempts to connect to internal PeopleSoft systems with known username-and-password combinations. Data theft followed in those cases.

Exploitation is confirmed, not hypothetical

CISA added CVE-2026-35273 to its Known Exploited Vulnerabilities catalog on June 12, 2026. U.S. federal agencies received a remediation deadline of June 15, 2026.

NVD also records the vulnerability as having been used in ransomware campaigns. That status, combined with the deployment of web shells and backdoors, means defenders should treat exposed PeopleSoft systems as possible incident-response cases rather than assuming patching alone completes the work.

CISA requires organizations to apply vendor mitigations in accordance with BOD 26-04, “Prioritizing Security Updates Based on Risk,” and its Forensics Triage Requirements. For cloud services, organizations must follow the applicable BOD 26-04 guidance or discontinue use if mitigations are unavailable. Asset owners are also responsible for evaluating internet exposure and meeting the directive’s patching requirements.

This is not Oracle’s only recent appearance in the KEV catalog. Three other Oracle vulnerabilities entered it within the last 90 days:

• CVE-2015-5287 on August 26, 2026.
• CVE-2026-21962 on August 24, 2026.
• CVE-2026-46817 on July 15, 2026.

Those entries do not establish a technical connection to the PeopleSoft campaign, but they add operational context for teams managing Oracle estates.

What PeopleSoft administrators should do now

Oracle directs customers to the PeopleSoft patch documentation in Oracle Support document CPU187. Organizations should apply the CVE-2026-35273 update immediately and verify that every affected PeopleTools instance is covered.

Oracle provides Security Alert patches only for releases under Premier Support or Extended Support. Customers using unsupported releases may therefore need to upgrade before they can obtain the relevant protection.

Google and Mandiant recommend additional containment and investigation steps:

1. Reduce exposure to the vulnerable component. In multi-server deployments, disable the Environment Management Hub service. In single-server environments, remove the PSEMHUB application.
2. Search WebLogic access logs. Look for /PSEMHUB/, /%50SEMHUB/, /%50SEMHUB/hub and other percent-encoded variations.
3. Inspect the application directory. Examine PSEMHUB.war for x.jsp, u.jsp, unexpected JSP files and other unauthorized artifacts.
4. Check for secondary payloads. Search for Ple64.exe, Neo-reGeorg components and unauthorized MeshAgent installations.
5. Review outbound traffic. Investigate connections from PeopleSoft servers to 162.219.30[.]165 and other unexplained external destinations.
6. Rotate exposed credentials. Replace credentials accessible to the PeopleSoft application service account.
7. Hunt for data staging. Look for unusually large archives in temporary directories or locations reachable through the web server.
8. Audit sensitive database access. Review bulk queries and exports involving HR, payroll and student-record tables.

Patched systems should still be examined for earlier compromise. Removing a web shell without identifying stolen credentials, persistence tools or lateral movement could leave the attacker with another route back into the environment.

Extortion risk and a separate FBIJobs.gov incident

Google describes UNC6240 as a data-theft-and-extortion actor that threatens to publish stolen information unless victims pay. Organizations affected by the PeopleSoft campaign should therefore prepare for extortion messages and monitor for leaked data.

Separately, ShinyHunters claimed to have breached the FBIJobs.gov portal and stolen an estimated 2–3 TB of sensitive data. The group denied financially motivated extortion in that incident and said it acted in response to allegations contained in an FBI alert from May 2026.

A spokesperson said the FBIJobs.gov intrusion used a different Oracle PeopleSoft zero-day, not CVE-2026-35273. The two incidents should not be treated as exploitation of the same flaw.

Oracle credits Bobby Gould of TrendAI Zero Day Initiative, Lucas Miller of TrendAI Research, and Minh Giang of TrendAI Zero Day Initiative with reporting CVE-2026-35273.