> ## Content Index > Fetch the complete content index at: https://f4n6.co.uk/llms.txt > Use this file to discover other available public pages before exploring further. # Attackers Bypass WAFs to Exploit Oracle PeopleSoft Flaw and Deploy Web Shells - URL: https://f4n6.co.uk/security-feed/attackers-bypass-wafs-to-exploit-oracle-peoplesoft-flaw-and-deploy-web-shells/ - Published: 2026-09-27T00:05:15.000Z - Updated: 2026-09-27T00:05:15.000Z - Author: Jeff Davies - Tags: #security-feed, CVE-2026-35273, ShinyHunters ## 1\. Executive summary UNC6240 (ShinyHunters, MITRE G1057) has resumed mass exploitation of CVE-2026-35273, a critical missing-authentication flaw in Oracle PeopleSoft Enterprise PeopleTools, after modifying its exploit to defeat string-based WAF rules. The vulnerability carries a CVSS score of 9.8, is listed in CISA KEV (added 2026-06-12), and has an EPSS of 9 percent; it permits unauthenticated remote code execution and was first used as a zero-day between May 27 and June 9, 2026\. The new wave targets higher education, technology, IT services, healthcare, agriculture, transportation, and government, and the attackers have deployed web shells on dozens of systems. EMEA financial services firms running PeopleTools 8.61 or 8.62 with the Environment Management Hub exposed are directly in scope, and the WAF bypass means perimeter filtering alone will not stop the request reaching the vulnerable servlet. ## 2\. Regulatory framing | Article | Trigger (the fact in this item) | Practical impact | | ------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | DORA Art. 17 | Active exploitation of an unauthenticated RCE in a PeopleSoft component used to run HR, payroll, and billing applications, with web shells deployed on dozens of systems | The ICT-related incident management process must cover detection, containment, and eradication of web shells and RMM persistence on PeopleSoft hosts, not just the initial patch | | DORA Art. 19 | Confirmed compromise of PeopleSoft infrastructure with data theft and extortion, affecting an entity type (financial services) that runs the same product | If the incident meets the major-incident classification, reporting to the competent authority is required; the campaign's exfiltration of HR, payroll, and student records is the trigger for assessing that threshold | | NIS2 Art. 23 | Data theft and extortion following exploitation of a supply-chain-adjacent enterprise application (PeopleSoft) | Incident reporting obligations apply where the entity is in scope; the extortion and DLS publication pattern is the trigger, not the mere existence of a vulnerability | DORA Art. 18 is engaged only if the incident is classified as major; the source does not give enough to make that call for any specific client. DORA Art. 28 and 29 are not triggered by this item because the source does not describe a third-party ICT provider failure at the client. UK NIS 2018 duties apply to OES/RDSP entities running the affected PeopleSoft versions; the source does not identify UK OES/RDSP victims beyond the University of Nottingham, which is a university, not a financial services OES. ## 3\. Technical analysis & attack chain CVE-2026-35273 is a critical vulnerability in the Updates Environment Management component of PeopleSoft Enterprise PeopleTools. The verified reference data records it as CWE-306 (Missing Authentication for Critical Function) with CVSS 9.8, in CISA KEV since 2026-06-12, EPSS 9 percent. TrendAI classifies the underlying flaw as server-side request forgery (CWE-918) and its detection signatures name it an SSRF; Mandiant describes it as a critical remote code execution vulnerability, with the SSRF serving as the mechanism through which code execution is achieved. Both classifications describe the same flaw: the missing authentication on the Environment Management Hub endpoint is what allows the unauthenticated request, and the SSRF is the path to code execution. The verified reference data's CWE-306 is the authoritative classification; the CWE-918 label is noted here as a discrepancy in the source material, not a correction. Affected versions are PeopleTools 8.61 and 8.62\. Oracle published a security alert on June 10, 2026 and released an out-of-band patch the same day. The vulnerability was reported through TrendAI's Zero Day Initiative. Mandiant observed exploitation between May 27 and June 9, 2026, predating Oracle's advisory by two weeks, so it was exploited as a zero-day. Confirmed attack chain, from the source material: 1. The attacker identifies susceptible targets by sending POST requests to `/%50SEMHUB/hub` containing a serialized Java object. 2. The attacker bypasses WAF rules by URL-encoding the character P as `%50` in the request path, requesting `/%50SEMHUB/` in place of `/PSEMHUB/`. Many WAF and reverse proxy rules match the literal path before URL decoding, while the PeopleSoft application server decodes the request and routes it to the vulnerable servlet. 3. The attacker abuses Java deserialization in the PSEMHUB hub servlet to deploy web shells and achieve fileless command execution. 4. Two JSP web shells are dropped in the `PSEMHUB.war` directory to reduce WAF detections during post-exploitation. `x.jsp` enables cross-platform command execution; `u.jsp` allows chunked file uploads to the server and command execution via `cmd.exe`. 5. `u.jsp` is used to upload a valid, signed trojanized installer, `Ple64.exe`, which loads in memory SIDEEYE, a C++ backdoor that communicates with an external server at `162.219.30[.]165` over TCP. SIDEEYE provides browser and desktop application credential theft, process and file management, interactive reverse shell, and reverse proxy capabilities. 6. Alongside `Ple64.exe`, the attacker stages the open-source Neo-reGeorg tunneling toolkit. 7. On Linux systems, UNC6240 deploys the legitimate RMM tool MeshAgent to establish persistent access after web shell placement. Two endpoints are involved in exploitation: `/PSEMHUB/hub` and `/PSIGW/HttpListeningConnector`. The exploit chain may cause the target system to make outbound SMB connections on TCP port 445 to external destinations, potentially allowing attackers to capture Windows machine-account NetNTLM hashes. The `/PSIGW/HttpListeningConnector` URI path also appears in a PeopleSoft exploit chain for CVE-2013-3821 documented by Lexfo in 2017, and a related XXE vulnerability, CVE-2017-3548, targeted a different Integration Gateway connector (PeopleSoftServiceListeningConnector) under the same `/PSIGW/` path. Post-exploitation activity observed by Mandiant in the earlier wave included internal reconnaissance of PeopleSoft configurations, deployment of lateral movement scripts, and data exfiltration using zstd compression. The attacker staging environments hosted customized MeshCentral agents masquerading as legitimate cloud endpoints, used to run administrative command queries and deploy a custom lateral movement and defacement script named `[victim_abbreviation]_fanout.sh`. The script connected via SSH to other internal PeopleSoft machines using known username and password combinations. About a quarter of the threat actor's commands were executed as root or `NT Authority\SYSTEM`, granting full control of the operating system; the remaining commands ran under PeopleSoft or WebLogic service accounts. The staging infrastructure is documented in the source material. GTIG triaged five sequential IP addresses, `142.11.200.186` through `142.11.200.190`, hosting Python SimpleHTTP servers on port 8888 that exposed directory contents including staging materials, customized agents, and attacker command histories. The staging hosts carried pre-configured Windows MeshCentral agent binaries disguised as Microsoft Azure services: `meshagent32-azure-ops.exe`, `meshagent64-azure-ops.exe`, and `meshagent64-v2.exe`. Static analysis indicates these agents were hardcoded to communicate with the C2 server `wss://azurenetfiles.net:443/agent.ashx`. The domain `azurenetfiles.net` mimics legitimate Microsoft Azure NetApp Files endpoints. An unconfigured Linux meshagent binary was also staged, suggesting parameters were passed dynamically via the command line during deployment. The exposed `.bash_history` file, identical across all five staging hosts, shows the attackers installed MeshCentral version 1.1.59 on May 27, 2026 at 22:14 UTC to establish the C2 staging environment. The campaign heavily targeted the higher education sector: 68 percent of the more than 100 notified organizations were universities and colleges, most based in the United States. Data stolen during the campaign was published on the ShinyHunters Data Leak Site on June 9, 2026\. ShinyHunters claims to have compromised more than 100 organizations across 300 vulnerable instances, including the University of Nottingham, from which it claims to have stolen 40 GB of personal data and billing records belonging to hundreds of thousands of current and former students. The University of Nottingham confirmed the breach. The Register reports that ShinyHunters posted the university on its DLS before publishing the stolen files the same day, presumably because the school refused to pay the extortion demand. Confidence caveats. The WAF bypass technique, the `/%50SEMHUB/` path, the JSP web shell filenames, the `Ple64.exe` and SIDEEYE detail, the `162.219.30[.]165` C2 address, and the Neo-reGeorg staging are reported by Google/Mandiant and carried by The Hacker News; treat the specific new-wave artefacts as single-sourced until corroborated. The ShinyHunters claim of 300 vulnerable instances and 100-plus victims is the actor's own claim, reported by The Register, and is not independently verified. Oracle has not publicly confirmed whether CVE-2026-35273 was the zero-day exploited in the ShinyHunters attacks; SecurityWeek notes Oracle released a patch but did not say whether it was a zero-day. The attribution to UNC6240 (ShinyHunters) is corroborated across Mandiant, Rapid7, and The Register, and the actor has a MITRE profile (G1057). ## 4\. Mitigation & containment P1, within 24 hours: - Apply the Oracle out-of-band patch for CVE-2026-35273 on all PeopleTools 8.61 and 8.62 instances. Oracle characterized this as a high-priority risk reduction measure and released it the same day as the advisory. Do not wait for a regular patch cycle. - Disable the Environment Management Hub (EMHub) service in multi-server configurations, or remove the PSEMHUB application entirely in single-server configurations. This is the compensating control Oracle and Mandiant both name. - Block external access to `/PSEMHUB/*` and `/PSIGW/HttpListeningConnector`. Because the WAF bypass uses `/%50SEMHUB/`, block the percent-encoded variant as well; a rule matching only the literal `/PSEMHUB/` path will not catch the current exploit. - Search WebLogic access logs for requests to `/PSEMHUB/` and any percent-encoded variant, including `/%50SEMHUB/`. - Inspect the `PSEMHUB.war` directory for JSP web shells and other malicious artifacts, specifically `x.jsp` and `u.jsp`. - Isolate any host showing web shell placement, SIDEEYE, MeshAgent, or Neo-reGeorg activity, and preserve volatile data before remediation. P2, within 72 hours: - Rotate credentials readable by the PeopleSoft application service account. The attacker ran commands under PeopleSoft and WebLogic service accounts and used known username and password combinations for SSH lateral movement, so assume those credentials are compromised. - Hunt PeopleSoft and database hosts for large archive files in temporary or web-accessible directories, consistent with the zstd-compressed exfiltration observed by Mandiant. - Review database audit logs for bulk queries or exports against HR, payroll, and student records tables. - Monitor outbound traffic from PeopleSoft hosts, with particular attention to TCP port 445 SMB connections to external destinations, which may indicate NetNTLM hash capture attempts, and to the C2 domain and IPs listed in section 5. - Search for the MeshCentral agent binaries `meshagent32-azure-ops.exe`, `meshagent64-azure-ops.exe`, and `meshagent64-v2.exe`, and for any MeshAgent or MeshCentral installation on PeopleSoft and adjacent hosts. P3, within 7 days: - Review whether the PeopleSoft Environment Management Hub needs to be reachable from untrusted networks at all; if not, restrict it to management networks. - Confirm that WAF and reverse proxy rules decode the request path before matching, or add a decoding step to the rule logic, so that percent-encoded path variants are caught. - Verify that the PeopleSoft service account has only the privileges it needs; the campaign's use of service-account credentials for lateral movement indicates over-privileged accounts widen the blast radius. ## 5\. Indicators of compromise | type | value | confidence | source | | -------- | -------------------------------------------- | ---------- | --------------------------------------------------- | | ipv4 | 142.11.200\[.\]186 | high | Mandiant/GTIG | | ipv4 | 142.11.200\[.\]187 | high | Mandiant/GTIG | | ipv4 | 142.11.200\[.\]188 | high | Mandiant/GTIG | | ipv4 | 142.11.200\[.\]189 | high | Mandiant/GTIG | | ipv4 | 142.11.200\[.\]190 | high | Mandiant/GTIG | | ipv4 | 162.219.30\[.\]165 | medium | Google/Mandiant via The Hacker News, single-sourced | | domain | azurenetfiles\[.\]net | high | Mandiant/GTIG | | url | hxxps://azurenetfiles\[.\]net:443/agent.ashx | high | Mandiant/GTIG | | filename | meshagent32-azure-ops.exe | high | Mandiant/GTIG | | filename | meshagent64-azure-ops.exe | high | Mandiant/GTIG | | filename | meshagent64-v2.exe | high | Mandiant/GTIG | | filename | Ple64.exe | medium | Google/Mandiant via The Hacker News, single-sourced | | filename | x.jsp | medium | Google/Mandiant via The Hacker News, single-sourced | | filename | u.jsp | medium | Google/Mandiant via The Hacker News, single-sourced | | filename | \[victim\_abbreviation\]\_fanout.sh | high | Mandiant/GTIG | | path | /PSEMHUB/hub | high | Mandiant/GTIG | | path | /PSIGW/HttpListeningConnector | high | Mandiant/GTIG | | path | /%50SEMHUB/hub | medium | Google/Mandiant via The Hacker News, single-sourced | ```iocs ipv4 142.11.200[.]186 ipv4 142.11.200[.]187 ipv4 142.11.200[.]188 ipv4 142.11.200[.]189 ipv4 142.11.200[.]190 ipv4 162.219.30[.]165 domain azurenetfiles[.]net url hxxps://azurenetfiles[.]net:443/agent.ashx filename meshagent32-azure-ops.exe filename meshagent64-azure-ops.exe filename meshagent64-v2.exe filename Ple64.exe filename x.jsp filename u.jsp filename [victim_abbreviation]_fanout.sh path /PSEMHUB/hub path /PSIGW/HttpListeningConnector path /%50SEMHUB/hub ``` No file hashes are present in the source material. Behavioural indicators: | behaviour | where to observe | confidence | | -------------------------------------------------------------------------------------------------------------- | -------------------------------------------------- | ---------- | | POST requests to /PSEMHUB/hub or /%50SEMHUB/hub containing a serialized Java object | WebLogic access logs, WAF logs, reverse proxy logs | high | | Outbound SMB connections on TCP port 445 from PeopleSoft hosts to external destinations | Network flow logs, firewall logs | high | | MeshCentral or MeshAgent installation on PeopleSoft or adjacent hosts | Endpoint telemetry, installed software inventory | high | | SSH connections from a PeopleSoft host to other internal PeopleSoft machines using service-account credentials | SSH logs, authentication logs | high | | Large archive files in temporary or web-accessible directories on PeopleSoft or database hosts | File system monitoring, EDR file-write telemetry | high | | Bulk queries or exports against HR, payroll, and student records tables | Database audit logs | high | | Commands executing as root or NT Authority\\SYSTEM on PeopleSoft hosts | EDR process telemetry, sudo logs | high | ## 6\. Detection The source material provides distinctive artefacts: the percent-encoded path, the JSP web shell filenames, the MeshCentral agent filenames, the fanout script name, and the C2 domain. The YARA rule below targets the web shell and agent artefacts. The Sigma rule targets the WAF bypass request pattern in web server logs. ```yara rule AT_PeopleSoft_PSEMHUB_WebShell_UNC6240 { meta: author = "Adverse Trace" date = "2026-09-27" reference = "https://thehackernews.com/2026/09/attackers-bypass-wafs-to-exploit-oracle.html" description = "Detects JSP web shells and MeshCentral agent artefacts associated with UNC6240 exploitation of CVE-2026-35273 in Oracle PeopleSoft" strings: $jsp1 = "x.jsp" $jsp2 = "u.jsp" $agent1 = "meshagent32-azure-ops.exe" $agent2 = "meshagent64-azure-ops.exe" $agent3 = "meshagent64-v2.exe" $fanout = "_fanout.sh" $c2 = "azurenetfiles.net" $path1 = "/PSEMHUB/hub" $path2 = "/%50SEMHUB/hub" condition: 3 of them } ``` ```yaml title: Oracle PeopleSoft PSEMHUB WAF Bypass Request id: 8f3c1a72-4b9e-4d21-9c7a-2e5f6a1b0d34 status: experimental description: Detects POST requests to the PeopleSoft Environment Management Hub using a percent-encoded path to bypass string-based WAF rules, consistent with UNC6240 exploitation of CVE-2026-35273 author: Adverse Trace date: 2026/09/27 references: - https://thehackernews.com/2026/09/attackers-bypass-wafs-to-exploit-oracle.html - https://www.rapid7.com/blog/post/etr-active-exploitation-of-oracle-peoplesoft-zero-day-cve-2026-35273 logsource: category: webserver detection: selection_method: cs-method: 'POST' selection_path: cs-uri-stem|contains: - '/%50SEMHUB/hub' - '/%50SEMHUB/' condition: selection_method and selection_path falsepositives: - Legitimate administrative access to the Environment Management Hub using percent-encoded paths level: high ``` ## CVE assessment 1 referenced CVE — **1 actively exploited (CISA KEV)**, 1 critical (CVSS ≥ 9.0) | CVE | CVSS | Exploited | EPSS | Summary | | -------------------------------------------------------------------------------- | ------------ | ---------------- | ---- | -------------------------------------------------------------------------------------------------------------------------------- | | [CVE-2026-35273](https://nvd.nist.gov/vuln/detail/CVE-2026-35273?ref=f4n6.co.uk) | 9.8 Critical | ⚠ KEV 2026-06-12 | 9% | Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Updates Environment Management)… | ## Threat actor context **ShinyHunters** · [G1057](https://attack.mitre.org/groups/G1057?ref=f4n6.co.uk) · aka UNC6240, Bling Libra [ShinyHunters](https://attack.mitre.org/groups/G1057?ref=f4n6.co.uk) is a cyber criminal collective that has been active since at least 2019 operating under the ShinyCorp persona. [ShinyHunters](https://attack.mitre.org/groups/G1057?ref=f4n6.co.uk) has targeted multiple industries and geographic regions gathering legitimate credentials and personally identifiable information (PII) for resale or extortion of victims. … ## 7\. Sources - The Hacker News, "Attackers Bypass WAFs to Exploit Oracle PeopleSoft Flaw and Deploy Web Shells", https://thehackernews.com/2026/09/attackers-bypass-wafs-to-exploit-oracle.html, 2026-09-26 - Rapid7, "Active Exploitation of Oracle PeopleSoft Zero-Day (CVE-2026-35273)", https://www.rapid7.com/blog/post/etr-active-exploitation-of-oracle-peoplesoft-zero-day-cve-2026-35273 - Mandiant / Google Threat Intelligence Group, "ShinyHunters Targets Education Sector with Oracle PeopleSoft Exploit", https://cloud.google.com/blog/topics/threat-intelligence/shinyhunters-targets-education-sector-oracle-exploit/ - Cybersecurity Dive, "ShinyHunters linked to exploitation of critical flaw in Oracle PeopleSoft", https://www.cybersecuritydive.com/news/shinyhunters-exploitation-critical-flaw-oracle-peoplesoft/822796/ - BleepingComputer, "Oracle mitigates PeopleSoft zero-day exploited in data theft attacks", https://www.bleepingcomputer.com/news/security/oracle-mitigates-peoplesoft-zero-day-exploited-in-data-theft-attacks/ - SecurityWeek, "Oracle Addresses PeopleSoft Vulnerability Amid Reports of Zero-Day Attacks", https://www.securityweek.com/oracle-addresses-peoplesoft-vulnerability-amid-reports-of-zero-day-attacks/ - The Register, "ShinyHunters claims it hacked 100 orgs by exploiting an Oracle PeopleSoft 0-day", https://www.theregister.com/cyber-crime/2026/06/11/shinyhunters-claims-oracle-peoplesoft-0-day-hit-100-orgs/5254443, 2026-06-11 ## 8\. Adverse Trace position Adverse Trace assesses CVE-2026-35273 as a critical, actively exploited vulnerability with a verified CVSS of 9.8, CISA KEV status since 2026-06-12, and an EPSS of 9 percent; the WAF bypass using `/%50SEMHUB/` means perimeter filtering that matches the literal path will not stop the request, so clients running PeopleTools 8.61 or 8.62 must treat the patch and the EMHub disablement as the primary controls, not the WAF. The client impact for EMEA financial services is concentrated in firms running PeopleSoft for HR, payroll, or billing: the campaign's post-exploitation pattern targets exactly those records, and the use of service-account credentials for SSH lateral movement means a single compromised PeopleSoft host can reach adjacent systems. The specific new-wave artefacts (the `/%50SEMHUB/` path, `Ple64.exe`, SIDEEYE, `162.219.30[.]165`, the JSP web shell filenames) are single-sourced to Google/Mandiant via The Hacker News; verify before enforcing blocks on them, and treat the MeshCentral agent filenames and the staging IP range as higher-confidence because they are corroborated by Mandiant's own triage. We will monitor for corroborating vendor reporting on the new wave, track whether Oracle issues further guidance on the WAF bypass, and update this advisory if the C2 infrastructure or web shell filenames change. --- [Read the original source →](https://thehackernews.com/2026/09/attackers-bypass-wafs-to-exploit-oracle.html?ref=f4n6.co.uk) *Published via PulseTrace — Adverse Trace threat intelligence.*