{"uuid": "120716da-163b-46cf-abfe-41cb4ee7f8ae", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-35273", "type": "seen", "source": "https://infosec.exchange/users/DarkWebInformer/statuses/117334335727901890", "content": "\ud83d\udea8 ShinyHunters resumes mass exploitation of critical Oracle PeopleSoft flaw using simple WAF bypass.\nMandiant and Google Threat Intelligence Group have identified renewed mass exploitation of CVE-2026-35273 by UNC6240, also known as ShinyHunters.\u2800The critical vulnerability allows unauthenticated remote code execution in Oracle PeopleSoft PeopleTools and carries a CVSS score of 9.8.\nOracle released an emergency patch on June 10.\u2800The new campaign targets organizations that attempted to mitigate the flaw using web application firewall rules but did not install the patch.\nShinyHunters bypassed rules blocking the vulnerable /PSEMHUB/ endpoint by encoding a single character and sending requests to /%50SEMHUB/.\u2800Google says web shells were deployed on dozens of systems worldwide across:\n\u2022 Higher education\u2022 Technology\u2022 IT services\u2022 Healthcare\u2022 Agriculture\u2022 Transportation\u2022 Government\u2800The actors deployed web shells, the SIDEEYE backdoor, Neo-reGeorg tunneling tools and MeshAgent for persistent remote access.\nAround one-quarter of the observed commands executed with root or SYSTEM privileges.\u2800Organizations running PeopleSoft should patch immediately, disable or remove the Environment Management Hub where possible and investigate encoded variants of /PSEMHUB/ in access logs.\nWAF rules alone are not sufficient.", "creation_timestamp": "2026-09-25T23:44:39.634908Z"}