ShinyHunters Bypass Web Filters to Mass Exploit Oracle PeopleSoft Servers Worldwide
A renewed wave of mass exploitation is underway against internet-facing Oracle PeopleSoft deployments, driven by the threat cluster tracked as UNC6240 and publicly known as ShinyHunters. The flaw at the centre of the campaign is CVE-2026-35273, a vulnerability in the PeopleSoft Environment Management Hub component reachable through the PSEMHUB web endpoint. The same group weaponised this issue as a zero-day in June 2026, at that time hitting academic institutions almost exclusively. The current activity is significantly broader: web shells have been planted on dozens of systems around the world, spanning higher education, technology firms, IT service providers, healthcare, agriculture, transportation and government bodies. Any organisation running PeopleSoft with the Environment Management Hub exposed to untrusted networks should consider itself within the target population.
What makes this wave notable is not a new vulnerability but a new way of reaching an old one. After the June disclosure, many operators front-ended their PeopleSoft Internet Architecture tier with web application firewall or reverse proxy rules that simply blocked any request path containing /PSEMHUB/. The attacker defeated that control with a single character change, URL-encoding the leading letter so the request arrives as /%50SEMHUB/ instead. Because a large number of WAF and proxy rules match the literal path string before URL decoding takes place, the request slips through inspection, while the PeopleSoft application server decodes it normally and routes it to the same vulnerable servlet. The practical effect is that systems whose owners believed they had mitigated the exposure with path blocking were still reachable and still exploitable. Following exploitation, the actor has been observed writing JSP web shells into the PSEMHUB web application directory, using filenames such as x.jsp, u.jsp, tunnel.jsp and tunnel.jspx, alongside a binary named Ple64.exe, and in some environments deploying MeshCentral remote management agents to retain access outside the web tier.
The strategic concern is the position PeopleSoft occupies in the organisations that run it. It typically holds human resources, student, payroll and financial records, and the application service account can usually read database connection strings in psappsrv.cfg, Integration Broker credentials and, in hybrid deployments, cloud credentials reachable from the web tier. A web shell on that host therefore offers far more than a foothold on a single server; it offers a route into the identity and data layers that sit behind it, which is consistent with this actor's established pattern of bulk data theft followed by extortion. Exploitation is not theoretical or modelled. CVE-2026-35273 is listed in the CISA Known Exploited Vulnerabilities catalogue with a listing date of 12 June 2026, is associated with known use in ransomware campaigns, and carries a FIRST EPSS estimate of a 9.4 percent probability of exploitation activity in the next 30 days, a figure well above the norm for the wider CVE population. The WAF bypass adds a second dimension of risk, because it converts a control many teams recorded as closed back into an open path, and detection gaps follow wherever monitoring was tuned to the literal endpoint string rather than its encoded variants. Oracle has published a security alert and patch for the vulnerability, along with guidance on disabling or removing the Environment Management Hub, so the exposure that remains is one of deployment coverage rather than absent vendor fixes.
Attack Surface
Web Application, Server OS, Remote Access Service
Tactics
Initial Access, Execution, Persistence, Defense Evasion, Credential Access, Command and Control
Techniques
- T1190 – Exploit Public-Facing Application
- T1505.003 – Server Software Component: Web Shell
- T1027 – Obfuscated Files or Information
- T1219 – Remote Access Tools
- T1552.001 – Unsecured Credentials: Credentials In Files
SuperPRO's Threat Countermeasures Procedures
- Apply the Oracle Security Alert patch for CVE-2026-35273 to all PeopleSoft Internet Architecture deployments. Path-based WAF or reverse proxy blocking of /PSEMHUB/ is not a substitute and has already been bypassed in the wild.
- Disable the Environment Management Hub (EMHub) service in multi-server PeopleSoft configurations, or remove the PSEMHUB application entirely in single-server configurations, following Oracle's guidance in the CVE-2026-35273 security alert.
- If a WAF rule must remain in place as a stopgap, configure it to normalise and URL-decode the request path before matching, and block percent-encoded variants such as /%50SEMHUB/, /%50SEMHU%42/ and mixed-case forms in addition to the literal /PSEMHUB/ string.
- Search PIA WebLogic access logs for requests to /PSEMHUB/ and any percent-encoded variant, giving priority to POST requests to /hub and any request for a .jsp file from an external source IP address.
- Inspect <PS_CFG_HOME>/webserv/<domain>/applications/peoplesoft/PSEMHUB.war/ for files not shipped with the product, specifically x.jsp, u.jsp, tunnel.jsp, tunnel.jspx and Ple64.exe, and preserve any findings for forensic review before deletion.
- Rotate every credential readable by the PeopleSoft application service account, including database connection strings held in psappsrv.cfg, Integration Broker credentials, and any cloud credentials reachable from the web tier.
- Monitor outbound connections from PeopleSoft hosts against the network indicators published in the Mandiant and GTIG report, and audit endpoints for unauthorised MeshCentral remote management agents installed as a post-exploitation persistence channel.
