# Oracle PeopleSoft Vulnerability Exploited in Global Cyberattack Campaign Attackers bypass WAF protections to deploy web shells across multiple sectors. - **Source:** [The Hacker News](https://brifing.si/source/f944ec2b-8180-47bc-94de-57085b5a6563) - **Published:** 2026-09-26 - **Topic:** [Software & Engineering](https://brifing.si/c/engineering) - **Original article:** - **On Brifing:** https://brifing.si/s/273395bb-c3da-4621-92d6-7292714f40ef ## Critical PeopleSoft vulnerability exploited Attackers are actively exploiting CVE-2026-35273, a critical Oracle PeopleSoft vulnerability with CVSS score 9.8, allowing unauthenticated remote code execution. The flaw affects the Environment Management Hub (PSEMHUB) endpoint. Mandiant has identified over 100 vulnerable organizations, primarily in the U.S., across education, healthcare, and government sectors. The vulnerability was previously used in academic institution attacks for reconnaissance and data theft. ## Novel WAF bypass technique UNC6240 modified their exploit to bypass web application firewall rules by URL-encoding a single character (/PSEMHUB/ becomes /%50SEMHUB/). This works because WAFs often match literal paths before URL decoding, while PeopleSoft servers decode requests normally. The technique demonstrates how slight modifications can circumvent security controls designed to block known attack patterns. ## Attack chain details The attackers deploy Ple64.exe and the Neo-reGeorg tunneling toolkit after initial access. On Linux systems, they establish persistence using the legitimate MeshAgent RMM tool. About 25% of executed commands run with root/SYSTEM privileges, granting full system control. Other commands operate under PeopleSoft or WebLogic service accounts, showing careful privilege escalation tactics. ## Multi-sector targeting Current victims span higher education, technology, IT services, healthcare, agriculture, transportation, and government sectors. The attackers have deployed web shells on dozens of systems. This broad targeting suggests the campaign aims for maximum data access rather than specific high-value targets, typical of data theft extortion operations. ## Extortion pattern established UNC6240 follows a consistent data theft extortion model: steal data then threaten public release unless paid. Google warns affected organizations to prepare for extortion communications and monitor for potential data leaks. The group's tactics mirror recent FBI portal breaches, though they claim those attacks weren't financially motivated. ## FBI portal breach connection ShinyHunters breached FBIJobs.gov using a different PeopleSoft zero-day, stealing 2-3TB of sensitive data. They claim this wasn't extortion but retaliation for FBI allegations. The group, formerly GnosticPlayers, rebranded in 2020. This parallel attack highlights multiple critical PeopleSoft vulnerabilities being actively exploited by sophisticated threat actors. ## Enterprise security implications The attacks demonstrate how legacy enterprise systems like PeopleSoft remain vulnerable despite security controls. The WAF bypass shows security teams must implement multi-layered defenses. As AI agents gain system access, visibility gaps become critical. Organizations must assume breach and focus on detection/response capabilities. ## Recommended mitigation steps Organizations should immediately patch PeopleSoft systems, implement behavioral WAF rules that inspect decoded URLs, monitor for unusual PSEMHUB endpoint activity, and audit service account privileges. They should also prepare incident response plans for potential extortion scenarios, including legal and PR considerations for data breach notifications. ## Sources covering this story - https://thehackernews.com/2026/09/attackers-bypass-wafs-to-exploit-oracle.html — --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._