Threat IntelligenceSep 26, 2026

ShinyHunters uses WAF bypass trick in Oracle PeopleSoft attacks

ShinyHunters gang bypasses WAFs to exploit Oracle PeopleSoft CVE-2026-35273.

The ShinyHunters extortion gang is actively exploiting Oracle PeopleSoft CVE-2026-35273 by using a URL-encoding trick to bypass Web Application Firewall (WAF) rules. This technique allows them to target unpatched servers that were previously protected by WAFs blocking the vulnerable PSEMHUB endpoint. The attackers deploy web shells and executables to gain further access and steal data from compromised organizations.

AI summary of the linked source. Not reviewed by an editor. How this works

Read at source

Vendor Watch

Run Oracle?

Get an email when a new story names Oracle, usually within the hour.

Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch works Privacy

The lesson from this incident

Full lesson

ShinyHunters exploited CVE-2026-35273 in Oracle PeopleSoft by using URL-encoding tricks to bypass WAF protections, reaching vulnerable endpoints that security teams believed were already shielded. This attack illustrates a critical and common misconception: WAFs are a compensating control, not a substitute for patching. Organizations that delayed applying the patch while relying solely on WAF rules created a false sense of security. Once the WAF was bypassed, attackers deployed web shells and exfiltrated data with minimal friction, demonstrating how a single unmitigated vulnerability can lead to full compromise.

What helps against this

How we list vendors

Google research Oracle affected

Vulnerability scanning and prioritisation
You know which systems are vulnerable, and which ones to fix first.
For exampleQualys VMDR Axonius Exposures Rapid7 Exposure Command (InsightVM)all options
Automated patch management
Known holes get closed in days, not months.
For exampleMicrosoft Intune Ivanti Neurons for Patch Management Action1 Patch Management all options
Web application firewall and DDoS protection
Websites and APIs stay up, and common web attacks are filtered before they reach them.
For exampleAkamai App & API Protector Imperva Cloud WAF F5 Web App and API Protection all options

Indicators of Compromise

Extracted by AI from the linked source. Not reviewed by an editor. How this works

cve — CVE-2026-35273
malware — x.jsp
malware — u.jsp
malware — u2.jsp
malware — Ple64.exe

Entities

ShinyHunters (threat_actor)UNC6240 (threat_actor)Oracle PeopleSoft (product)Oracle (vendor)WebLogic (product)Google (vendor)