ShinyHunters Exploit Oracle PeopleSoft Flaw by Bypassing WAF Defenses
Written by AI from the linked story. Not reviewed by an editor. How this works
The ShinyHunters threat actor (UNC6240) is actively exploiting CVE-2026-35273 in Oracle PeopleSoft, leveraging URL encoding techniques to evade WAF rules and gain unauthorized access. Once inside, attackers deploy web shells and the SIDEEYE backdoor, establishing persistent footholds across higher education, government, and technology sectors. This incident highlights a critical over-reliance on WAF solutions as a sole defensive layer — WAFs can be circumvented through encoding tricks, making unpatched vulnerabilities just as exposed as if no WAF existed. It also underscores the urgent need for timely patching of internet-facing enterprise applications, which represent high-value targets for sophisticated threat actors.
Tactical Insight
Immediate Actions
- Apply Oracle's official patch or mitigation for CVE-2026-35273 on all PeopleSoft instances immediately.
- Audit WAF rule sets to include URL-decoded and double-encoded input inspection to prevent bypass techniques.
- Scan all internet-facing PeopleSoft deployments for signs of web shell installation or SIDEEYE backdoor indicators of compromise (IoCs).
Long-Term Improvements
- Implement a formal emergency patching process with defined SLAs (e.g., <24 hours) for critical CVEs on internet-facing systems.
- Adopt a defense-in-depth strategy so that WAF, network segmentation, and endpoint detection each provide independent layers of protection.
- Maintain a continuously updated inventory of all externally exposed enterprise applications, including version and patch status.
Detection Measures
- Deploy endpoint detection and response (EDR) tooling on PeopleSoft servers to detect web shell execution and anomalous process behavior.
- Enable centralized logging of all web application requests, including decoded URL parameters, and alert on known web shell patterns.
- Conduct regular threat hunting exercises targeting persistence mechanisms such as backdoors and scheduled tasks on critical application servers.