ShinyHunters Exploits Unpatched Oracle PeopleSoft to Breach 100+ Organizations
Written by AI from the linked story. Not reviewed by an editor. How this works
The ShinyHunters group (UNC6240) successfully exploited CVE-2026-35273 in Oracle PeopleSoft by using URL encoding to bypass web application firewall rules, demonstrating that WAFs alone are not a reliable substitute for timely patching. Once inside, attackers established deep persistence through web shells, custom backdoors, and tunneling tools, making remediation significantly more complex and costly. This campaign highlights the critical danger of leaving internet-facing enterprise applications unpatched, particularly when threat actors are actively researching WAF bypass techniques to circumvent compensating controls. Over 100 organizations across multiple sectors were affected, underscoring that widely deployed enterprise software like PeopleSoft represents a high-value, high-impact target for financially motivated threat groups.
Tactical Insight
Immediate actions
- Apply Oracle's official patch for CVE-2026-35273 to all PeopleSoft instances immediately, prioritizing internet-facing deployments.
- Audit all PeopleSoft Environment Management Hub endpoints and restrict external access to only trusted, necessary IP ranges.
- Scan web servers and application tiers for indicators of compromise including web shells, SideEye, Neo-reGeorg, and MeshCentral artifacts.
Long-term improvements
- Establish a formal emergency patching SLA (e.g., 24–72 hours) for critical vulnerabilities affecting internet-exposed enterprise applications.
- Maintain a continuously updated inventory of all internet-facing assets and their associated software versions to accelerate vulnerability impact assessments.
- Implement network segmentation to isolate PeopleSoft application and database tiers from the broader corporate network, limiting lateral movement opportunities.
Detection measures
- Configure WAF and SIEM rules to detect URL-encoded bypass patterns (e.g., '%50' substitutions) targeting known vulnerable endpoints.
- Deploy behavioral monitoring on application servers to alert on anomalous processes, outbound tunneling connections, and unexpected administrative tool execution.
- Enable centralized logging of all PeopleSoft application activity and correlate logs against threat intelligence feeds for known ShinyHunters TTPs.