[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fi8v0MNwPNSmcjbS05HpOMU3_6mFSNAg_cK2J_iDZNR0":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":23,"status":24,"created_at":25,"published_at":26,"article":27,"tags":31,"podcasts":50,"controls":51},"6cb2c233-16ad-4586-8f44-157b78955282","waf-bypass-enables-mass-exploitation-of-critical-oracle-peoplesoft-flaw","ad05dc9b-6903-4c06-9f65-e20dfc39e89e","WAF Bypass Enables Mass Exploitation of Critical Oracle PeopleSoft Flaw","Attackers linked to ShinyHunters (UNC6240) are exploiting CVE-2026-35273 in Oracle PeopleSoft by URL-encoding malicious characters to evade Web Application Firewall detection — a classic bypass technique that highlights the danger of treating WAFs as a primary defense rather than one layer in a defense-in-depth strategy. Once inside, threat actors deploy persistent web shells and backdoors like SIDEEYE, giving them long-term footholds in victim environments across education, healthcare, and technology sectors. The root cause is a failure to apply critical patches promptly on internet-facing enterprise systems, compounded by over-reliance on WAFs as a compensating control. This matters because unpatched ERP platforms like PeopleSoft often hold sensitive HR, financial, and student data, making them high-value targets with catastrophic breach potential.","**Immediate actions:**\n- Apply Oracle's patch for CVE-2026-35273 immediately, prioritizing all internet-facing PeopleSoft instances.\n- Audit web server directories for unauthorized web shells or unexpected files in the Environment Management Hub path.\n- Temporarily restrict or disable access to the vulnerable Environment Management Hub endpoint until patching is confirmed.\n\n**Detection measures:**\n- Configure WAF rules and SIEM alerts specifically for URL-encoded bypass patterns (e.g., `%2F`, `%00`, `%3B`) targeting PeopleSoft endpoints.\n- Hunt for indicators of compromise including SIDEEYE backdoor artifacts and MeshAgent binaries across all PeopleSoft hosts.\n- Enable detailed HTTP request logging on WAF and web server layers to capture encoded payloads for forensic review.\n\n**Long-term improvements:**\n- Implement an emergency patching SLA (e.g., 24–72 hours) for critical CVEs affecting internet-facing ERP systems.\n- Adopt a defense-in-depth posture by combining WAFs with network segmentation, runtime application self-protection (RASP), and privileged access controls — never treat WAFs as a sole control.\n- Conduct regular vulnerability assessments and penetration tests against ERP platforms to identify exploitable misconfigurations before attackers do.",[12,13,14,15,16,17,18,19,20,21,22],"CIS Control 7: Continuous Vulnerability Management","CIS Control 12: Network Infrastructure Management","CIS Control 13: Network Monitoring and Defense","NIST SP 800-40: Guide to Enterprise Patch Management","NIST SI-2: Flaw Remediation","NIST SC-7: Boundary Protection","NIST IR-4: Incident Handling","NIST CA-8: Penetration Testing","OWASP Top 10: A05 Security Misconfiguration","ITIL: Change and Release Management (Emergency Change Procedure)","GDPR Article 32: Security of Processing (applicable to healthcare\u002Feducation sectors handling EU data)",{},"published","2026-09-26T20:22:28.647238+00:00","2026-09-26T20:22:28.554+00:00",{"id":7,"url":28,"slug":29,"title":30},"https:\u002F\u002Fthehackernews.com\u002F2026\u002F09\u002Fattackers-bypass-wafs-to-exploit-oracle.html","attackers-bypass-wafs-to-exploit-oracle-peoplesoft-flaw-and-deploy-web-shells-124ca5","Attackers Bypass WAFs to Exploit Oracle PeopleSoft Flaw and Deploy Web Shells",[32,38,44],{"id":33,"name":34,"slug":35,"description":36,"color":37},"05757c8d-6b93-4194-b35d-7359e7d33b0e","Vulnerability Management","vulnerability-management","Missing scans, no risk prioritization","#fb923c",{"id":39,"name":40,"slug":41,"description":42,"color":43},"859cf0ad-a7e9-42bb-a75d-bac6511fa5d5","Configuration Management","configuration-management","Misconfigs, default credentials, exposed services","#eab308",{"id":45,"name":46,"slug":47,"description":48,"color":49},"af7fce9e-1ce8-4156-93bc-09dcfbfdf29d","Patch Management","patch-management","Unpatched vulnerabilities, delayed updates","#ef4444",[],[52,55,59],{"slug":47,"name":53,"problem":54},"Automated patch management","Known holes get closed in days, not months.",{"slug":56,"name":57,"problem":58},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",{"slug":60,"name":61,"problem":62},"waf-ddos","Web application firewall and DDoS protection","Websites and APIs stay up, and common web attacks are filtered before they reach them."]