ShinyHunters Bypasses WAFs to Exploit Oracle PeopleSoft RCE (CVE‑2026‑35273)
What It Is – The UNC‑6240 “ShinyHunters” extortion gang is using a percent‑encoding trick (e.g., /%50SEMHUB/) to evade web‑application‑firewall (WAF) signatures that block the vulnerable PeopleSoft /PSEMHUB/ endpoint. The technique lets the attackers reach the unpatched Oracle PeopleSoft flaw and achieve unauthenticated remote code execution.
Exploitability – The CVE was publicly disclosed and patched in June 2026, but many organizations remain unpatched. The WAF‑bypass method works against devices that compare the raw URL before decoding, so active exploitation is observed in the wild. No public proof‑of‑concept is required beyond the encoded request.
Affected Products – Oracle PeopleSoft (any version vulnerable to CVE‑2026‑35273) and any front‑end WAF or reverse‑proxy that does not normalize URL‑encoding before rule evaluation.
Why It Matters for Trust & Control Assurance
- Demonstrates that a single control (WAF rule) can give a false sense of security if not continuously validated against evolving attacker techniques.
- Highlights the need for evidence‑driven patch management and configuration‑as‑code practices that can be audited across frameworks (NIST CSF, ISO 27001, etc.).
- Shows that robust log‑based detection of encoded request patterns is a critical control objective for defending against web‑layer exploits.
Recommended Actions
- Deploy Oracle’s security update for CVE‑2026‑35273 on all PeopleSoft instances without delay.
- Review and harden WAF/Reverse‑proxy rules to decode URLs before pattern matching; test with common encodings (
%50, mixed‑case, etc.). - Search WebLogic and proxy access logs for
/PSEMHUB/and encoded variants (/%50SEMHUB/,%50seMHUB, etc.) to identify any prior exploitation attempts. - Integrate WAF rule validation and patch‑status checks into a continuous control‑monitoring program to produce defensible audit evidence.
Source: BleepingComputer – ShinyHunters uses WAF bypass trick in Oracle PeopleSoft attacks