Google is warning of renewed mass exploitation of a critical security vulnerability in Oracle PeopleSoft, tracked as CVE-2026-35273 with a CVSS score of 9.8, as part of a campaign hitting multiple sectors worldwide. The flaw allows unauthenticated remote code execution and was first exploited as a zero-day in attacks against academic institutions. Now, the ShinyHunters-linked threat group UNC6240 has modified its exploit to evade web application firewall (WAF) protections that were blocking the vulnerable Environment Management Hub endpoint.

The latest wave of attacks targets entities across higher education, technology, IT services, healthcare, agriculture, transportation, and government sectors, with attackers deploying web shells on dozens of systems. The threat actor's WAF bypass technique is deceptively simple: they replaced a single character in the request path by URL-encoding it, requesting "/%50SEMHUB/" instead of "/PSEMHUB/". Many WAF and reverse proxy rules match the literal path before URL decoding occurs, while the PeopleSoft application server decodes the request and routes it to the vulnerable servlet. Once inside, attackers abuse Java deserialization to deploy two JSP web shells—"x.jsp" for cross-platform command execution and "u.jsp" for chunked file uploads and command execution via "cmd.exe". They then upload a trojanized installer that loads SIDEEYE, a C++ backdoor communicating with an external server over TCP to steal credentials, manage processes and files, and establish interactive reverse shells. About a quarter of the threat actor's commands were executed as root or NT Authority\SYSTEM, granting full control of the operating system, with remaining commands run under PeopleSoft or WebLogic service accounts.

According to Google-owned Mandiant, the company "initiated notifications to over 100 global organizations whose IP addresses matched vulnerable endpoints, most of them located in the U.S." during the initial zero-day exploitation phase. The report notes that "UNC6240 has a well-established pattern of data theft extortion, that is, stealing data and threatening to release it on a data leak site unless the victim pays a ransom," and warns that "affected organizations should prepare for extortion communications and monitor for potential public exposure of stolen data." ShinyHunters separately breached the FBI's FBIJobs.gov portal and stole approximately 2-3 TB of sensitive data, though a spokesperson told The Hacker News the breach was "NOT financially motivated" and used a different zero-day vulnerability in Oracle PeopleSoft.

Organizations must apply patches for CVE-2026-35273 immediately and either disable the Environment Management Hub service in multi-server configurations or remove the PSEMHUB application entirely in single-server setups. Additional countermeasures include searching WebLogic access logs for requests to "/PSEMHUB/" and any percent-encoded variant, inspecting the "PSEMHUB.war" directory for JSP web shells, rotating credentials readable by the PeopleSoft application service account, and reviewing database audit logs for bulk queries against HR, payroll, and student records tables. The report emphasizes monitoring outbound traffic from PeopleSoft hosts to detect ongoing exfiltration. Organizations that delay patching face the prospect of complete system compromise, credential theft, and public data exposure through extortion tactics that have become the threat group's signature. The sophistication gap between defensive measures and attacker techniques continues to widen as simple encoding tricks render expensive security tools ineffective, forcing defenders to rethink assumptions about what constitutes adequate perimeter protection.