Critical Oracle PeopleSoft Vulnerability Targeted in Renewed Exploitation Campaign
Mandiant, in collaboration with the Google Threat Intelligence Group (GTIG), has reported a resurgence in attacks targeting a significant vulnerability in Oracle’s PeopleSoft platform. Attackers have employed a straightforward URL manipulation technique to circumvent web application firewall (WAF) defenses designed to mitigate this threat.
The malicious activity is attributed to the group known as UNC6240, also referred to as ShinyHunters. They are believed to have exploited the zero-day vulnerability identified as CVE-2026-35273 during a window from May 27 to June 9. Although Oracle swiftly released an emergency patch on June 10, the recent attacks are part of a continued effort that began with earlier exploitation campaigns.
At the core of the exploit is a flaw affecting PeopleSoft’s Environment Management Hub (PSEMHUB). Attackers modified the directory path from “/PSEMHUB/” to “/%50SEMHUB/”, using URL encoding to replace the letter “P” with its encoded counterpart. This approach leverages gaps in many WAF and reverse-proxy rule sets that fail to decode the URL prior to inspecting its structure. As a result, the altered request is permitted through, allowing WebLogic to decode and ultimately process the vulnerable servlet.
Mandiant’s investigations revealed the presence of web shells on numerous systems, impacting various sectors including higher education, technology, healthcare, and government. In June, Hackread.com highlighted Mandiant’s earlier discoveries, which showed that over 100 organizations had systems potentially exposed to these vulnerabilities, with 68% situated within higher education primarily in the United States.
Following the exploitation, attackers have installed JSP web shells such as “x.jsp” and “u.jsp” in the PeopleSoft application directory. The former enables command execution, while the latter allows for the uploading of larger files in manageable chunks to navigate around HTTP request size limitations. Notably, on Windows systems, attackers delivered a 5.2 MB file dubbed “Ple64.exe,” which is a trojanized installer for the Light Alloy media player that establishes the SIDEEYE backdoor. Mandiant observed that this installer was signed with a valid certificate, further complicating detection efforts.
The SIDEEYE backdoor features capabilities for credential theft, file and process management, and establishing reverse shells and proxies. Attackers have also utilized the open-source Neo-reGeorg tunneling tool alongside legitimate remote management software, MeshAgent, to maintain their foothold in compromised environments.
This alarming situation follows ShinyHunters’ claims of using the same Oracle PeopleSoft zero-day to breach the FBI’s systems via its job application portal, from which they allegedly moved laterally into other segments of the FBI’s infrastructure, including AWS GovCloud, amassing between 2TB and 3TB of data.
While ShinyHunters did not disclose the specific PeopleSoft vulnerability leveraged against the FBI, there is no current evidence linking their actions to CVE-2026-35273 as outlined in Mandiant’s findings. The potential tactics employed during these attacks can be mapped to the MITRE ATT&CK framework, encompassing techniques such as initial access and persistence.
Mandiant strongly advises organizations to prioritize applying the security patch released by Oracle rather than relying solely on WAF rules for protection. It is also recommended to disable the Environment Management Hub wherever feasible, scrutinize WebLogic logs for both typical and encoded “/PSEMHUB/” requests, and perform checks within the PeopleSoft application directory for any unauthorized JSP or executable files. Organizations should also consider rotating credentials associated with any systems that may have been compromised.