← Back to Feed

ShinyHunters Renewed Mass Exploitation Campaign Targeting Oracle PeopleSoft

CVE-2026-35273

September 25, 2026 · Google Cloud Security · Severity: CRITICAL

Introduction  As an update to the June 2026 post, ShinyHunters Targets Education Sector with Oracle PeopleSoft Exploit, Mandiant and Google Threat Intelligence Group (GTIG) have identified renewed mass exploitation of CVE-2026-35273 by UNC6240 (ShinyHunters), along with expanded global targeting across multiple sectors. In June, the threat actor exploited this vulnerability as a zero-day predominantly against academic institutions. This new wave of activity stems from UNC6240 modifying its exploit to bypass web application firewall (WAF) rules blocking the vulnerable Environment Management Hub (PSEMHUB) endpoint. The threat actor bypassed these string-based WAF rules by URL-encoding a single character in the request path, requesting /%50SEMHUB/ in place of /PSEMHUB/. Many WAF and reverse proxy rules match the literal path before URL decoding, while the PeopleSoft application server decodes the request and routes it to the vulnerable servlet. This allows the threat actor to reach the endpoint on systems whose operators may have believed their WAF rules had mitigated the exposure. Our analysis indicates that the threat actor expanded their targeting in this recent campaign, deploying web shells on dozens of systems globally, spanning higher education, technology, IT services, healthcare, agriculture, transportation, and government. Mandiant recommends that organizations running Oracle PeopleSoft take the following immediate actions. Additional remediation and hardening guidance is included later in this post. Remediation and Hardening Quick Guide Apply the Oracle Security Alert patch for CVE-2026-35273. WAF rules and path-based blocking are not a substitute for patching. Disable the Environment Management Hub (EMHub) service in multi-server configurations, or remove the PSEMHUB application entirely in single-server configurations, as advised in Oracle's security alert guidance. Search PIA WebLogic access logs for requests to /PSEMHUB/ and... 📌 **Analyst Note:** This vulnerability is confirmed actively exploited in the wild. Organizations should treat this as an emergency patching priority and monitor for compromise indicators.

Key Takeaways

  • ShinyHunters has renewed its mass exploitation campaign targeting vulnerable systems, continuing to leverage known vulnerabilities for widespread compromise.
  • The sustained campaign activity from ShinyHunters demonstrates the group's operational capacity and the persistent risk from organized cybercriminal exploitation operations.
  • Organizations should ensure timely patching of known vulnerabilities and monitor for indicators of ShinyHunters-associated exploitation activities.
☕ Buy a Coffee