Attackers Bypass WAFs to Exploit Oracle PeopleSoft Flaw and Deploy Web Shells

Google's Mandiant team reports a fresh surge of exploitation targeting Oracle PeopleSoft, tied to the ShinyHunters-linked group UNC6240. The attackers are abusing CVE-2026-35273 (CVSS 9.8), an unauthenticated remote code execution bug in the Environment Management Hub (PSEMHUB) component, by URL-encoding a character in the request path so string-matching WAF rules fail to block the malicious traffic before the PeopleSoft server decodes and routes it anyway. Once inside, the actors drop JSP web shells, deliver a signed-but-trojanized installer that loads the SIDEEYE backdoor, deploy the Neo-reGeorg tunneling tool, and use MeshAgent for persistence, giving them root or SYSTEM-level access on many compromised hosts across education, healthcare, government, and other sectors. Organizations running PeopleSoft are urged to apply the patch, disable or remove the PSEMHUB application where unneeded, rotate service-account credentials, and hunt for encoded PSEMHUB requests and web shell artifacts, since UNC6240 is known for data-theft extortion campaigns.