ShinyHunters Walks Past Your WAF With One Percent Sign: The PeopleSoft CVE-2026-35273 Resurgence

The patch you skipped, and the WAF rule that never held

ShinyHunters, the extortion gang that has made a business of breaching organizations running unpatched enterprise software, found a way through a web application firewall that many security teams believed was holding. The trick costs the attackers nothing: one character in the URL, changed from a letter to its percent-encoded form.

Google’s Mandiant reported on September 26 that the group (tracked as UNC6240) is resuming exploitation of Oracle PeopleSoft servers using a WAF bypass against CVE-2026-35273, the unauthenticated remote code execution flaw Oracle patched back in June. The victims this time are the organizations that never installed the update but pointed a WAF rule at the vulnerable endpoint and called it mitigated.

How the bypass works

The vulnerable path in PeopleSoft’s Environment Management Hub is /PSEMHUB/. When Mandiant advised blocked-but-unpatched organizations to deny external access to that endpoint, most wrote a rule matching the literal string. The problem is that URLs can encode characters in more than one legal form. Writing the first P as %50 produces a request that a WAF comparing raw, undecoded paths sees as something entirely different. Oracle WebLogic, sitting behind the WAF, decodes the request happily and routes it straight to the vulnerable code.

The firewall checks the string, the application server checks the meaning, and the two never agree. The request walks through the gap.

Mandiant warns the %50 variant is not fixed. The group can rotate through mixed case, double encoding, or other representations of the same path at will. Any defensive rule built on literal string matching is playing whack-a-mole against an attacker who controls the alphabet.

The attack sequence, from quiet probe to full tunnel

The reconnaissance phase is deliberately low-noise. Before exploiting, the attackers send between five and fifteen POST requests to /PSEMHUB/hub carrying serialized Java objects. On a vulnerable server these return operating system details without writing files or disrupting the service. A security team watching for webshell drops or crashes sees nothing at all.

Once a server confirms it is exploitable, the intrusion escalates:

• Web shells for access. An x.jsp shell handles command execution; u.jsp and u2.jsp handle uploading larger files.
• A backdoor on Windows. An executable named Ple64.exe masquerades as a signed Light Alloy media player installer and drops SIDEEYE, a Google-tracked backdoor used for credential theft and interactive reverse shells.
• A tunnel into the internal network. The open-source Neo-reGeorg toolkit, planted as tunnel.jsp or tunnel.jspx, wraps SOCKS5 proxy traffic in ordinary HTTP and HTTPS. From there the compromised PeopleSoft server is a bridge into everything behind it.
• Legitimate tooling on Linux. On Linux systems the group uses MeshAgent, a genuine remote management product, to hold access. Nothing about it looks malicious to an EDR product that trusts signed agents.

According to Mandiant, this wave has planted web shells on dozens of systems across higher education, technology, IT services, healthcare, agriculture, transportation, and government.

The FBI Jobs claim

This bypass is not theoretical. ShinyHunters told BleepingComputer they used it against the FBI Jobs platform. The group claims a breach that moved laterally into FBI AWS GovCloud infrastructure and took two to three terabytes of data on current and former employees, job applicants, and internal systems. The FBI has confirmed it is investigating unauthorized activity affecting FBIjobs.gov but has not confirmed a breach or the data volume, and BleepingComputer could not independently verify the claims. The gang additionally asserts they found a second, unknown vulnerability in the same PSEMHUB component. Treat that claim with the skepticism it deserves. It comes from the people selling the breach.

What this means for African enterprises

PeopleSoft is not a niche product on this continent. It runs HR and finance for banks, insurers, universities, parastatals, and government departments from Johannesburg to Lagos. Many of these estates sit behind perimeter WAFs, were scheduled to patch on a quarterly cycle, and told their boards the exposure was “mitigated” the day the rule went live.

The practical lesson is narrow and uncomfortable. A WAF rule written against a URL string is a guess about how the application server will interpret that string. It fails the moment the two disagree, and attackers know exactly where the seams are. If you run PeopleSoft or any WebLogic-fronted Oracle stack:

1. Install the June 2026 PeopleSoft updates for CVE-2026-35273, or take the PSEMHUB endpoint offline entirely. A WAF rule is not either of these things.
2. Search WebLogic access logs for /PSEMHUB/hub and its encoded variants, including the tell-tale burst of five to fifteen serialized-object POSTs. Assume the literal search will miss attacks.
3. Look for x.jsp, u.jsp, u2.jsp, and tunnel.jsp or tunnel.jspx anywhere under your application directories.
4. Audit remote management agents. MeshAgent installs that nobody ordered are a foothold, not a tool.

Where eHawu fits

The ShinyHunters campaign succeeds because a mitigation was believed and never verified. eHawu built our network-layer platform around that gap. Continuous exposure mapping shows you which endpoints are reachable from the public internet and how they respond to the variations an attacker would try, not just the literal string your firewall rule matches. If you run Oracle middleware and want to know whether your WAF is actually holding before a gang like UNC6240 tests it, that is exactly the question eHawu answers. Talk to us about a managed exposure assessment.