A notorious cybercrime gang has once again found a way to exploit a previously patched vulnerability in Oracle’s PeopleSoft software, thanks to a clever trick that bypasses web application firewall rules. The ShinyHunters extortion gang is using this technique to target vulnerable servers, steal sensitive data, and gain unauthorized access to internal networks.
The vulnerability, known as CVE-2026-35273, was patched by Oracle back in June after it was first reported by BleepingComputer that the ShinyHunters gang was exploiting it to steal data from over 100 organizations. However, the threat actors have now modified their exploit to evade detection by web application firewalls (WAFs) that were thought to be effective against this type of attack.
The trick involves encoding the URL path in a way that makes it appear as if the attackers are requesting a different endpoint than they actually intend to target. For example, instead of sending requests to `/PSEMHUB/`, the attackers are now requesting `%50SEMHUB/`. This encoded version of the path is often missed by WAFs and reverse proxies because they compare the literal request path before decoding it.
As a result, many organizations that thought their WAF rules had mitigated the exposure have been caught off guard. According to Google’s Mandiant team, this new technique has allowed ShinyHunters to target PeopleSoft servers that had not applied security updates and deploy web shells on dozens of systems worldwide.
The attackers typically begin by sending between five and 15 POST requests to `%50SEMHUB/hub` containing serialized Java objects. These requests allow them to determine whether a server can be exploited quietly, after which they exploit the flaw again to execute commands directly in memory or deploy JSP web shells. The threat actors have been using these shells to deploy malware, including a backdoor tracked by Google as SIDEEYE, which is used to steal credentials and create interactive reverse shells.
What’s particularly concerning about this development is that it highlights the limitations of relying on WAFs alone to protect against sophisticated attacks. While WAFs can provide some level of protection, they are not foolproof and can be easily bypassed by determined threat actors. In this case, ShinyHunters has shown that with enough creativity and persistence, even a patched vulnerability can be exploited.
So what can organizations running Oracle PeopleSoft do to protect themselves? Mandiant recommends installing the latest security update to patch CVE-2026-35273. Additionally, they should search WebLogic access logs for requests to `/PSEMHUB/` and encoded variants such as `%50SEMHUB/` to detect signs of exploitation. By taking these steps, organizations can reduce their risk of falling victim to this type of attack and protect sensitive data from being stolen by cybercrime gangs like ShinyHunters.
Source: Bleeping Computer — 2026-09-26