A single encoded character has allowed ShinyHunters to reach vulnerable Oracle PeopleSoft systems protected by some web application firewall rules, according to new research from Mandiant and Google Threat Intelligence Group.
The group, tracked as UNC6240, has resumed mass exploitation of CVE-2026-35273, a critical flaw in PeopleSoft’s Environment Management Hub. The latest activity follows a campaign earlier this year that predominantly targeted higher education institutions while the vulnerability was still a zero-day.
The change is small but consequential. Instead of sending requests to /PSEMHUB/, the attackers use /%50SEMHUB/. Some firewalls and reverse proxies check for the literal path before decoding the request. The PeopleSoft application server then decodes it and routes the traffic to the vulnerable component.
Mandiant says the revised approach has enabled attacks against organisations that may have believed their firewall rules addressed the exposure. Its researchers observed web shells on dozens of systems globally, across sectors including healthcare, technology, transportation, agriculture, government and higher education.
Oracle issued a security alert for the flaw in June. It affects supported PeopleTools versions 8.61 and 8.62 and carries a severity score of 9.8 out of 10. Successful exploitation can give an unauthenticated attacker remote code execution.
For Australian organisations running PeopleSoft, the finding calls for a fresh check of patch status and internet exposure, particularly where a firewall rule was used as an interim measure. There is no suggestion in Mandiant’s report that the observed compromises include an Australian organisation.
Mandiant recommends applying Oracle’s security update, disabling the Environment Management Hub service or removing the PSEMHUB application where appropriate, and reviewing WebLogic logs for encoded versions of the path. Its central warning is that a rule blocking a known request string cannot replace a fix for the underlying vulnerability.
