How ShinyHunters Bypassed WAF Rules to Exploit Oracle PeopleSoft Again

ShinyHunters, tracked by Mandiant and Google’s Threat Intelligence Group as UNC6240, resumed mass exploitation of Oracle PeopleSoft vulnerability CVE-2026-35273 in September 2026. The group modified its requests to bypass some web application firewall (WAF) rules that blocked the vulnerable URL path—but a firewall rule did not remove the flaw. The earlier May–June campaign compromised more than 300 PeopleSoft instances across over 100 organizations, predominantly in education. 1117

How the WAF bypass worked

Some organizations had tried to mitigate the vulnerability by using WAF rules to block requests to PeopleSoft’s Environment Management Hub endpoint, /PSEMHUB/. In the renewed campaign, attackers percent-encoded the first letter of the path, sending /%50SEMHUB/ instead. A rule checking only for the literal /PSEMHUB/ path could miss the altered request, while the application’s request handling could still resolve it to the vulnerable endpoint. 36

That distinction matters: the URL was written differently, but the underlying PeopleSoft vulnerability remained. Google’s threat-intelligence reporting attributed the renewed activity to UNC6240 and described it as exploitation of the same CVE. 17

The renewed campaign reached more sectors

The first observed wave ran from May 27 to June 9, 2026, and focused predominantly on academic institutions. Researchers reported that it affected more than 300 application instances at over 100 organizations. 1122

The later campaign expanded beyond education. Reported targets included higher education, technology, healthcare, agriculture, transportation and government organizations. 217

What is known about the FBI jobs-portal claims

ShinyHunters claimed it breached the FBI jobs portal using an alleged new PeopleSoft zero-day, then accessed FBI-managed AWS GovCloud and stole data relating to employees and applicants. 10 Separate reporting described a sample of about 5,000 purported FBI employee records. 43

Those details should be treated as claims, not established findings: the available reporting does not independently confirm the alleged GovCloud access, the full scope of any data theft, or whether the FBI incident involved a separate zero-day. Reporting says the FBI was investigating the jobs-site incident, but that alone does not verify the group’s broader account. 2

Why patching matters more than a WAF rule

A WAF can provide a layer of protection, but a rule that matches one form of a URL may not catch a differently encoded version. Because the request can still reach the vulnerable endpoint, blocking the literal path is not a substitute for addressing the vulnerability itself. 36

Mandiant and Google reported renewed exploitation of CVE-2026-35273 and urged affected organizations to apply Oracle’s security fix rather than rely on WAF rules alone. 176