The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
The confirmed PeopleSoft risk is renewed exploitation of a known, critical vulnerability—not proof of a second zero-day. Mandiant and Google reported that ShinyHunters bypassed literal-path web application firewall (WAF) rules by URL-encoding one character in the vulnerable path. Separately, an October 5, 2026 report described the group’s unverified claim that it used another PeopleSoft flaw. For operators, the practical lesson is clear: patch the known vulnerability, don’t rely on path blocking, and investigate the second-flaw claim without treating it as established fact.
Is this a new PeopleSoft zero-day?
There are two separate issues in the reporting. The confirmed vulnerability is CVE-2026-35273 in Oracle PeopleSoft PeopleTools. Oracle’s June 10, 2026 security alert says it can be exploited remotely without authentication and may lead to remote code execution. Oracle lists PeopleTools 8.61 and 8.62 in its risk matrix and assigns the flaw a CVSS 3.1 base score of 9.8. Those details apply to CVE-2026-35273, not to the alleged second flaw. Oracle’s Security Alert Advisory provides the product-specific guidance.
The separate “new zero-day” account remains an allegation. CIO reported on October 5, 2026, that ShinyHunters claimed to have used a previously undocumented, pre-authentication PeopleSoft RCE in a claimed FBI-related breach and against other unnamed targets. The report said there was no assigned CVE, Oracle had not commented, and the issue was not listed in CISA’s Known Exploited Vulnerabilities catalog. It also quoted an analyst noting the absence of independent forensic confirmation. The cited reporting did not independently confirm either the second flaw or the claimed FBI breach. CIO’s October 5 report attributes the claim to the threat actor; it is not confirmation of a second vulnerability.
How did ShinyHunters bypass a PeopleSoft WAF rule?
The September campaign involved the known CVE, not evidence of a second vulnerability. Mandiant and Google reported renewed exploitation by UNC6240, which they identify as ShinyHunters, and said the activity reached organizations across sectors and countries. The request changed the path from /PSEMHUB/ to /%50SEMHUB/. The characters %50 encode the letter P.
#1 Best Overall
A WAF or reverse proxy that checks only the literal, unnormalized path may not match the encoded version. The PeopleSoft application server can decode the path and route the request to the vulnerable servlet anyway. That can defeat a path-based rule even while the underlying system remains unpatched. Mandiant reported web shells on dozens of systems globally in the September campaign; that is a reported campaign scope, not a complete victim count or an estimate of the share of exposed installations. Mandiant and Google’s September 25 report describes the activity and bypass.
TrendAI’s October 1 analysis also advises checking that WAF and reverse-proxy rules decode and normalize paths before matching, and validating whether /PSEMHUB/hub is reachable from outside the network. TrendAI’s analysis discusses the one-character path variation.
Why patching matters more than perimeter-only blocking
| Control | What it does | What the campaign shows |
|---|---|---|
| Oracle’s Security Alert patch for CVE-2026-35273 | Remediates the known vulnerability on affected PeopleSoft nodes. | This is the primary remediation for the confirmed CVE. Follow Oracle’s alert and support guidance for the deployed version. |
| Literal-path WAF or reverse-proxy blocking | Attempts to block requests that match a specified URL path. | The encoded /%50SEMHUB/ path could evade rules that match only the literal raw path; blocking alone does not fix the vulnerable software. |
Oracle says the alert’s patches and mitigations cover product versions in Premier or Extended Support and recommends remaining on actively supported releases. Organizations should use Oracle’s advisory to determine applicability and follow its instructions for their version and configuration.
What PeopleSoft operators should do now
- Patch affected nodes. Apply Oracle’s Security Alert patch for CVE-2026-35273. Treat WAF rules and path-based blocks as additional controls, not substitutes for patching.
- Restrict the Environment Management Hub. In multi-server configurations, disable the Environment Management Hub service. In single-server configurations, remove the PSEMHUB application where appropriate. Follow Oracle’s configuration-specific guidance.
- Review PIA WebLogic access logs. Search for requests to
/PSEMHUB/and encoded or otherwise normalized variants such as/%50SEMHUB/. Pay particular attention to POST requests to/huband external requests for JSP files. - Inspect the application directory. Check
<PS_CFG_HOME>/webserv/<domain>/applications/peoplesoft/PSEMHUB.war/for files not included in the shipped product. Mandiant namesx.jsp,u.jsp,tunnel.jsp,tunnel.jspx, andPle64.exeas examples to investigate. - Rotate credentials accessible to the PeopleSoft service account. Include database connection strings, Integration Broker credentials, and cloud credentials reachable from the web tier.
- Investigate suspicious activity. Monitor outbound traffic from PeopleSoft hosts and look for unexpected remote-management agents. If you find web shells or other evidence of compromise, treat the host as compromised and follow your organization’s incident-response process.
These incident-specific steps do not replace an organization’s incident-response procedures or Oracle support guidance. If WAF or reverse-proxy controls remain in place, verify that they normalize paths before matching and test external reachability of the hub.
Rank #3
What the earlier exploitation figures do—and don’t—show
Mandiant and Google observed exploitation of CVE-2026-35273 from May 27 through June 9, 2026, before Oracle’s June 10 alert. Their June 11 report says Google notified over 100 organizations whose IP addresses correlated with potentially vulnerable endpoints; those were notifications, not confirmed victim counts. Higher education accounted for 68 percent of that notified organization set, not 68 percent of all exposed PeopleSoft deployments. The report describes the earlier activity as concentrated in higher education. The June 11 Mandiant and Google report provides that context.
The later campaign broadened targeting internationally and across sectors, according to the September report. Neither report establishes a total number of exposed PeopleSoft installations or a portfolio-wide probability of compromise, so these observed figures should not be used to calculate one.
Quick Recap
Best Value
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Recommended Free Tools
