Mandiant: ShinyHunters re-exploits 9.8-rated PeopleSoft flaw in 7 sectors by encoding one character to evade WAFs; 25% of commands at top privilege

According to a BleepingComputer report on 26 September, CVE-2026-35273 is an unauthenticated remote code execution flaw in the Environment Management Hub (PSEMHUB) component of Oracle PeopleSoft; the first zero-day exploitation was reported on 10 June and Oracle released a patch on 11 June. According to Mandiant, the attackers circumvent rules blocking the /PSEMHUB/ path with a /%50SEMHUB/ request: many WAFs inspect the path before decoding it, while WebLogic decodes the request and routes it to the vulnerable component. In the reconnaissance phase, 5 to 15 POST requests containing serialised Java objects are sent to the target, after which the x.jsp, u.jsp and u2.jsp web shells, the SIDEEYE backdoor, the Neo-reGeorg tunnelling tool and the MeshAgent remote management software are deployed.

According to a report by The Hacker News on 26 September, dozens of systems in 7 sectors (higher education, technology, IT services, healthcare, agriculture, transport and government) were compromised through the flaw, which carries a CVSS score of 9.8; around 25% of the attacker's commands ran with root or SYSTEM privileges. Mandiant warned more than 100 organisations with exposed endpoints. The group is continuing its pattern of stealing data and demanding ransom under threat of publication. The disclosure came in the same week as a claim that ShinyHunters stole 2–3 TB of data from the FBI's FBIJobs.gov portal using a different PeopleSoft zero-day; that claim could not be independently verified. Rather than relying solely on WAF rules, Mandiant recommends installing the patch, searching WebLogic logs for encoded variants and rotating credentials.