ShinyHunters Return to Oracle PeopleSoft With a Simple Trick That Slips Past Firewalls

Mandiant and Google Threat Intelligence Group (GTIG) have identified renewed mass exploitation of CVE-2026-35273, a vulnerability in Oracle PeopleSoft, by the group tracked as UNC6240, also known as ShinyHunters. In June, the group used the flaw as a zero-day, mostly against academic institutions. This new wave has spread globally, with web shells deployed on dozens of systems across higher education, technology, IT services, healthcare, agriculture, transportation and government.

The renewed activity relies on a simple change. Many web application firewall (WAF) and reverse proxy rules block the vulnerable Environment Management Hub endpoint by matching its exact path. The attackers encoded a single character in the request, so the path no longer matched the rule as written. The PeopleSoft server then decoded the request and routed it to the vulnerable component anyway. Organisations that believed their firewall rules had closed the exposure may therefore still be at risk.

Mandiant recommends several immediate actions for PeopleSoft users. Disable the Environment Management Hub service in multi-server setups, or remove the application entirely in single-server setups, as Oracle advises. Search web server access logs for requests to the endpoint, including percent-encoded variants, especially from external addresses. Check the application directory for files that are not part of the shipped product. Finally, rotate credentials the PeopleSoft service account can read, including database connection details, Integration Broker credentials and any reachable cloud credentials.