Mandiant Warns of ShinyHunters Exploiting PeopleSoft via Simple WAF Bypass

Mandiant and Google Threat Intelligence Group (GTIG) disclosed a renewed mass-exploitation campaign orchestrated by UNC6240, a threat group associated with ShinyHunters. The adversary is actively exploiting CVE-2026-35273—a pre-authentication vulnerability located in Oracle PeopleSoft's Environment Management Hub (PSEMHUB). While initial zero-day activity was observed primarily in higher education earlier in the year, this latest wave has expanded globally across technology, healthcare, transport, and government sectors. Crucially, the attackers revived this exploit pipeline by using percent-encoding in request paths (requesting /%50SEMHUB/ instead of /PSEMHUB/), completely bypassing perimeter string-matching WAF rules to drop web shells and remote management agents. For DevOps, SecOps, and cloud platform architects, this incident highlights a recurring systemic vulnerability in perimeter defense strategies. Many organizations lean heavily on Cloud WAFs, API gateways, and reverse proxies as rapid temporary mitigations for unpatched enterprise workloads. However, when upstream layer-7 proxies fail to normalize URIs consistently before evaluation, simple character encoding transforms known vulnerability signatures into effective zero-days. When legacy enterprise ERP systems run exposed to ingress traffic, attackers gain a foothold directly under service accounts, establishing persistence and secondary staging without triggering alert thresholds. This trend fits within the broader shift away from perimeter-only trust models toward strict micro-segmentation and BeyondProd zero-trust architectures. Enterprise ERP applications, such as PeopleSoft, SAP, and complex relational databases, often host legacy listening endpoints and administrative hubs intended only for system-to-system orchestration or internal batch automation. Exposing these components to the open web—relying solely on edge signature inspection—has consistently proven inadequate as automated reconnaissance tools quickly iterate through encoding permutations. Practitioners must immediately audit access to backend application servers. Mandiant explicitly advises that WAF rules are not a substitute for vendor patches. Cloud and infrastructure teams running PeopleSoft should immediately apply Oracle's official security updates, disable the Environment Management Hub service where not strictly required, and isolate the PSEMHUB application behind private service endpoints or zero-trust identity-aware proxies. Furthermore, log ingestion pipelines should inspect WebLogic and ingress access logs for percent-encoded URI variants targeting administrative endpoints.