ShinyHunters Bypasses PeopleSoft WAF Defences as CVE-2026-35273 Attacks Continue

Organisations running Oracle PeopleSoft have a fresh reason to check their patch status after Google threat researchers reported renewed mass exploitation of a critical PeopleTools vulnerability by the ShinyHunters threat group.

The flaw, tracked as CVE-2026-35273, is not new: Oracle disclosed and patched it in June. What has changed is the attack method. Google’s Mandiant and Google Threat Intelligence Group (GTIG) said on 25 September that the attackers have modified their requests to get around some web application firewall (WAF) rules that organisations may have been using as a temporary defence.

The practical lesson is straightforward: a WAF rule is not a substitute for installing Oracle’s security update.

Key takeaways

• Oracle rates CVE-2026-35273 at 9.8 out of 10 under CVSS 3.1.
• The vulnerability affects supported PeopleSoft Enterprise PeopleTools 8.61 and 8.62 and is remotely exploitable without authentication.
• Oracle says successful exploitation can result in remote code execution and recommends immediate action.
• Google says ShinyHunters, tracked as UNC6240, has renewed mass exploitation and expanded targeting beyond the education sector.
• The attackers modified requests so that simple string-based WAF rules could fail to recognise the vulnerable endpoint.
• Administrators should apply Oracle’s security update, review exposed PeopleSoft systems and investigate for signs of earlier compromise.

What is CVE-2026-35273?

CVE-2026-35273 is a vulnerability in the Updates Environment Management component of Oracle PeopleSoft Enterprise PeopleTools. Oracle’s security advisory says an unauthenticated attacker with network access over HTTP can exploit the issue.

Oracle assigns the vulnerability a CVSS 3.1 base score of 9.8, with high potential impact to confidentiality, integrity and availability. The vendor says successful exploitation may lead to remote code execution and a compromise of PeopleTools.

The supported versions explicitly listed in Oracle’s advisory are PeopleTools 8.61 and 8.62. Oracle also warns that older, unsupported releases are not tested for the vulnerability and recommends upgrading to supported versions so that current security fixes are available.

Why the renewed attacks matter

The latest development is important because some organisations may have treated a WAF rule as sufficient protection after the vulnerability became public.

Google says ShinyHunters initially exploited CVE-2026-35273 as a zero-day in June, with academic institutions forming a major part of the early targeting. Mandiant and GTIG have now observed a renewed mass-exploitation campaign across a broader range of sectors.

According to Google, the attackers altered the way they requested the vulnerable PeopleSoft endpoint. Some WAF and reverse-proxy rules were configured to look for a literal path string before URL decoding. By changing the representation of part of that path, malicious traffic could reach the application even where operators believed the WAF rule was blocking access.

The underlying PeopleSoft application still interpreted the request as the vulnerable endpoint. That mismatch between what an intermediary security control inspected and what the application ultimately processed is why relying on the filtering rule alone proved fragile.

WAF mitigation is not the same as patching

Web application firewalls can be useful compensating controls. They can reduce exposure while teams test and deploy a vendor fix, and they can provide valuable logging and detection. But they do not remove the vulnerable code.

This campaign demonstrates the risk of treating a narrowly written filtering rule as a permanent remediation. Attackers can sometimes alter equivalent requests in ways that defeat pattern-based controls while leaving the application’s interpretation unchanged.

Oracle’s own guidance is to apply its security patches without delay. The June security alert provides patch availability and mitigation information for affected PeopleSoft releases, and Oracle subsequently included the fix in its June Critical Security Patch Update.

What PeopleSoft administrators should do now

1. Confirm the actual PeopleTools version

Inventory internet-facing and internally exposed PeopleSoft environments and establish which PeopleTools versions they run. Do not assume a system is protected simply because a WAF rule was previously deployed.

2. Verify that Oracle’s fix is installed

Check the environment against Oracle’s CVE-2026-35273 security alert and the applicable patch documentation. Organisations on unsupported releases should review Oracle’s upgrade guidance because security fixes are provided for supported versions.

3. Treat WAF rules as an additional control

Keep appropriate WAF and reverse-proxy protections in place, but do not use them as a reason to postpone the vendor patch. Review rules for normalisation and decoding differences that could create gaps between the edge security layer and the application.

4. Review systems for evidence of compromise

Because exploitation has occurred in the wild, patching closes the known vulnerability but does not prove that a previously exposed server was never compromised. Organisations should review relevant application, web, proxy, identity and endpoint telemetry and follow their incident-response process when suspicious activity is found.

5. Reduce unnecessary exposure

PeopleSoft administrative and environment-management services should not be more broadly reachable than operationally necessary. Network segmentation, access controls and careful exposure management can reduce the attack surface alongside patching.

Who is being targeted?

Google says the renewed campaign has expanded beyond the higher-education focus observed earlier in the year. Its investigation describes compromised systems across sectors including technology, IT services, healthcare, agriculture, transportation and government.

That breadth makes the issue relevant to any organisation operating an exposed vulnerable PeopleSoft environment, rather than to one industry alone.

Why defenders should pay attention to request normalisation

The incident also illustrates a wider web-security problem. Security devices and application servers do not always interpret encoded or normalised URLs at exactly the same stage. If a filtering rule evaluates one representation while the backend evaluates another, attackers may be able to exploit the difference.

For defenders, that means mitigation rules should be tested against the way the entire request path is decoded and processed, not simply against one visible string. More importantly, compensating controls should have an expiry plan: once a vendor patch is available and validated, eliminating the underlying vulnerability is preferable to indefinitely depending on a signature.

The bottom line

CVE-2026-35273 has had a vendor fix available since June, but Google’s latest findings show that the threat has not disappeared. ShinyHunters has adapted its exploitation method to bypass some WAF-based defences and renewed targeting at scale.

PeopleSoft administrators should therefore verify the Oracle patch first, preserve WAF controls as defence in depth, and investigate previously exposed systems rather than assuming that a firewall rule provided complete protection.

Sources: Oracle Security Alert Advisory for CVE-2026-35273; Google Cloud/Mandiant and Google Threat Intelligence Group, “ShinyHunters Renewed Mass Exploitation Campaign Targeting Oracle PeopleSoft”, 25 September 2026.