# Critical Oracle PeopleSoft Vulnerability Under Renewed Mass Exploitation Campaigns
**Published: September 2026**
A sophisticated cyber operation targeting Oracle PeopleSoft systems has resurfaced with renewed intensity, prompting urgent warnings from security researchers and technology firms worldwide. The campaign leverages a high-severity flaw that allows unauthenticated attackers to seize complete control of vulnerable servers without any credentials.
## The Vulnerability at the Center of the Storm
The exploited weakness is identified as **CVE-2026-35273**, carrying a maximum CVSS severity score of **9.8 out of 10**. At its core, the flaw resides within Oracle PeopleSoft’s Environment Management Hub — a component that processes serialized Java objects submitted via HTTP POST requests.
What makes this vulnerability particularly dangerous is its combination of critical severity with ease of exploitation. Attackers do not need any authentication or prior access to the system. A single crafted request to the affected endpoint is sufficient to trigger the flaw and gain arbitrary code execution on the target machine.
## How the Attack Unfolds
Security analysts have mapped out a multi-stage attack chain that demonstrates a high level of sophistication. The initial phase involves reconnaissance, where attackers identify vulnerable PeopleSoft installations by probing specific endpoints with specially crafted requests.
To evade detection by web application firewalls (WAFs) and reverse proxies, the attackers employ a clever bypass technique. Instead of using the standard `/PSEMHUB/` path in their requests, they encode the initial character using percent-encoding, transforming it to `/%50SEMHUB/`. Many WAF and proxy systems inspect incoming URLs before they are decoded, meaning the encoded variant slips past filtering rules. Meanwhile, the PeopleSoft application server itself decodes the request and faithfully routes it to the vulnerable servlet, falling directly into the attacker’s hands.
Once the vulnerable endpoint is reached, the attackers abuse Java deserialization to deploy web shells — lightweight scripts that provide persistent command execution capabilities directly through a web browser. Two specific shell variants have been identified:
– **x.jsp** — Designed for cross-platform command execution, allowing attackers to run arbitrary commands on the compromised system regardless of the underlying operating system.
– **u.jsp** — A more specialized shell that supports chunked file uploads and enables command execution through `cmd.exe` on Windows environments.
## Post-Exploitation and Persistence Mechanisms
After establishing initial access, the attackers escalate their foothold using several techniques. A trojanized executable called **Ple64.exe** is uploaded to the compromised system via the web shell. This legitimate-looking installer secretly loads **SIDEEYE**, a custom C++ backdoor that communicates with an external command-and-control server over TCP. SIDEEYE provides a comprehensive toolkit for attackers, including browser credential theft, desktop application password harvesting, file and process management, interactive reverse shell access, and reverse proxy capabilities.
On Linux-based systems, the attackers have been observed deploying **MeshAgent**, a legitimate remote monitoring and management tool, to maintain persistent access even if the web shells are detected and removed. Additionally, the open-source **Neo-reGeorg** tunneling toolkit has been staged to facilitate covert communication with compromised hosts behind network restrictions.
A particularly alarming finding is that approximately **25 percent** of the commands executed during these intrusions run with **root** (Linux) or **NT Authority SYSTEM** (Windows) privileges, granting the attackers unrestricted control over the entire operating system. The remaining commands operate under service accounts associated with PeopleSoft and WebLogic, limiting access but still providing significant leverage for lateral movement.
## Industries in the Crosshairs
The latest wave of activity shows no discrimination when it comes to target selection. Victims span a remarkably diverse range of industries, including:
– **Higher education** institutions and universities
– **Technology and IT services** companies
– **Healthcare** organizations
– **Agriculture** sector businesses
– **Transportation** infrastructure operators
– **Government** agencies
Google’s incident response team, Mandiant, estimates that it had to issue notifications to over 100 global organizations whose IP addresses matched vulnerable endpoints during an earlier wave of attacks. The majority of affected organizations were located in the United States.
## Motive and Attribution
The operation has been attributed to **UNC6240**, a threat actor group also linked to the **ShinyHunters** collective — a cybercriminal organization well-known for large-scale data theft campaigns. UNC6240 has a documented history of a data-theft-and-extortion model, where stolen information is exfiltrated and then held for ransom under the threat of public disclosure on data leak sites.
Organizations affected by this campaign are strongly advised to prepare for potential extortion communications and to actively monitor for any signs of stolen data being published publicly.
In a separate but related development, the ShinyHunters group claimed responsibility for breaching the **U.S. Federal Bureau of Investigation’s FBIJobs.gov** portal, exfiltrating an estimated 2 to 3 terabytes of sensitive data. The group stated that the breach was intended to counter what they described as false allegations made by the agency and denied any financial motivation behind the act. The FBI portal remained inaccessible at the time of reporting.
## Recommended Mitigation Steps
Organizations running Oracle PeopleSoft environments should take immediate action to reduce their exposure. The following measures are strongly recommended:
1. **Apply security patches** for CVE-2026-35273 as soon as they become available from Oracle.
2. **Disable the Environment Management Hub (EMHub)** service in multi-server deployment configurations, or **completely remove the PSEMHUB application** in single-server setups.
3. **Conduct thorough log reviews** of WebLogic access logs, searching for any requests targeting `/PSEMHUB/` or percent-encoded variants of the path.
4. **Inspect the PSEMHUB.war directory** for unauthorized JSP web shells and other malicious artifacts.
5. **Rotate all credentials** that are accessible to the PeopleSoft application service account.
6. **Scan PeopleSoft and database hosts** for unusually large archive files located in temporary or web-accessible directories.
7. **Review database audit logs** for signs of bulk data queries or unauthorized exports targeting HR, payroll, and student records tables.
8. **Monitor outbound network traffic** from PeopleSoft hosts for suspicious connections to external IP addresses.
—
## Frequently Asked Questions (FAQ)
**Q: What is CVE-2026-35273?**
A: CVE-2026-35273 is a critical vulnerability (CVSS 9.8) in Oracle PeopleSoft’s Environment Management Hub that allows unauthenticated remote code execution through Java deserialization flaws.
**Q: Who is behind the recent exploitation campaigns?**
A: The attacks have been attributed to UNC6240, a threat actor group also associated with the ShinyHunters cybercriminal collective.
**Q: Why are web application firewalls (WAFs) failing to block these attacks?**
A: The attackers bypass WAF rules by percent-encoding the first character of the request path (`/%50SEMHUB/` instead of `/PSEMHUB/`). Many WAF systems inspect URLs before URL decoding, so the encoded variant passes through undetected. The application server then decodes the path and processes the malicious request normally.
**Q: What kinds of systems are targeted?**
A: The campaigns primarily target Oracle PeopleSoft and WebLogic environments deployed across industries including higher education, healthcare, technology, government, agriculture, and transportation.
**Q: What should organizations do if they suspect they have been compromised?**
A: Organizations should immediately apply patches, inspect their PSEMHUB.war directories for web shells, rotate service account credentials, review database audit logs for bulk data exports, and monitor outbound traffic. They should also engage forensic investigators and prepare for potential extortion attempts.
**Q: Is there a financial motivation behind these attacks?**
A: Yes. UNC6240 follows a well-documented pattern of stealing sensitive data and threatening public release unless a ransom is paid. Affected organizations should anticipate extortion communications.
—
## Conclusion
The renewed exploitation of CVE-2026-35273 underscores a persistent and evolving threat landscape in which well-known vulnerabilities continue to be weaponized at scale. The sophistication of the attack chain — from WAF bypass techniques to multi-layered persistence mechanisms — demonstrates that threat actors are continually adapting their methods to evade detection and maximize impact. Organizations running Oracle PeopleSoft environments must treat this as a priority security concern and act swiftly to apply patches, disable vulnerable services, and conduct thorough forensic inspections of their systems. Proactive defense, continuous monitoring, and rapid incident response remain the most effective strategies against this and similar campaigns targeting critical enterprise infrastructure.
Thank you for reading
