Google Warns of Renewed Oracle PeopleSoft Exploitation by UNC6240

September 26, 2026 at 04:46 PM2 min

This digest was compiled by AI from multiple sources — links to the originals are below.

Google warned of renewed mass exploitation of a critical Oracle PeopleSoft vulnerability, CVE-2026-35273, by the UNC6240 threat actor. The attackers bypassed web application firewall rules using URL encoding to deploy web shells on dozens of systems across multiple sectors globally.

Key Facts

The vulnerability CVE-2026-35273 has a CVSS score of 9.8 and allows unauthenticated remote code execution.
Mandiant notified over 100 global organizations whose IP addresses matched vulnerable endpoints, most located in the U.S.
The threat actor bypassed WAF rules by URL-encoding a single character, requesting /%50SEMHUB/ instead of /PSEMHUB/.
Targets include higher education, technology, IT services, healthcare, agriculture, transportation, and government sectors.
The attackers deployed two JSP web shells, x.jsp and u.jsp, in the PSEMHUB.war directory.

Exploitation Technique

UNC6240 modified its exploit to bypass WAF rules blocking the vulnerable Environment Management Hub (PSEMHUB) endpoint. The threat actor bypassed string-based WAF rules by URL-encoding a single character in the request path, requesting /%50SEMHUB/ in place of /PSEMHUB/. Many WAF and reverse proxy rules match the literal path before URL decoding, while the PeopleSoft application server decodes the request and routes it to the vulnerable servlet. The attack chain begins with POST requests to /%50SEMHUB/hub containing a serialized Java object to identify susceptible targets.

Post-Exploitation Activity

The attackers dropped two JSP web shells in the PSEMHUB.war directory to minimize WAF detections during post-exploitation. The web shell x.jsp enables cross-platform command execution, while u.jsp allows chunked file uploads and command execution via cmd.exe. Using u.jsp, the threat actor uploaded a valid, signed trojanized installer named Ple64.exe. Ple64.exe loads SIDEEYE, a C++ backdoor that communicates with an external server at 162.219.30[.]165 over TCP. SIDEEYE facilitates browser and desktop application credential theft, process and file management, interactive reverse shell, and reverse proxy capabilities.

Persistence and Tooling

Alongside Ple64.exe, the threat actor staged the open-source Neo-reGeorg tunneling toolkit. To establish persistent access after web shell placement on Linux systems, UNC6240 deployed the legitimate RMM tool MeshAgent. The ShinyHunters-linked activity was first exploited as a zero-day against academic institutions for reconnaissance and data theft.