Mandiant has identified an ongoing campaign exploiting CVE-2026-35273, a critical vulnerability in Oracle PeopleSoft with a CVSS score of 9.8. The flaw resides in the Environment Management Hub, known as PSEMHUB, and enables unauthenticated remote code execution.
The distinctive element of this wave is a simple web application firewall bypass that depends on a single character. Attackers substitute the path /PSEMHUB/ with /%50SEMHUB/, where %50 represents the URL encoding of the letter P. Many WAF and reverse-proxy rules compare the literal path before decoding the URL, while the PeopleSoft application server decodes the request and forwards it to the vulnerable servlet.
Exploitation and Web Shell Deployment
Exploitation occurs through Java object deserialization. Attackers send specially crafted POST requests to /%50SEMHUB/hub containing serialized Java objects. Successful exploitation results in the installation of two JSP web shells inside the PSEMHUB.war directory.
- x.jsp executes operating-system commands across multiple platforms.
- u.jsp supports chunked file uploads and execution via cmd.exe.
Persistence and Tooling
Following initial access, the operators deploy a trojanized installer named Ple64.exe that loads the SIDEEYE backdoor. They additionally install the Neo-reGeorg tunneling tool and the remote administration framework MeshAgent. Approximately one quarter of observed commands were executed with root or SYSTEM privileges.
The activity is attributed to UNC6240, a group linked to ShinyHunters. The campaign began as a zero-day targeting educational institutions in June 2026 and has since expanded to higher education, technology, healthcare, agriculture, transportation, and government organizations. No Oracle patch is referenced in the current analysis.
