Oracle PeopleSoft CVE-2026-35273: WAF Bypassed via URL Normalization Mismatch to Deploy Web Shells and SIDEEYE

1. Overview

• Article Title: ShinyHunters Renewed Mass Exploitation Campaign Targeting Oracle PeopleSoft
• Source: Google Threat Intelligence Group / Mandiant
• Publication Date: September 25, 2026
• Original Article: Google Threat Intelligence Group / Mandiant
• Related Sources: Oracle Security Alert Advisory - CVE-2026-35273, BleepingComputer
• Related Malware, Threat Groups, CVEs, and Products: SIDEEYE, x.jsp, u.jsp, u2.jsp, Neo-reGeorg, MeshAgent, UNC6240, ShinyHunters, CVE-2026-35273, Oracle PeopleSoft Enterprise PeopleTools 8.61 / 8.62, Oracle WebLogic, Environment Management Hub
• Severity: Critical (Active exploitation of a CVSS 9.8 pre-authentication RCE vulnerability has been confirmed, with web shells deployed across dozens of systems. An encoding technique is used to bypass WAF pattern blocking, and tools enabling credential theft and internal tunneling have been deployed post-intrusion.)
• Revision Notes: Maintained 16 sections and the comparison table, refined the scope of WAF bypass, signed malicious files, observed functions and execution success, and determination criteria using HTTP responses and logs in accordance with primary sources.

2. Executive Summary

The threat group UNC6240 (ShinyHunters) exploited an unpatched Oracle PeopleSoft vulnerability (CVE-2026-35273) by percent-encoding the P in /PSEMHUB/ as %50, successfully bypassing WAF rules that only match the raw path string. The deployment of JSP web shells across dozens of systems has been confirmed, alongside reports of fileless command execution and the post-intrusion deployment of remote access tools (SIDEEYE, Neo-reGeorg, and MeshAgent).

3. Attack Flow

The following is an overview of the attack path based on public reporting. Not all tools or stages were necessarily executed sequentially in every victim organization.

Attack Path and Tool Comparison

Common Stage: WAF Bypass via URL Encoding and Verification of Exploitability

1. Sending Crafted Requests: The attacker sends POST requests containing serialized Java objects to /%50SEMHUB/hub (typically 5 to 15 times) against unpatched PeopleSoft environments.
2. WAF Evasion and Backend Delivery: WAF rules that only match the literal string /PSEMHUB/ fail to detect this encoding. Meanwhile, the backend WebLogic performs URL decoding before processing, allowing the request to reach the vulnerable Environment Management Hub (EMHub) feature successfully.
3. Verifying Exploitability: The attacker checks the returned operating system information to assess exploitability. Some probed hosts showed no observed follow-on activity.

Attack Path A: Web Shell Deployment

1. Dropping JSPs: Exploits pre-authentication RCE to place web shells such as x.jsp onto the file system. Repeated deployment of sequential JSPs has also been observed. Mandiant assesses this behavior as an attempt to propagate files to nodes behind load balancers.
2. Executing Arbitrary Commands: Sends HTTP requests to the deployed web shell to execute OS commands and use them as a foothold for continued access.

Attack Path B: Fileless Execution

1. Execution without JSP Web Shells: Commands execute through shell processes spawned by WebLogic without first deploying a JSP web shell.
2. Returning Responses: Execution results are included in the body of the HTTP response. This technique avoids file-based detection on disk.

Post-Intrusion Tool Deployment (Observed Variations)

• Windows Environments (SIDEEYE): Uses u.jsp and u2.jsp for segmented uploads to construct Ple64.exe. SIDEEYE is deployed into memory from a modified, valid EV-signed malicious file based on the Light Alloy installer. Credential theft and reverse proxy capabilities have been confirmed through analysis, while execution and successful theft on individual hosts must be verified separately.
• Establishing Tunnels (Neo-reGeorg): Deploys a SOCKS proxy using HTTP(S) as a relay protocol to reach internal systems through permitted HTTP(S) connections, subject to the compromised host’s network access.
• Linux Environments (MeshAgent): Deploys the open-source remote management tool MeshAgent to maintain independent remote access sessions.

4. Attacker Positioning and Execution Location

• Attacker Positioning: External to the network, such as the internet. Prior authentication and valid accounts are entirely unnecessary.
• Execution Location and Privileges: Command execution occurs under the privileges of the OS account running the PeopleSoft (WebLogic) service. Mandiant's investigation confirmed root or NT AUTHORITY\SYSTEM privileges in some environments, but this observation alone does not imply privilege escalation via the vulnerability. Verify the service account and the actual command execution privileges.

5. Victim and Administrator Perspective

Victims

• General users of PeopleSoft Internet Architecture (PIA) may not experience visual anomalies in their browsers and may remain unaware of the compromise.

Administrators

• Access Logs: Encoded URIs containing /%50SEMHUB/, unknown JSP files under web-accessible directories, and rapid bursts of sequential POST requests are recorded.
• Process and Endpoint: Process trees where Java processes spawn cmd.exe or /bin/sh, suspicious binaries such as Ple64.exe, and persistent MeshAgent processes are observed.
• Important Note: Relying solely on WAF block logs risks overlooking actual malicious requests that bypassed detection via encoding.

6. Success and Failure Conditions

Success Conditions

• Vulnerability Presence: An unpatched version of Oracle PeopleTools 8.61 or 8.62 is running, and the PSEMHUB / EMHub endpoints are network-accessible to the attacker.
• Observed WAF Bypass Conditions: A discrepancy exists between raw URI pattern-matching blocks and WebLogic URL decoding behavior, allowing requests to pass. This is not a strict prerequisite for the vulnerability itself; unpatched handlers reachable without a WAF remain targets.
• Conditions for Data Access and Lateral Movement: Further data access or lateral movement depends on the service account’s permissions and network reachability.

Failure Conditions and Risk Mitigation

• Applying Vendor Patches: Apply the security patch for CVE-2026-35273 published by Oracle. Verify that the installed patch level includes the CVE fix specified in Oracle’s Patch Availability Document; the version family alone is insufficient.
• Disabling EMHub Features: Disable EMHub according to Oracle's instructions if unnecessary for operations (e.g., disabling EMHub in multi-server configurations or undeploying the PSEMHUB application in single-server configurations).
• Network Access Control: Restrict access to management features and PSEMHUB exclusively to internal management networks or specific IPs, blocking direct internet access.
• Least Privilege and Outbound Traffic Restrictions: Minimize permissions for the PeopleSoft execution user and block unnecessary outbound traffic from servers (especially TCP/3333 and 3334 or unknown destinations) via firewalls.

7. What Happens Upon Success

• Attackers gain the ability to execute arbitrary OS commands on the PeopleSoft server.
• The deployment of JSP web shells can establish a foothold for persistent access.
• SIDEEYE supports credential theft and reverse proxying, while Neo-reGeorg provides SOCKS tunneling over HTTP(S). Whether lateral movement or data theft succeeded in individual victim environments requires separate corroboration.
• Confidential data such as HR, payroll, and financial information, alongside database connection details (e.g., psappsrv.cfg), risk being stolen.

8. Observable Logs

Primary log types and key focus areas when investigating an organization's environment. Available logs depend on system configuration and auditing settings.

• Email: Email usage as an initial intrusion vector has not been reported.
• Proxy / SWG / DNS: Check access logs from web servers, reverse proxies, and WAFs for access to /%50SEMHUB/hub or suspicious JSPs (x.jsp, u.jsp, etc.). It is necessary to verify whether raw URIs or normalized URIs are recorded. Note that DNS logs do not contain URI paths or POST body contents.
• Endpoint / EDR: Investigate launch events for cmd.exe, powershell.exe, or /bin/sh parented by the Java process (WebLogic), file creation under web-accessible directories, and execution history for Ple64.exe or MeshAgent.
• Identity / IdP: Track suspicious login attempts or API calls involving PeopleSoft administrator accounts, database accounts, or cloud service accounts stored on the server.
• SaaS / Cloud: Check database audit logs and application logs for large-scale data queries, export operations, or privilege modification events.
• Network: Investigate communications destined for ports observed in SIDEEYE activity (TCP/3333, 3334), long-lived sessions to suspicious external IP addresses, and large data transfers outbound (SSH, rsync, HTTP POST, etc.).

9. Attack Success Determination

Confirmed in Public Reporting

• Post-Intrusion Confirmed: Mandiant's incident response confirmed the deployment of JSP web shells across dozens of systems. Specific post-intrusion activities were also identified, including fileless command execution, in-memory deployment of SIDEEYE, tunnel construction via Neo-reGeorg, and the use of MeshAgent on Linux. (Scope: Real-world victim environments investigated by Mandiant)

Criteria for Internal Assessment

• Attack Attempt Observed (Success Unconfirmed): Suspicious requests received without evidence of responses, processes, or file creation confirming execution. HTTP 4xx/5xx status codes alone do not prove failed execution, and the absence of logs does not prove an uncompromised state.
• Initial Execution Confirmed: Execution verified through corresponding command output from requests or shells spawned by Java. An HTTP 200 response is neither a necessary nor sufficient condition. Distinguish between verifying exploitability and subsequent compromises.
• Information Theft or Session Compromise Confirmed: Verified unauthorized access to information, acquired contents, exfiltration, or unauthorized use of credentials. Large data volumes alone do not confirm transmission contents or successful theft. Evaluate the mere presence of web shell files separately from the exfiltration of sensitive data to external entities.

10. Investigation Playbook

Recommended procedures for incident investigation and response within your organization:

• Investigation Origin: Detection of access to /%50SEMHUB/, alerts for suspicious child processes spawned by Java processes, detection of unknown JSPs under web directories, or communications with published IoCs.
• Initial Verification: Verify the exact patch level of running PeopleTools, the internet exposure status of PSEMHUB, and WAF URL decoding and normalization specifications. If load balancers are used, create a comprehensive list of all backend nodes.
• Endpoint and Server Investigation: Comprehensively preserve and investigate WebLogic access logs, EDR process trees, and file modification timestamps and hashes under PSEMHUB and PORTAL across all nodes behind load balancers.
• Authentication and Credential Investigation: Identify database connection credentials, service accounts, and cloud access keys that may have been read from configuration files (psappsrv.cfg, etc.) or memory on the server.
• Tracking Subsequent Activity: Trace internal SOCKS connections using Neo-reGeorg, authentication attempts against other hosts, database dump creation, and suspicious outbound communications destined for external C2 servers.
• Containment and Eradication: Immediately isolate suspected compromised hosts from the network and preserve forensic evidence. Apply vendor patches or completely disable EMHub, and rotate all credentials that may have been exposed.
• Determination Categories: Clearly distinguish and record each phase: request arrival, verification of exploitability, command execution, web shell persistence, internal lateral movement, and data exfiltration.

11. Defense and Detection Ideas

• Single Event: Detect requests resolving to PSEMHUB after URL decoding, shells (cmd.exe, sh, etc.) spawned by WebLogic (Java) processes, and new JSP file creation in web-accessible directories.
• Time-Series Correlation: Correlate POST requests destined for PSEMHUB with Java child process creation and responses. While web shell deployment involves new JSP creation and subsequent access, fileless execution does not require JSP creation as a mandatory condition.
• Threat Hunting: Retroactively scan all historical logs for PSEMHUB requests containing mixed case or encoded representations, sequentially named JSP files, SIDEEYE-related hashes, and MeshAgent execution records.
• Considerations for Log Limitations: When only normalized URIs are retained, the original encoding expression is lost. If only raw URIs remain, search while accounting for decoded paths. Additionally, this execution path does not require a web shell file, although logs and other forensic artifacts may remain; process command-line and memory monitoring logs are essential.
• Priority Mitigations: Prioritize applying official Oracle patches, stopping public exposure of unnecessary EMHub endpoints, reducing privileges for PeopleSoft service accounts, and restricting outbound communication from servers.

12. Facts / Inference / Hypothesis

Facts

• Mandiant (Google Threat Intelligence Group) reported that UNC6240 (ShinyHunters) launched attacks against unpatched PeopleSoft installations using the URL-encoded expression /%50SEMHUB/.
• This technique exploits the discrepancy between URL normalization specifications in backend web servers and certain WAF rules that perform simple string matching (/PSEMHUB/) on raw request URIs, successfully bypassing the WAF while WebLogic decodes the path and routes it to the correct internal handler.
• Initial observed requests typically consist of 5 to 15 POST requests containing serialized Java objects, which retrieve OS information responses to verify exploitability.
• Mandiant confirmed the deployment of JSP web shells (x.jsp, sequential JSPs, etc.) across dozens of systems in real-world environments. Fileless execution paths, returning command results in HTTP responses without writing files to disk, were also confirmed.
• In Windows environments, the malicious file Ple64.exe—a modified Light Alloy installer—was signed with a valid EV code-signing certificate, and SIDEEYE was deployed into memory. SIDEEYE features credential theft, process and file manipulation, reverse shell, and reverse proxy capabilities.
• The use of MeshAgent in Linux environments and the establishment of SOCKS tunnels via HTTP(S) using Neo-reGeorg were also reported.
• Oracle published a security alert for CVE-2026-35273 on June 10, 2026, with a CVSS 3.1 base score of 9.8 (Critical), affecting PeopleTools 8.61 and 8.62.

Inference

• Because signature-based WAF blocking carries a perpetual risk of being bypassed due to differences in URL normalization specifications between the WAF and backend web servers, it cannot serve as a substitute for fundamental vendor patches or network access controls.
• Depending on load-balancer routing, web shells may be present on only some backend nodes, so all nodes should be investigated.

Hypothesis

No additional hypotheses. Unverified items are documented in "14. Unknowns and Additional Investigation."

13. MITRE ATT&CK Mapping

14. Unknowns and Additional Investigation

• The exact count of hosts among the dozens with deployed web shells that progressed to actual exfiltration of sensitive data or lateral movement into other internal systems.
• The specific types and scale of data exfiltrated in each victim organization.
• The presence of unknown C2 infrastructure or additional persistence mechanisms not documented in public reports.

15. Impact on SOCs and Organizations

Japanese organizations utilizing PeopleSoft for core operations such as HR, payroll, and financials must also verify their target environments. This incident clearly demonstrates that even with WAFs deployed, discrepancies in URL normalization processing can allow severe vulnerabilities (CVSS 9.8) to be exploited. Organizations operating PeopleSoft should not rely excessively on WAF defenses, must verify the application status of official patches, and must block direct internet access to PSEMHUB functions. Furthermore, in cases of suspected compromise, investigations should not be limited to a single node; thorough forensic analysis of files and processes must be conducted across all servers in load-balanced environments.

16. Summary by Role

• For SOCs: Monitor and correlate requests destined for PSEMHUB (especially those containing encoded expressions like %50), shell execution from WebLogic processes, new JSPs in web-accessible areas, and suspicious outbound traffic such as TCP/3333 and 3334.
• For Administrators: Apply official Oracle patches and check the PAD for your running PeopleTools version family. Disable unnecessary EMHub features, and restrict management port access to internal networks. If compromise is suspected, inspect all nodes and immediately rotate potentially exposed credentials.
• For Users: Because this attack executes directly on the server side, it does not originate from general user browser actions. Patch application and access control enhancements by system management and operations personnel are required.