WAF Bypass Enables PeopleSoft Exploit, Web Shells Deployed

Attackers are actively exploiting a critical vulnerability in the PeopleSoft enterprise suite by slipping past web application firewalls with a simple but effective encoding trick. Google’s Mandiant team warns that the campaign, linked to the ShinyHunters group, is hitting multiple sectors globally after the threat actor tweaked its exploit to bypass string‑based WAF rules. The technique replaces a single letter in the request path, letting malicious traffic reach the vulnerable application while many firewalls miss it entirely.

The vulnerability at the centre of these attacks is CVE‑2026‑35273, a critical flaw with a CVSS score of 9.8 that allows unauthenticated remote code execution. It was first used as a zero‑day against academic institutions, where intruders conducted reconnaissance, deployed the MeshCentral agent for persistence, moved laterally over SSH and stole data. Mandiant had already notified more than 100 organisations worldwide, mostly in the United States, that their PeopleSoft endpoints were reachable from the internet.

In the new wave, the attackers simply URL‑encode the letter “P” as “%50” in the request path, so the targeted endpoint becomes “/%50SEMHUB/” instead of “/PSEMHUB/”. Many WAFs and reverse proxy rules inspect the literal path before any decoding takes place, while the PeopleSoft application server decodes the URL and routes it straight to the vulnerable Environment Management Hub servlet. This tiny modification lets the exploit go unnoticed by defences that were patched to block the original path.

The attack chain begins with a POST request to “/%50SEMHUB/hub” containing a serialised Java object. By abusing Java deserialisation in the hub servlet, the attackers achieve fileless command execution and then drop two JSP web shells into the PSEMHUB.war directory. The shell “x.jsp” delivers cross‑platform command execution, while “u.jsp” enables chunked file uploads and command execution through the Windows command processor. Using “u.jsp”, the group uploads a signed, trojanised installer called “Ple64.exe”, which loads a C++ backdoor named SIDEEYE in memory. SIDEEYE connects to an external server over TCP, stealing browser and desktop application credentials, managing files and processes, and providing an interactive reverse shell and reverse proxy. On Linux hosts, the attackers also stage the open‑source Neo‑reGeorg tunnelling toolkit and deploy the legitimate remote monitoring tool MeshAgent to maintain persistent access.

Mandiant says about a quarter of the commands it observed ran with root or NT Authority\SYSTEM privileges, giving the intruders full control over the operating system. The remaining commands executed under PeopleSoft or WebLogic service accounts. The targets span higher education, technology, IT services, healthcare, agriculture, transport and government, with web shells placed on dozens of systems worldwide. The team warns that UNC6240 – the Mandiant designation for the actor – has a well‑established pattern of data theft extortion, stealing sensitive information and threatening to leak it unless a ransom is paid. This campaign is likely to be followed by extortion communications, so affected organisations should prepare for that and monitor for public exposure of stolen data.

The broader context includes a separate incident where the ShinyHunters group claims to have broken into the FBI’s FBIJobs.gov portal using a different, unpatched PeopleSoft zero‑day and stolen 2–3 terabytes of data. The group insists the breach is not financially motivated and was carried out solely to correct what it calls false allegations made by the FBI. While that incident is unrelated to the ongoing WAF‑bypass campaign, it underscores how aggressively the actor is targeting PeopleSoft environments.

To defend against this campaign, organisations should apply the vendor’s patch for CVE‑2026‑35273 immediately. They should also disable the Environment Management Hub service in multi‑server setups or remove the PSEMHUB application entirely in single‑server configurations. Logs must be searched for any request containing “/PSEMHUB/” and its percent‑encoded variants, and the PSEMHUB.war directory inspected for unknown JSP files. Credentials accessible to the PeopleSoft service account should be rotated, and database audit logs reviewed for bulk queries against HR or student records. Outbound traffic from PeopleSoft hosts needs close monitoring. For website owners and IT teams running any online application, this incident is a stark reminder that firewalls alone cannot stop determined attackers – layered defences and prompt patching are essential. Managed hosting environments like AEU Hosting provide built‑in security hardening that can shrink the attack surface, though nothing replaces timely vendor fixes for application‑level flaws like this one.