News Date: 2026-09-26
A renewed exploitation campaign targeting Oracle PeopleSoft demonstrates why a web application firewall cannot compensate for an unpatched enterprise application. Attackers linked to UNC6240 have reportedly modified requests for CVE-2026-35273 so they can bypass defensive rules that look only for the expected vulnerable endpoint.
Simple Encoding Defeats Literal Matching
The critical vulnerability can provide unauthenticated remote code execution through PeopleSoft's Environment Management Hub. Some organizations attempted to block access by creating WAF rules that matched the PSEMHUB path. The attackers responded by percent-encoding one character, sending requests to a path beginning with %50SEMHUB instead.
This works when a firewall evaluates the literal request before decoding it, while the application server decodes the value and routes it to the vulnerable component. The result is a dangerous difference in interpretation between the security layer and the protected application.
Reported targets span higher education, healthcare, government, technology, transportation, agriculture and IT services. Once inside, the attackers have deployed JSP web shells, uploaded additional payloads and used legitimate remote-management software for persistence. A backdoor associated with the campaign can support credential theft, file operations, reverse shells and proxy activity.
Immediate Defensive Priorities
- Apply Oracle's correction for CVE-2026-35273 without relying on WAF filtering alone.
- Disable the Environment Management Hub where it is not operationally required.
- Search access logs for normal and percent-encoded versions of the PSEMHUB path.
- Inspect the PSEMHUB application directory for unfamiliar JSP files.
- Rotate credentials accessible to PeopleSoft and WebLogic service accounts.
- Review database auditing for unusual exports involving payroll, HR or student information.
The Broader Security Failure
In my view, this campaign exposes a recurring weakness in compensating controls. A hastily written WAF rule may reduce automated scanning, but it is not equivalent to removing the vulnerable code. Attackers routinely test encoding differences, alternative path representations, case variations and proxy normalization behavior.
Organizations should validate what their firewall inspects after URL decoding and compare that behavior with the application server. More importantly, they should test whether blocking rules survive common evasion techniques before describing a system as protected.
PeopleSoft environments deserve particular attention because they often contain concentrated stores of employment, financial and identity data. If exploitation is suspected, incident response should extend beyond the web server to databases, connected application tiers, administrative credentials and downstream systems. Patching closes the entry point, but it does not remove web shells or access already established by an intruder.