Google Issues Global Warning Over Mass Exploitation of Critical Oracle PeopleSoft Vulnerability

Cybersecurity researchers at Google’s Mandiant division have issued an urgent warning regarding a renewed and sophisticated campaign of mass exploitation targeting a critical security vulnerability in Oracle PeopleSoft. The campaign, which has been linked to the notorious threat actor group known as ShinyHunters, is currently impacting a wide array of sectors across the globe, with a particular focus on organizations within the United States.

The activity centers on the weaponization of CVE-2026-35273, a critical security flaw that carries a near-perfect CVSS score of 9.8. This vulnerability allows for unauthenticated remote code execution, effectively granting attackers the ability to take full control of a vulnerable system without needing valid login credentials. While the flaw was initially identified and patched earlier this year, the latest intelligence suggests that the threat actor, tracked by Mandiant as UNC6240, has refined its methods to bypass existing security perimeters.

The Evolution of the Exploitation Campaign

The history of CVE-2026-35273 is a testament to the persistence of modern threat actors. The vulnerability was first observed in the wild as a zero-day exploit in June 2026. During that initial phase, the attackers focused primarily on academic institutions. Their objective was clear: perform deep reconnaissance within university networks, deploy remote access software for long-term persistence, and move laterally across the infrastructure to identify and exfiltrate sensitive data.

At the time of the initial discovery, Mandiant initiated a massive notification effort, reaching out to more than 100 organizations globally whose IP addresses were identified as vulnerable endpoints. The majority of these targets were located in the United States, highlighting the domestic focus of the early campaign.

However, the threat has since evolved. The current wave of activity is characterized by a significant tactical shift. According to Mandiant’s latest findings, UNC6240 has modified its exploit payloads specifically to circumvent Web Application Firewall (WAF) rules that were designed to protect the vulnerable Environment Management Hub (PSEMHUB) endpoint.

The mechanics of this bypass are deceptively simple yet highly effective. The threat actor discovered that many WAF and reverse proxy configurations rely on literal string matching to block suspicious requests. By URL-encoding a single character in the request path—requesting "/%50SEMHUB/" instead of the literal "/PSEMHUB/"—the attackers are able to slip past security filters. While the WAF sees a non-matching string and allows the traffic through, the underlying Oracle PeopleSoft application server decodes the request and routes it directly to the vulnerable servlet, triggering the exploit.

Tactics, Techniques, and Procedures of UNC6240

The current campaign is not merely a series of isolated probes but a coordinated effort to gain deep-seated access to corporate and governmental networks. Once the vulnerability is successfully exploited, the attackers deploy a variety of tools to ensure they maintain their foothold.

Among the primary tools identified in this campaign is "Ple64.exe," alongside the open-source Neo-reGeorg tunneling toolkit. Neo-reGeorg is frequently used by sophisticated actors to create SOCKS proxies, allowing them to tunnel traffic into a compromised network and bypass traditional firewall restrictions. To establish persistent access on Linux-based systems, UNC6240 has been observed deploying MeshAgent, a legitimate remote monitoring and management (RMM) tool. By using legitimate software for malicious purposes—a tactic known as "living off the land"—attackers can often evade detection by traditional antivirus and endpoint detection systems.