Google Issues Global Warning Over Mass Exploitation of Critical Oracle PeopleSoft Vulnerability

Cybersecurity researchers at Google’s Mandiant division have issued an urgent warning regarding a renewed and sophisticated campaign of mass exploitation targeting a critical security vulnerability in Oracle PeopleSoft. The campaign, which has been linked to the notorious threat actor group known as ShinyHunters, is currently impacting a wide array of sectors across the globe, with a particular focus on organizations within the United States.

The activity centers on the weaponization of CVE-2026-35273, a critical security flaw that carries a near-perfect CVSS score of 9.8. This vulnerability allows for unauthenticated remote code execution, effectively granting attackers the ability to take full control of a vulnerable system without needing valid login credentials. While the flaw was initially identified and patched earlier this year, the latest intelligence suggests that the threat actor, tracked by Mandiant as UNC6240, has refined its methods to bypass existing security perimeters.

The Evolution of the Exploitation Campaign

The history of CVE-2026-35273 is a testament to the persistence of modern threat actors. The vulnerability was first observed in the wild as a zero-day exploit in June 2026. During that initial phase, the attackers focused primarily on academic institutions. Their objective was clear: perform deep reconnaissance within university networks, deploy remote access software for long-term persistence, and move laterally across the infrastructure to identify and exfiltrate sensitive data.

At the time of the initial discovery, Mandiant initiated a massive notification effort, reaching out to more than 100 organizations globally whose IP addresses were identified as vulnerable endpoints. The majority of these targets were located in the United States, highlighting the domestic focus of the early campaign.

However, the threat has since evolved. The current wave of activity is characterized by a significant tactical shift. According to Mandiant’s latest findings, UNC6240 has modified its exploit payloads specifically to circumvent Web Application Firewall (WAF) rules that were designed to protect the vulnerable Environment Management Hub (PSEMHUB) endpoint.

The mechanics of this bypass are deceptively simple yet highly effective. The threat actor discovered that many WAF and reverse proxy configurations rely on literal string matching to block suspicious requests. By URL-encoding a single character in the request path—requesting "/%50SEMHUB/" instead of the literal "/PSEMHUB/"—the attackers are able to slip past security filters. While the WAF sees a non-matching string and allows the traffic through, the underlying Oracle PeopleSoft application server decodes the request and routes it directly to the vulnerable servlet, triggering the exploit.

Tactics, Techniques, and Procedures of UNC6240

The current campaign is not merely a series of isolated probes but a coordinated effort to gain deep-seated access to corporate and governmental networks. Once the vulnerability is successfully exploited, the attackers deploy a variety of tools to ensure they maintain their foothold.

Among the primary tools identified in this campaign is "Ple64.exe," alongside the open-source Neo-reGeorg tunneling toolkit. Neo-reGeorg is frequently used by sophisticated actors to create SOCKS proxies, allowing them to tunnel traffic into a compromised network and bypass traditional firewall restrictions. To establish persistent access on Linux-based systems, UNC6240 has been observed deploying MeshAgent, a legitimate remote monitoring and management (RMM) tool. By using legitimate software for malicious purposes—a tactic known as "living off the land"—attackers can often evade detection by traditional antivirus and endpoint detection systems.

The level of access obtained by the group is particularly alarming. Google’s analysis indicates that approximately one-quarter of the commands executed by the threat actor were run with the highest possible privileges, such as "root" on Linux or "NT AuthoritySYSTEM" on Windows. This grants the attackers total control over the operating system. The remaining commands were typically executed under the service accounts for PeopleSoft or WebLogic, which still provide significant latitude for data theft and internal movement.

The scope of the targeting has also expanded significantly since the June 2026 zero-day attacks. While higher education remains a primary target, the latest activity has been observed hitting the technology sector, IT services, healthcare, agriculture, transportation, and various government agencies. In dozens of confirmed cases, the attackers have successfully deployed web shells, which serve as permanent backdoors for future access.

The ShinyHunters Connection and the FBI Breach

The resurgence of PeopleSoft exploitation coincides with a high-profile confrontation between the ShinyHunters group and U.S. federal law enforcement. Recently, the group claimed responsibility for a massive breach of the Federal Bureau of Investigation’s FBIJobs.gov portal. As of late September 2026, the portal remains inaccessible to the public.

ShinyHunters claims to have exfiltrated between two and three terabytes of sensitive data from the FBI’s systems. However, in a surprising turn, a spokesperson for the group stated that the attack was not motivated by financial gain. Instead, the group claims the breach was a direct response to a May 2026 alert issued by the FBI, which they believe unfairly tarnished their reputation.

"We want to reiterate and emphasize that we are NOT extorting the FBI," a ShinyHunters spokesperson told The Hacker News. "This is NOT financially motivated. This is NOT a ransom or extortion. All we seek to do is set the record straight and protect the image of our organization."

Interestingly, the group asserts that the FBI portal was breached using a different zero-day vulnerability within Oracle PeopleSoft, distinct from the CVE-2026-35273 flaw currently being mass-exploited. This suggests that the group may possess a sophisticated research capability, allowing them to maintain a stockpile of undisclosed vulnerabilities in widely used enterprise software.

The group also provided insight into their history, confirming that they originally operated under the name GnosticPlayers before rebranding to ShinyHunters in 2020. This lineage connects them to some of the most significant data breaches of the last decade, reinforcing their status as a tier-one threat to global enterprises.

The Extortion Model and Risk to Organizations

Despite the group’s claims regarding the FBI breach, their standard operating procedure remains rooted in data theft and extortion. UNC6240 has a well-documented history of stealing sensitive corporate data and threatening to publish it on dedicated leak sites unless a ransom is paid.

The mass exploitation of Oracle PeopleSoft is particularly dangerous because these systems often serve as the "brain" of an organization. PeopleSoft environments typically house Enterprise Resource Planning (ERP) data, including human resources records, financial data, student information, and proprietary business processes. A successful compromise can lead to the exposure of Social Security numbers, banking details, and sensitive intellectual property.

Google and Mandiant have advised that affected organizations should not only focus on the technical aspects of the breach but also prepare for the eventual phase of extortion communications. Monitoring for potential public exposure of stolen data on dark web forums and leak sites is now a critical component of the incident response process for any entity running PeopleSoft.

Mitigation and Defensive Recommendations

To counter the ongoing threat, cybersecurity experts are urging organizations to take immediate action. The primary defense remains the application of the official security patches provided by Oracle. However, given the attackers’ ability to bypass WAFs and establish persistence, patching alone may not be sufficient for organizations that have already been targeted.

Security teams are encouraged to perform a thorough audit of their PeopleSoft environments. This includes inspecting the "/PSEMHUB/" and "/%50SEMHUB/" endpoints for unauthorized access logs. Furthermore, organizations should scan their systems for the presence of known indicators of compromise, such as the Neo-reGeorg toolkit, MeshAgent installations that were not authorized by IT, and the Ple64.exe binary.

Mandiant also recommends that organizations review their WAF configurations to ensure they are decoding URL-encoded characters before applying matching rules. If a WAF only inspects the raw request string, it will remain vulnerable to the character-encoding bypass used by UNC6240.

As the campaign continues to unfold, the collaboration between private security firms like Google Mandiant and the broader IT community remains essential. With a highly capable adversary like ShinyHunters actively seeking out vulnerable ERP systems, the window for remediation is closing fast for organizations that have yet to secure their infrastructure.