Google has issued a warning regarding a widespread exploitation of a significant security flaw in Oracle PeopleSoft, affecting multiple sectors worldwide. This campaign, linked to the ShinyHunters group, leverages CVE-2026-35273, a vulnerability with a critical CVSS score of 9.8, enabling unauthorized remote code execution.
Global Impact of the Oracle PeopleSoft Exploit
The vulnerability, initially exploited as a zero-day, primarily targeted educational institutions, where attackers conducted reconnaissance, deployed remote access tools like MeshCentral, and exfiltrated data. Google’s Mandiant had alerted over 100 organizations globally about potential risks, with most affected entities based in the U.S.
The recent wave of attacks shows the involvement of threat actor UNC6240, who managed to bypass web application firewall (WAF) protections by URL-encoding characters in the request path. This manipulation allows the attackers to exploit the Environment Management Hub (PSEMHUB) endpoint, circumventing defenses designed to block such intrusions.
Methodology of the Exploitation
The attackers targeted several sectors, including technology, healthcare, and government, deploying web shells across numerous systems. The attack sequence involved identifying vulnerable targets via POST requests containing serialized Java objects and bypassing WAFs using encoded characters.
Once through the defenses, the attackers exploited Java deserialization vulnerabilities to deploy web shells and execute commands without detection. They planted two JSP web shells in critical directories to facilitate cross-platform commands and upload tools like the trojanized installer Ple64.exe, which introduced a C++ backdoor for credential theft and system control.
Preventive Measures and Future Outlook
To mitigate this threat, organizations are urged to patch the CVE-2026-35273 vulnerability promptly, disable or remove the vulnerable services, and scrutinize access logs for anomalous activity. Further, they should inspect directories for malicious files, rotate credentials, and monitor network traffic for unusual patterns.
Google highlights the pattern of extortion by UNC6240, emphasizing the need for vigilance against data theft and potential public data exposure. Recent incidents, such as the breach of FBIJobs.gov, underscore the group’s continued attempts to exploit vulnerabilities, although they deny financial motives.
As cyber threats evolve, organizations must remain proactive in strengthening their defenses to protect sensitive data and prevent unauthorized access, underscoring the importance of continuous monitoring and timely updates to security protocols.
