PeopleSoft CVE-2026-35273 Exploit Evades WAFs with URL-Encoded Path – Action Guide for Engineers

UNC6240 (ShinyHunters) has altered its exploitation of CVE-2026-35273 by sending a URL‑encoded "%50" character in the request path, turning /PSEMHUB/ into /%50SEMHUB/. This subtle change lets the request slip past many web‑application firewalls that match the literal string before decoding, while the PeopleSoft server decodes the path and reaches the vulnerable servlet. Engineers who rely on WAFs as the primary mitigation for PeopleSoft deployments must treat the change as a direct exposure.

Exploit Modification and WAF Bypass

The original attack targeted the Environment Management Hub endpoint (/PSEMHUB/) directly. By encoding the leading "P" as "%50", the attacker creates a path that looks different to the firewall but resolves to the same servlet after the PeopleSoft server decodes it. Because most WAF and reverse‑proxy rules perform string comparison before URL decoding, the rule that blocks /PSEMHUB/ no longer matches, allowing the exploit to reach vulnerable instances that were thought to be protected.

Immediate Remediation Steps

1. Apply the Oracle Security Alert patch that addresses CVE-2026-35273. Patching remains the definitive fix; WAF rules are supplemental.
2. In multi‑server PeopleSoft configurations, disable the Environment Management Hub (EMHub) service. In single‑server setups, remove the PSEMHUB application entirely, following Oracle’s security‑alert guidance.
3. Search PeopleSoft WebLogic access logs for any request to /PSEMHUB/ or its percent‑encoded variants (e.g., /%50SEMHUB/). Pay special attention to POST requests to /hub and any .jsp files originating from external IP addresses.
4. Inspect the directory <PS_CFG_HOME>/webserv/<domain>/applications/peoplesoft/PSEMHUB.war/ for unexpected files that may indicate a planted web shell.

Operational Implications

Beyond the immediate patch, the bypass highlights several operational considerations:

• WAF rule design: Rules that rely on literal path matching can be evaded by simple URL‑encoding. Teams should evaluate whether their WAF can decode URLs before applying pattern checks, or add explicit decoding steps.
• Log‑driven detection: The exploit generates distinct request patterns (/%50SEMHUB/, POST /hub, .jsp accesses). Integrating these signatures into SIEM queries improves early detection of compromised instances.
• Service surface reduction: Disabling or removing the EMHub component reduces the attack surface, simplifying both patch management and monitoring.
• Deployment pipelines: Automated build or container images that include the PSEMHUB.war should be audited to ensure the component is not unintentionally re‑introduced after removal.

Related CloudNinjas coverage: Google Cloud.

What This Means For Practitioners

Engineers should verify that all PeopleSoft environments are running the Oracle patch for CVE-2026-35273 and that the EMHub service is disabled where possible. Review WAF configurations to ensure URL decoding occurs before path matching, and add log‑analysis rules for the encoded request pattern. Finally, conduct a quick audit of the PSEMHUB.war directory for stray files that could indicate a web shell. Prompt action limits the window for attackers to leverage the newly exposed path.