Live
Hardening GitOps Pipelines for AI‑Driven Change SafetyIntegrating Meta’s Muse Ember: Cost‑Effective Multimodal Model for Agentic TasksFable 5.2 coding performance boost and pricing shift: what engineers need to knowMulti‑Agent LLM Batch Pipelines Cut Walmart’s Cloud Inference Spend Ten‑foldDeploying NVIDIA Nemotron 3.5 Super VL on SageMaker JumpStart: Practical Implications for EngineersUsing the Rust Flagship SDK for Feature Flag Evaluation in Async ServicesDeploying Open‑Weight Models on Kubernetes with the New AI‑Native StackClaude Fable 5.2 on Amazon Bedrock: Implications for Engineering and OperationsHardening GitOps Pipelines for AI‑Driven Change SafetyIntegrating Meta’s Muse Ember: Cost‑Effective Multimodal Model for Agentic TasksFable 5.2 coding performance boost and pricing shift: what engineers need to knowMulti‑Agent LLM Batch Pipelines Cut Walmart’s Cloud Inference Spend Ten‑foldDeploying NVIDIA Nemotron 3.5 Super VL on SageMaker JumpStart: Practical Implications for EngineersUsing the Rust Flagship SDK for Feature Flag Evaluation in Async ServicesDeploying Open‑Weight Models on Kubernetes with the New AI‑Native StackClaude Fable 5.2 on Amazon Bedrock: Implications for Engineering and Operations
Google Cloud

PeopleSoft CVE-2026-35273 Exploit Evades WAFs with URL-Encoded Path – Action Guide for Engineers

Ninja·September 26, 2026·2 min read·via Google Cloud Blog
AI SummaryPowered by AI

UNC6240 (ShinyHunters) has updated its exploitation of CVE-2026-35273 by sending a URL-encoded "%50" character in the request path to bypass literal-match WAF rules. The change re-exposes PeopleSoft deployments that relied on WAF blocking, forcing engineers to patch, disable the vulnerable service, and adjust monitoring.

UNC6240 (ShinyHunters) has altered its exploitation of CVE-2026-35273 by sending a URL‑encoded "%50" character in the request path, turning /PSEMHUB/ into /%50SEMHUB/. This subtle change lets the request slip past many web‑application firewalls that match the literal string before decoding, while the PeopleSoft server decodes the path and reaches the vulnerable servlet. Engineers who rely on WAFs as the primary mitigation for PeopleSoft deployments must treat the change as a direct exposure.

Exploit Modification and WAF Bypass

The original attack targeted the Environment Management Hub endpoint (/PSEMHUB/) directly. By encoding the leading "P" as "%50", the attacker creates a path that looks different to the firewall but resolves to the same servlet after the PeopleSoft server decodes it. Because most WAF and reverse‑proxy rules perform string comparison before URL decoding, the rule that blocks /PSEMHUB/ no longer matches, allowing the exploit to reach vulnerable instances that were thought to be protected.

Immediate Remediation Steps

  1. Apply the Oracle Security Alert patch that addresses CVE-2026-35273. Patching remains the definitive fix; WAF rules are supplemental.
  2. In multi‑server PeopleSoft configurations, disable the Environment Management Hub (EMHub) service. In single‑server setups, remove the PSEMHUB application entirely, following Oracle’s security‑alert guidance.
  3. Search PeopleSoft WebLogic access logs for any request to /PSEMHUB/ or its percent‑encoded variants (e.g., /%50SEMHUB/). Pay special attention to POST requests to /hub and any .jsp files originating from external IP addresses.
  4. Inspect the directory <PS_CFG_HOME>/webserv/<domain>/applications/peoplesoft/PSEMHUB.war/ for unexpected files that may indicate a planted web shell.

Operational Implications

Beyond the immediate patch, the bypass highlights several operational considerations:

  • WAF rule design: Rules that rely on literal path matching can be evaded by simple URL‑encoding. Teams should evaluate whether their WAF can decode URLs before applying pattern checks, or add explicit decoding steps.
  • Log‑driven detection: The exploit generates distinct request patterns (/%50SEMHUB/, POST /hub, .jsp accesses). Integrating these signatures into SIEM queries improves early detection of compromised instances.
  • Service surface reduction: Disabling or removing the EMHub component reduces the attack surface, simplifying both patch management and monitoring.
  • Deployment pipelines: Automated build or container images that include the PSEMHUB.war should be audited to ensure the component is not unintentionally re‑introduced after removal.

Related CloudNinjas coverage: Google Cloud.

What This Means For Practitioners

Engineers should verify that all PeopleSoft environments are running the Oracle patch for CVE-2026-35273 and that the EMHub service is disabled where possible. Review WAF configurations to ensure URL decoding occurs before path matching, and add log‑analysis rules for the encoded request pattern. Finally, conduct a quick audit of the PSEMHUB.war directory for stray files that could indicate a web shell. Prompt action limits the window for attackers to leverage the newly exposed path.

Tags: #peoplesoft#vulnerability#waf#patching#incident-response
Originally published atGoogle Cloud Blog
Related Articles
GitHub

Actions workflow log scanning enters public preview on GitHub

3 min read
AWS

Enable cross‑partition access with AWS IAM outbound federation

4 min read
AWS

AWS Account Access Manager: Centralized Role Assignment for Engineers

4 min read