ShinyHunters Beat the PeopleSoft Fix With One Trick
The extortion group ShinyHunters resumed widespread attacks on Oracle PeopleSoft servers by URL-encoding a single character — enough to slip past the web application firewall rules many organizations deployed instead of patching, according to Mandiant.
Key facts
The vulnerability: CVE-2026-35273, a critical unauthenticated flaw in Oracle PeopleSoft's Environment Management component (PSEMHUB)
The patch: Oracle released it June 10, 2026, with an explicit warning that firewall rules alone were insufficient
The bypass: ShinyHunters modified its exploit to URL-encode a character, defeating firewall rules while unpatched servers processed the request normally
Who's affected: Mandiant observed compromised PeopleSoft systems across higher education, technology, healthcare, agriculture, transportation and government globally
FBI status: The bureau's applicant portals at apply.fbijobs.gov and fbijobs.gov/special-agents remain offline
What exactly did the attackers do?
They found the gap between mitigating a vulnerability and fixing it.
A web application firewall, or WAF, sits in front of a server and blocks requests matching known attack patterns. After CVE-2026-35273 was disclosed, some organizations applied Oracle's patch. Others wrote a firewall rule blocking the known attack string and moved on.
ShinyHunters then encoded one character in the request differently. The firewall rule no longer recognized the string as an attack; the unpatched server behind it processed the request exactly as before.
Every organization that had patched was protected. Every organization that had relied only on the firewall rule was exposed.
Mandiant had warned about precisely this when it first documented the flaw, stating that relying solely on WAF body-inspection rules is insufficient because those controls can be bypassed. Oracle's own advisory carried the same warning.
What happened to the FBI?
The FBI confirmed on September 22 that it was investigating unauthorized activity on FBIJobs.gov after its Special Agent Applicant Portal went offline. ShinyHunters defaced apply.fbijobs.gov the same day.
The group told reporters it used a PeopleSoft remote code execution flaw to gain access before pivoting to AWS GovCloud servers, and claims to have taken two to three terabytes of data on current employees, former employees and job applicants.
An important distinction: it is not publicly established whether the FBI intrusion used CVE-2026-35273 or a genuinely new, unpatched flaw. ShinyHunters describes it as a separate zero-day. No CVE has been assigned to an FBI-specific PeopleSoft vulnerability, and none has appeared in CISA's Known Exploited Vulnerabilities catalog.
ShinyHunters provided roughly 5,000 records to journalists at Nextgov/FCW, who verified them. The bureau has confirmed only that it is investigating and has not stated the scope of what was taken.
The group framed the attack as retaliation for an FBI advisory published in May 2026 describing its tactics, demanding the bureau correct or remove it — a demand rather than a ransom.
What should organizations running PeopleSoft do?
Apply Oracle's patch for CVE-2026-35273, available since June 10. If you deployed a firewall rule instead, you are not protected — treat the system as potentially compromised and investigate rather than simply patching now.
Where possible, keep PeopleSoft login and application portals off the open internet, behind a VPN or zero-trust proxy.
The lesson beyond PeopleSoft
Mitigations buy time; patches fix problems. A firewall rule blocks a known attack string, and attack strings can be rewritten. When a vendor explicitly says a workaround is insufficient, that sentence is the whole advisory.
The second lesson is about which systems count as critical. HR platforms and recruitment portals rarely appear on a security team's priority list, yet they hold names, home addresses, Social Security numbers and family details — and in this campaign, they were the way in.
Sources: Help Net Security; BleepingComputer; Infosecurity Magazine.