{"id":2047,"date":"2026-09-28T14:35:24","date_gmt":"2026-09-28T09:05:24","guid":{"rendered":"https:\/\/www.hexnode.com\/threat-watch\/?p=2047"},"modified":"2026-09-30T23:03:09","modified_gmt":"2026-09-30T17:33:09","slug":"peoplesoft-waf-bypass-lets-unc6240-reopen-a-critical-rce-campaign","status":"publish","type":"post","link":"https:\/\/www.hexnode.com\/threat-watch\/peoplesoft-waf-bypass-lets-unc6240-reopen-a-critical-rce-campaign\/","title":{"rendered":"PeopleSoft WAF Bypass Lets UNC6240 Reopen a Critical RCE Campaign"},"content":{"rendered":"

Attackers have renewed PeopleSoft exploitation by encoding one character in a request path. On September 25, Google Threat Intelligence Group and Mandiant attributed the campaign to UNC6240, tracked as ShinyHunters.<\/p>\n

For security teams investigating PeopleSoft web shell activity, the immediate question extends beyond whether a firewall blocked known requests. Teams must establish whether vulnerable systems remained reachable and whether attackers gained access before remediation.<\/p>\n

How the PeopleSoft web shell attack bypasses WAF rules<\/h2>\n

Oracle identifies CVE-2026-35273<\/a> as an unauthenticated remote code execution vulnerability affecting supported PeopleTools versions 8.61 and 8.62. Google reports a CVSS score of 9.8. Oracle published its security alert on June 10, 2026.<\/p>\n

The attackers request \/%50SEMHUB\/<\/code> instead of \/PSEMHUB\/<\/code>, encoding the letter P. Literal-path WAF rules can miss that representation, while the application server decodes it and reaches the same vulnerable endpoint.<\/p>\n

PSEMHUB runs within Oracle WebLogic Server. Google observed Java deserialization abuse in its hub servlet through two methods: JSP web shell deployment and fileless command execution. In the latter, WebLogic\u2019s Java process launches a command shell without creating a web shell file.<\/p>\n

Post-exploitation tools included SIDEEYE, Neo-reGeorg, and MeshAgent, supporting credential theft, tunneling, and persistent access. These findings make filesystem checks alone insufficient for assessing exposure.<\/p>\n

Treat the bypass as a failure in request filtering, rather than evidence that attackers defeated Oracle\u2019s patch. Validate patch installation independently from WAF configuration, and test how each defensive layer handles equivalent URL representations.<\/p>\n

\n
\n
\n
\n \"cybersecurity-kit\"\n <\/div>\n <\/div>\n
\n
\n Featured Resource\n <\/h5>\n

\n Cybersecurity kit\n <\/h4>\n

\n Access essential cybersecurity resources to strengthen security, reduce risk, and improve cyber resilience.\n <\/p>\n \n Download the Resource Kit\n \n \n \n \n <\/g>\n <\/svg>\n\n <\/a>\n <\/div>\n <\/div>\n <\/section>\n

Why application compromise demands a wider investigation<\/h2>\n

An application incident can involve more than the affected server. Google\u2019s earlier investigation documented internal reconnaissance, credential spraying, and stolen-data publication associated with the campaign. Attackers inspected PeopleSoft and WebLogic configuration files to understand the surrounding infrastructure.<\/p>\n

For incident responders, that history supports a broader assessment: identify which accounts, systems, and data the compromised application could reach. Review service-account privileges and administrative connections alongside the initial intrusion evidence.<\/p>\n

Coordinate application owners, security analysts, and identity administrators around one incident timeline. Record the exposure window, suspicious activity, containment decisions, and recovery milestones. This helps teams distinguish confirmed compromise from unresolved investigation gaps.<\/p>\n

Investigating PeopleSoft web shell exposure<\/h3>\n

Start with these response priorities:<\/p>\n

    \n
  1. Confirm remediation coverage.<\/strong> Inventory affected PeopleTools installations and apply Oracle\u2019s guidance. Oracle warns that unsupported releases may also contain the vulnerability; their absence from the supported-version table does not establish safety.<\/li>\n
  2. Preserve and review evidence.<\/strong> Examine WebLogic access logs and unexpected files in application directories. Google\u2019s guidance also calls for checking unauthorized staging content and suspicious XML changes.<\/li>\n
  3. Assess credential exposure.<\/strong> Identify secrets accessible from compromised systems. Coordinate credential replacement with containment so attackers cannot immediately capture replacement credentials.<\/li>\n
  4. Validate recovery.<\/strong> Assign owners to unresolved findings and document the evidence supporting service restoration. Keep monitoring after patch deployment instead of closing the incident solely because installation succeeded.<\/li>\n<\/ol>\n

    How Hexnode XDR supports endpoint response<\/h2>\n

    Hexnode XDR<\/a> can support investigation when suspicious activity reaches enrolled, supported endpoints. Its threat-hunting query engine lets analysts search seven days of historical process and endpoint event data. The Visual Process Tree helps analysts examine process relationships.<\/p>\n

    Analysts can initiate Isolate Device<\/strong>, Kill Process<\/strong>, Kill Process Tree<\/strong>, and Quarantine File<\/strong> actions. Isolation<\/a> preserves connectivity to Hexnode XDR, while quarantine encrypts and restricts access to malicious files. These analyst-triggered controls support endpoint containment.<\/p>\n

    Hexnode XDR supports detection and containment of post-exploitation activity on enrolled, supported endpoints, complementing server-side WebLogic patching and application-tier remediation without replacing either.<\/p>\n

    Close the vulnerability and verify recovery<\/h3>\n

    A PeopleSoft web shell investigation requires clear ownership across patching, forensics, and endpoint response. Establish what attackers could access, preserve the evidence needed to assess impact, and validate each recovery action.<\/p>\n

    Make closure an evidence-based decision. Confirm remediation, resolve suspicious activity, and document remaining uncertainty before treating the environment as recovered.<\/p>\n

    <\/div><\/div>
    Strengthen PeopleSoft Threat Response<\/h5>

    Detect suspicious endpoint activity, contain active threats, and accelerate incident response with Hexnode UEM and XDR.<\/p>