Threat actors associated with the notorious cybercrime group ShinyHunters have initiated a fresh wave of global attacks, exploiting a critical vulnerability in Oracle's PeopleSoft enterprise software. What makes this recent campaign particularly concerning for enterprise security teams is the attackers' ability to systematically bypass traditional Web Application Firewalls (WAFs) to achieve unauthenticated remote code execution and drop persistent web shells.
Tracked as CVE-2026-35273, the flaw carries a near-maximum Common Vulnerability Scoring System (CVSS) rating of 9.8 out of 10. Threat intelligence researchers, including monitoring teams at Google, have observed widespread exploitation across multiple industry sectors worldwide. Organizations that rely on PeopleSoft for human resources, financial management, and supply chain operations are facing severe operational risks as adversaries leverage this vector to gain initial access to core corporate networks.
The Anatomy of CVE-2026-35273
To understand the severity of the ongoing campaign, it is necessary to examine the underlying architectural mechanics of PeopleSoft and how CVE-2026-35273 operates. Oracle PeopleSoft relies on a complex web of application servers, database connectors, and web server interfaces, collectively coordinated through PeopleTools. The architecture relies heavily on Java-based servlets to process incoming HTTP requests and map them to internal business logic.
CVE-2026-35273 stems from an improper input validation and request-handling flaw within the PeopleSoft Internet Architecture (PIA). An unauthenticated actor can craft a specialized HTTP request that tricks the application server into deserializing malicious objects or executing unintended administrative paths. Because the processing logic executes before robust authentication checks take effect, an attacker can issue commands directly to the underlying host operating system.
Initial discovery of the vulnerability revealed that it was originally leveraged as a zero-day exploit in limited, highly targeted intrusions. However, once details of the bug leaked into underground forums and security research circles, public proof-of-concept exploits quickly emerged. The transition from target-specific intrusion to automated, automated mass exploitation took only a matter of days, placing immense pressure on enterprise patch management workflows.
Bypassing the Front Line: How Attackers Defeat WAF Rules
One of the most alarming aspects of the recent ShinyHunters activity is the effortless manner in which the attackers are circumventing Web Application Firewalls. WAFs are traditionally deployed at the edge of an enterprise network to inspect inbound web traffic, matching payload patterns against known signature sets or heuristics to block malicious requests before they reach backend servers.
In this campaign, adversaries are utilizing sophisticated payload obfuscation techniques specifically designed to evade signature-based detection mechanisms. By manipulating request encodings—such as combining chunked transfer encoding, nested URL encoding, and non-standard HTTP header structures—the attackers cause the WAF to interpret the request as benign or unparseable.
When the security gateway receives these manipulated requests, it fails to normalize the payload correctly and forwards the raw stream to the backend Oracle PeopleSoft server. However, the Java application server hosting the PIA interprets the malformed stream differently, successfully decoding the hidden payload and triggering the execution path. This disparity in how edge security devices and backend application servers parse HTTP traffic is a classic example of impedance mismatch, allowing malicious commands to slip through defenses undetected.
Web Shell Deployment and Network Escalation
Once remote code execution is achieved, the primary goal of the attackers in this campaign is to establish long-term persistence within the target environment. They achieve this by writing lightweight Java web shells directly into publicly accessible directories managed by the PeopleSoft web server.
These web shells act as persistent backdoors, enabling the actors to execute arbitrary commands, upload additional malware, and exfiltrate sensitive data via standard port 80 or 443 HTTPS traffic. Because the web shell commands look like normal web traffic interacting with existing administrative utilities, detecting their presence through standard logging mechanisms can be extraordinarily difficult.
With a stable beachhead established, ShinyHunters-aligned operators pivot laterally through the environment. Enterprise resource planning (ERP) systems like PeopleSoft are uniquely valuable targets because they sit at the intersection of critical corporate assets. They contain employee personally identifiable information (PII), banking details, corporate payroll records, supply chain logistics, and proprietary operational data. Access to these systems provides adversaries with maximum leverage, enabling both data theft for extortion and subsequent deployment of enterprise-wide ransomware.
The Broader Threat Ecosystem and Attribution
While the name ShinyHunters was historically associated with high-profile database breaches and dark web data brokerage, the group's tactics have evolved significantly. The community surrounding this label now encompasses a broader network of skilled threat actors, extortionists, and initial access brokers who collaborate to target enterprise infrastructure.
The deployment of zero-day exploits and rapid adoption of WAF-evasion techniques indicate a high degree of technical sophistication. Intelligence reports suggest that these groups actively monitor public vulnerability disclosures and vendor patches, diffing binary updates to construct working exploits within hours of a release. They then deploy automated scanning infrastructure across global IP spaces to identify exposed PeopleSoft instances before corporate IT departments can apply official patches.
Targeting patterns reveal that the campaign is opportunistic yet focused on high-value sectors. Finance, healthcare, government, higher education, and large enterprise services have all reported compromise attempts. For multi-national corporations running legacy PeopleSoft deployments, the threat is particularly acute, as these environments often contain extensive custom code and complex dependencies that complicate emergency patching.
Immediate Remediation and Defense Strategies
Given that edge-based WAF protections are actively being bypassed, security organizations cannot rely solely on perimeter controls to block these attacks. A defense-in-depth approach is essential to mitigate the risk posed by CVE-2026-35273.
First and foremost, organizations running Oracle PeopleSoft must prioritize applying the official security updates issued by Oracle. If an immediate maintenance window is not feasible, security teams should evaluate temporary mitigation controls provided by the vendor, such as disabling non-essential PIA components or restricting external network access to the PeopleSoft administrative endpoints.
Second, perimeter security teams must update and tune their WAF inspection rules to detect obfuscation techniques. This includes enforcing strict HTTP request normalization, dropping non-compliant transfer encodings, and inspecting incoming traffic for anomalous string patterns associated with Java object deserialization.
Third, robust endpoint detection and response (EDR) telemetry must be deployed on all application and web servers hosting PeopleSoft services. Defenders should actively hunt for unusual child processes spawned by web server processes (such as cmd.exe, bash, or powershell executing under web daemon user accounts). Furthermore, file integrity monitoring (FIM) should be enabled on web root directories to detect the creation or modification of unexpected .jsp files.
Finally, strict network segmentation must be enforced around ERP environments. Application servers should only be permitted to communicate with necessary database instances and internal infrastructure, restricting outbound internet access to prevent web shells from reaching back to external command-and-control (C2) servers.
Long-Term Implications for ERP Security
The exploitation of CVE-2026-35273 serves as a stark reminder of the systemic risks associated with legacy enterprise software platforms. Many organizations rely on core applications that were originally architected decades ago, with modern web interfaces layered on top to support cloud and remote workflows.
As threat actors continue to refine their ability to defeat perimeter security controls like WAFs, the industry must pivot toward zero-trust architectures and deeper runtime application self-protection (RASP). Simply placing a security firewall in front of an unpatched, vulnerable web application is no longer a viable security posture. Organizations must assume that edge defenses will fail and construct internal monitoring systems capable of detecting and interrupting post-exploitation activities in real time.
