Google / Mandiant detects new wave of exploitation of CVE-2026-35273 in Oracle PeopreSoft PSEMHUB

Google and Mandiant's response team have detected a new wave of mass exploitation against critical vulnerability of Oracle PeopleSoft identified as CVE-2026-35273(CVSS 9.8). According to public analysis, attackers are taking advantage of a deerialization failure in the PSEMHUB service to achieve remote execution without authentication, deploy back doors and exfilter data from multiple sectors. These facts have been described by the security firms investigating the incidents; what follows is a technical summary, the expected impact and concrete steps that organizations and managers should take now.

What has happened (confirmed facts): Google / Mandiant researchers reported that a track actor such as UNC6240 - linked by the industry to the ShinyHunters family in this campaign - modified an explosion for CVE-2026-35273 and began to exploit it on a large scale. The avoidance technique consisted of URL-encodeating the letter "P" on the vulnerable route, requesting "/% 50SEMHUB / hub" instead of "/ PSEMHUB / hub," which allowed many WAF rules and reverse proxies based on literal coincidence to not detect the request; the PeopreSoft application server decodifies the route and sends it to the vulnerable servlet, where a Java deerialization payload causes code execution. After that initial access, the attackers have deployed JSP shells, loaded a broken and signed installer (Ple64.exe) that inject a memory backdoor called SIDEEYE, used Neo-reGeorg for tuning and MeshAgent (MeshCentral) for persistence in Linux systems. The reported victims include higher education, technology, health, transport, agriculture and public bodies.

How it works technically (confirmed attack chain): the vector is Java deerialization operation in PSEMHUB hub servlet using POSTs containing malicious serialized Java objects. To evade WAF, the route is sent with "% 50" (the ASCII encoding for 'P') so that intermediate systems that make matching before decoding do not recognize the malicious pattern. Once exploited, the attacker usually leaves two JSP web shells (x.jsp and u.jsp) on PSEMHUB.war: one facilitates cross-platform command execution and the other allows you to upload file fragments and run cmd.exe on Windows. With these capabilities they go up to Ple64.exe (signed apparently legitimate) that loads the SIDEEYE backdoor into memory and opens TCP communication with external servers (e.g., the IP observed 162.219.30 [.] 165), facilitating theft of browser / desktop credentials, process / file management and reverse shells. They also use Neo-reGeorg to tuned traffic and MeshAgent for legitimate remote access as a means of persistence.

Who it affects and why it matters: affects Oracle PeopleSoft deployments that have enabled the Environment Management module (EMHub / PSEMHUB), especially single-server facilities or multi-server configurations that have not applied the patches. The accounts and databases that contain PeopleSoft often contain sensitive information (HRR, payroll, student files, clinical data) so the main risk is mass data theft and possible extortion by public dissemination. In addition, the combination of execution as SYSTEM / root (approx. 25% of observed commands) and persistence via RMM or backdoors facilitates side movements and compromises the integrity of the entire infrastructure.

Actual (confirmed and likely) consequences: confirmed by researchers is the implementation of web shells, backdoors in memory and use of RMM; exfiltration and preparation for extortion (usual actor pattern) has also been observed. Probably: publication of stolen data on escape sites and extortion campaigns for victims; operational impact due to the lack of availability of PeopleSoft services and high remediation costs due to the need to rebuild committed systems. Still uncertain: total scope of data theft in each victim and whether all incidents are linked to the same activity or to variants of the explosion.

What's proven you're in dispute: is verified by Mandiant / Google that there is active exploitation of CVE-2026-35273 and that attackers use WAF avoidance techniques, web shells and toolsets such as Neo-reGeorg and MeshAgent. Less independently confirmed is the final attribution to ShinyHunters in all incidents and the group's public statements about other intruders (for example, a statement about an alleged attack on the FBI employment portal was disseminated by means such as The Hacker News and The Register, but such external statements require additional verification by the authorities). See the official technical reports and notices for the primary confirmations: Mandiant / Google and the Oracle page for PeopleSoft.

https: / / www.mandiant.com / resources / blog(research resources and incident response blogs) and https: / / www.oracle.com / applications / peoplesoft-enterprise /(Oracle documentation and notices) are starting points for technical validation and patches. For critical vulnerabilities and regulatory obligations, see the catalogue of vulnerabilities exploited by known CISA actors: https: / / www.cisa.gov / knowledge-exploited-vulnerabilities-catalog.

Specific and urgent actions(operational check list that IT / security equipment should now apply): apply immediately the published patch that fixes CVE-2026-35273; if not possible, disable the Environment Management Hub service in multi-server environments or remove PSEMHUB in single server facilities. Search WebLogic's log and proxy all requests to "/ PSEMHUB /" and any variant with percent-encoding (e.g. "/% 50SEMHUB /"); review the PSEMHUB.war directory by non-legitimate JSPs (x.jsp, u.jsp or others). Detecting and isolating hosts with MeshAgit processes or communications to suspicious IPs (162.219.30 [.] 165 was observed in the campaign). Tracking executables called Ple64.exe, signed anomaly, and any use of Neo-reGeorg or reverse tunnels. Rotate accessible credentials from the PeopleSoft service account and force changes to service and administrator account passwords; activate MFA wherever possible. Review database records for mass queries or exports on sensitive tables (HRR, payroll, students) and search for large files in / tmp or web directories that might contain any braindumps. In the event of a commitment detection, consider the reconstruction from clean images and backups verification; document the time line of the intrusion for regulatory notifications and preparation for possible extortion.

Additional defence recommendations: adjust the WAF rules to compare routes after canonicalization / decoding or insert specific signatures to detect "% 50SEMHUB" and variants; implement EDR rules to detect dangerous Java deerialization and JSP web shell patterns; segment the network to limit the lateral movement capacity by SSH and reduce the scope of service accounts. Prepare playbooks to respond to data extortion: preserve evidence, coordinate with legal and communications and not pay without forensic and legal evaluation.

Final summary: the exploitation of CVE-2026-35273 is active and has been proven to be effective by the combination of WAF evasion, Java deerialization and use of persistence / backdoor tools that facilitate theft and extortion. Organizations using PeopleSoft should prioritize patches and search for compromise indicators right now; rapid detection and rotation of credentials are essential to limit impact and be able to rebuild with guarantees.