ShinyHunters renewed exploitation of Oracle PeopleSoft, bypassing web application firewall rules and deploying web shells on dozens of systems globally.

Mandiant and Google Threat Intelligence Group (GTIG) identified renewed exploitation of CVE-2026-35273 by UNC6240, also known as ShinyHunters. The renewed activity follows a campaign that exploited the vulnerability as a zero-day between May 27 and June 9, 2026, predominantly against higher-education institutions.

The updated exploit bypassed string-based web application firewall (WAF) rules protecting PeopleSoft’s Environment Management Hub endpoint. The report explains that encoding a character in the request path defeated rules matching the literal path before decoding, while the application server decoded and routed the request to the vulnerable component.

The campaign expanded beyond education and deployed web shells on dozens of systems worldwide. The identified sectors include higher education, technology, information technology services, healthcare, agriculture, transportation, and government; the source does not provide an exact affected-system count or a quantified data-loss total.

Mandiant recommends applying Oracle’s security patch rather than relying on WAF rules or path blocking. Its guidance also calls for disabling the Environment Management Hub service in multi-server configurations or removing the application in single-server configurations, reviewing access logs and application files for compromise, rotating credentials accessible to the service account, and checking outbound traffic and unexpected MeshCentral agents.