ShinyHunters WAF Bypass Keeps PeopleSoft Attacks Alive

WAF rules match against known request patterns. When an attacker sends the same payload using percent-encoded characters instead of their literal equivalents, a WAF that skips input normalization before inspection sees a different string. The application backend, running a standard URL decoder, reconstitutes the original request. The rule fires on one form; the application processes the other.

That is the technique ShinyHunters has been applying against Oracle PeopleSoft deployments, according to BleepingComputer. The target is CVE-2026-35273, a missing-authentication flaw in Oracle PeopleSoft Enterprise PeopleTools (CVSS 9.8, critical). Oracle patched it, and CISA added the vulnerability to the Known Exploited Vulnerabilities catalog in June 2026 with a three-day remediation window for federal agencies.

The WAF bypass lets the group continue deploying web shells on servers with WAF mitigations in place. Web shells written to disk before patching can persist through a patch cycle: the patch closes the initial access path but doesn’t remove files that are already there. Any PeopleSoft deployment in the exploitation window should be audited for persistent access, not just updated.

ShinyHunters has been active against PeopleSoft throughout 2026. The group claimed a breach of FBI systems via a PeopleSoft zero-day earlier this month and ran an extortion operation against Cl0p victims using separately obtained data. The WAF bypass is the technical mechanism that keeps new victims reachable while the unpatched population shrinks.

For PeopleSoft operators: apply the patch if not already done. If WAF rules are the current compensating control, verify the WAF normalizes URL-encoded input before running pattern matching. Audit for web shells on any instance that may have been exposed before patching. Earlier Oracle KEV context: Oracle WebLogic CVE-2026-21962 Added to CISA KEV.