Four months after Oracle patched a critical remote-code-execution hole in PeopleSoft, the attackers who broke in through it are back. Google’s Threat Intelligence Group and its Mandiant incident-response unit say the extortion crew tracked as ShinyHunters, internally designated UNC6240, has resumed widespread exploitation of CVE-2026-35273 by disguising its attack traffic so that web application firewalls wave it through. BleepingComputer reported on September 26, 2026, that the group is using a URL-encoding trick to slip past WAF rules written specifically to block the flaw, meaning organizations that assumed a firewall rule was enough protection may be exposed again.
The renewed activity matters because CVE-2026-35273 was never a small story. It carries a CVSS severity score of 9.8, sits in PeopleSoft’s Environment Management component, and was originally exploited as a zero-day before Oracle shipped an advisory on June 10, 2026, according to Google’s June 11 report. Tech Insider covered the original disclosure when it emerged that more than 100 schools had already been hit. Now the same bug is back in play, this time with a bypass technique aimed squarely at the defenses enterprises put up after the first wave.
Don't miss new tech stories on Google
Add Tech Insider once in the Google app and our stories appear in your news suggestions.
What Google and Mandiant Found
According to Google’s threat intelligence blog, Mandiant and the Google Threat Intelligence Group (GTIG) identified an active compromise and extortion campaign attributed to UNC6240, the cluster the security industry more commonly calls ShinyHunters, targeting Oracle PeopleSoft application infrastructure. The activity Google tracked ran from May 27 through June 9, 2026, a two-week window that predates Oracle’s public advisory by roughly a day, which is the detail that made the original incident a genuine zero-day rather than a patch-lag problem.
Reuters, in a report picked up by Yahoo News on September 26, 2026, summarized Google’s position plainly: the Alphabet unit said ShinyHunters exploited a bug in Oracle’s PeopleSoft enterprise software in attacks from May 27 through June 9 that mainly affected universities. That detail, mainly affected universities, lines up with a pattern this outlet has tracked all year: education-sector back-office systems, which run PeopleSoft for HR, payroll, and student records, are frequently under-resourced on the security side relative to the sensitivity of the data they hold.
Google’s account of the intrusion goes further than a simple “they got in.” Mandiant said attackers used a MeshCentral agent for persistence, then moved laterally between compromised PeopleSoft machines over SSH, frequently relying on known username-and-password combinations rather than fresh exploitation once inside. In practical terms: the initial break-in exploited a real, unpatched software flaw, but the spread across a victim’s network afterward often came down to reused or weak credentials sitting on adjacent servers, a much more mundane failure than the zero-day that got the attackers through the front door.
The New Twist: A URL-Encoding Trick That Beats the Firewall
The September development is what separates this from a routine “old CVE still gets exploited” story. BleepingComputer reported that the ShinyHunters extortion gang is using a URL-encoding trick to bypass web application firewall rules that mitigate the Oracle PeopleSoft CVE-2026-35273 flaw, allowing the threat actors to resume widespread exploitation of a flaw on vulnerable servers. Security teams that deployed a WAF signature in June, treating it as a stopgap while the Oracle patch rolled out across their estate, may have quietly lost that protection without any alert firing.
WAF bypass through character encoding is not a new class of trick in absolute terms, but it is a durable one, because signature-based WAF rules typically match against a normalized or literal version of a request path or parameter. If a rule is written to catch a specific string in a URL, encoding part of that string, changing case, inserting redundant percent-encoding, or splitting a payload across parameters, can produce a request that the backend application still interprets correctly while the WAF’s pattern-matcher does not recognize it as the thing it was told to block. That gap between what a WAF sees and what the origin server actually parses is exactly the kind of blind spot BleepingComputer’s report describes ShinyHunters exploiting here.
Illustrative WAF logic gap (not exploit code):
Rule blocks literal path: /psp/ps/EOEM/EMPLOYEE/...
Bypass class: percent-encode a byte in the path so the
string no longer matches the rule's literal pattern, while
the origin server's URL decoder still resolves it to the
same protected endpoint.
Mitigation: normalize/decode requests BEFORE WAF pattern
matching, not after; patch the underlying application; do
not rely on a WAF rule as the sole control for a CVSS 9.8
RCE.
That last line matters most for IT and security leaders reading this today: a web application firewall rule was always meant to be a temporary compensating control, not a substitute for patching. Oracle’s June 10 advisory exists precisely so that organizations running PeopleSoft apply the vendor fix directly. Anyone still relying on a WAF signature written in June as their only defense against CVE-2026-35273 in late September has, functionally, gone unprotected for months without necessarily realizing it.
Timeline: From Zero-Day to Renewed Mass Exploitation
The table below lays out the public timeline as reported by Google, Reuters, and BleepingComputer, alongside this site’s own June coverage of the original breach.
| Date | Event | Source |
|---|---|---|
| May 27, 2026 | Mandiant-observed exploitation window begins against PeopleSoft environments, mainly universities | Google Threat Intelligence Group |
| June 9, 2026 | Observed exploitation window closes per Google’s initial tracking | Google Threat Intelligence Group |
| June 10, 2026 | Oracle publishes advisory for CVE-2026-35273, CVSS 9.8, Environment Management component | Oracle Security Alerts |
| June 11, 2026 | Google/Mandiant publish blog attributing the campaign to UNC6240 (ShinyHunters) | Google Cloud blog |
| June 2026 | Tech Insider reports over 100 schools affected by the initial zero-day wave | Tech Insider |
| September 26, 2026 | ShinyHunters resume widespread exploitation using a URL-encoding WAF bypass | BleepingComputer |
| September 26, 2026 | Reuters republishes Google’s confirmation that the May-June campaign mainly hit universities | Reuters via Yahoo News |
Who Is ShinyHunters, and Why Do They Keep Coming Back
ShinyHunters is not a single tightly organized gang so much as a durable brand and a loose, overlapping set of operators that security researchers have connected to a string of 2026’s biggest breach disclosures. This outlet has reported on the group’s claims against federal systems, and separately on its leak of Rockstar Games anti-cheat source code. What ties the PeopleSoft campaign to that broader pattern is a preference for hitting enterprise software that sits underneath an organization rather than customer-facing apps: PeopleSoft, in this case, is HR and financial back-office infrastructure, not something IT teams necessarily watch as closely as a public website.
Google’s designation of the cluster as UNC6240 reflects its own internal tracking convention for activity it has not yet formally merged into a fully named group profile, which is itself informative: even a threat intelligence team with Mandiant’s visibility is treating the PeopleSoft intrusion set as a discrete, trackable campaign rather than assuming everything labeled “ShinyHunters” in public reporting is the same operators using the same tooling. For defenders, that nuance matters less than the outcome: a financially motivated crew found a critical RCE in enterprise software, used it quietly against a sector with historically thin security budgets, and is now iterating on its intrusion technique months after the initial patch, rather than moving on to a fresh vulnerability.
Scale: More Than 100 Organizations Flagged Worldwide
Mandiant told Google’s blog audience that it notified more than 100 global organizations whose IP addresses matched vulnerable PeopleSoft endpoints, with most of the identified organizations located in the United States. That figure describes exposure, meaning systems Mandiant could see were running vulnerable, internet-facing PeopleSoft instances, not necessarily every organization that suffered a confirmed data theft. The distinction matters for anyone trying to gauge real-world blast radius: it is a notification count of at-risk infrastructure, drawn from Mandiant’s own scanning and threat-intelligence visibility, rather than a tally of confirmed victims with stolen records.
Early targeting concentrated on academic institutions, per Google’s reporting, which tracks with why education-sector breaches tied to ShinyHunters-linked activity have been a recurring theme on this site through 2026. Universities run PeopleSoft for student information systems, HR, and finance simultaneously, meaning a single successful intrusion can expose several categories of sensitive data, from academic records to payroll and Social Security numbers, in one campaign.
Reading the Renewed Exploitation Against 2026’s Other Repeat Offenders
CVE-2026-35273 is not the only 2026 vulnerability that security teams thought they had closed off, only to see attackers return with a new angle. The table below stacks it up against other critical flaws this site has tracked this year where exploitation resumed, escalated, or required repeated emergency patching.
| Vulnerability | Vendor/Product | CVSS | Repeat-exploitation pattern |
|---|---|---|---|
| CVE-2026-35273 | Oracle PeopleSoft | 9.8 | Zero-day in June, WAF-bypass revival in September |
| CVE-2026-76460 | Cisco ISE | 10.0 | Patched alongside 9 other bugs after zero-day exploitation |
| N-central (4th advisory) | N-able | 10.0 | Fourth critical RCE fix shipped within months, per this site’s coverage |
| CVE-2026-85706 | GitLab | 10.0 | Exploited in the wild before patch adoption completed |
| SonicWall SMA1000 (second flaw) | SonicWall | 10.0 | Second zero-day disclosed within weeks of the first |
The pattern across all five rows is the same: a single emergency patch is treated by defenders as the end of the story, when in practice 2026’s most persistent intrusion crews are increasingly built to iterate. If a vendor’s fix or a compensating WAF rule closes one path in, these groups appear willing to spend weeks or months probing for the next one rather than abandoning a target that has already proven valuable.
Why PeopleSoft Keeps Showing Up in Breach Headlines
PeopleSoft is decades-old enterprise resource planning software, originally built by PeopleSoft Inc. before Oracle acquired the company in 2005, and it remains deeply embedded in university, government, and large-enterprise HR and finance operations precisely because replacing it is expensive and disruptive. That combination, old architecture, high-value data, and institutional reluctance to migrate away, is a recurring theme in enterprise security: the software that is hardest to replace is often the software attackers have had the most time to study.
Environment Management, the specific PeopleSoft component named in CVE-2026-35273, handles configuration and administrative functions across a PeopleSoft deployment, which is part of why a flaw there carries a 9.8 severity score: successful exploitation does not just expose one application module, it can touch the administrative layer that manages the whole environment. That is a meaningfully different risk profile than a bug confined to a single customer-facing form or report.
Market and Industry Impact
For enterprise software buyers, the practical impact of a story like this is less about Oracle’s stock price and more about procurement and budget conversations that are already underway for 2027. Security teams evaluating legacy ERP and HR platforms now have a fresh, concrete data point, a critical zero-day, a WAF bypass revival, and a named extortion crew, to bring into renewal discussions about whether to keep funding on-premises PeopleSoft estates or accelerate migration to cloud-hosted alternatives with vendor-managed patching cycles.
It also reinforces demand for the web application firewall and runtime protection vendors whose products are supposed to catch exactly this kind of bypass. A signature that can be defeated by URL encoding is a marketing problem for WAF vendors as much as a technical one, and expect vendors serving higher-education and enterprise HR customers to point to this incident when pitching more advanced, normalization-aware inspection engines over simple pattern-matching rules.
Historical Context: A Year of Repeat Zero-Days
2026 has been a difficult year for the theory that a single emergency patch ends a vulnerability’s exploitation lifecycle. This site’s own coverage this year has tracked SonicWall SMA1000 hit by back-to-back zero-days, N-able shipping a fourth critical N-central fix within weeks, and Microsoft’s September Patch Tuesday still landing zero-days actively exploited in the wild despite a record patch volume. The PeopleSoft story fits neatly into that same 2026 narrative: patching is necessary but, on its own, increasingly treated by well-resourced attackers as a speed bump rather than a wall.
The education sector specifically has had a rough year on this front. Beyond the PeopleSoft campaign, ShinyHunters-linked activity has touched multiple large platforms in 2026, and the group’s willingness to return to a target months after an initial compromise, rather than treating a single breach as a closed chapter, is becoming one of the year’s defining threat-actor traits.
What Security Teams Should Do Right Now
The immediate, concrete steps for any organization running PeopleSoft mirror what Google and BleepingComputer’s reporting implies rather than any single official checklist: confirm the June 10 Oracle patch for CVE-2026-35273 is actually applied to every PeopleSoft instance, not assumed to be applied; treat any WAF rule written against this CVE as unreliable given the reported bypass; audit for MeshCentral agents or unfamiliar remote-management tooling on PeopleSoft hosts, since Mandiant flagged that specific persistence mechanism; and rotate credentials across systems that share authentication with PeopleSoft servers, since lateral movement in the original campaign relied on reused username-and-password pairs over SSH rather than fresh exploitation.
None of those steps require exotic tooling. They require verifying that a patch applied in June is still doing its job in September, which is precisely the assumption this renewed campaign is designed to break.
Expert and Industry Perspective
Google Threat Intelligence Group and Mandiant, in their joint threat intelligence report, described the incident directly: “Mandiant and Google Threat Intelligence Group (GTIG) have identified an active compromise and extortion campaign attributed to UNC6240 (ShinyHunters) targeting Oracle PeopleSoft application infrastructure.” The same report ties the campaign to the specific flaw: “The activity was observed between May 27, 2026, and June 9, 2026 and is consistent with the exploitation of CVE-2026-35273, a critical remote code execution vulnerability (CVSS 9.8) in the Environment Management component.”
Google’s researchers were also explicit about the zero-day timing, writing: “Because this activity predates Oracle’s June 10, 2026 advisory, the vulnerability was exploited as a zero-day.” Reuters, in coverage republished by Yahoo News on September 26, 2026, summarized the company’s position: “The unit of Alphabet’s Google said ShinyHunters exploited a bug in Oracle’s PeopleSoft enterprise software in attacks from May 27 through June 9 that mainly affected universities.”
On the new development, BleepingComputer reported: “The ShinyHunters extortion gang is using a URL-encoding trick to bypass web application firewall rules that mitigate the Oracle PeopleSoft CVE-2026-35273 flaw, allowing the threat actors to resume widespread exploitation of a flaw on vulnerable servers.”
Predictions: Where This Goes Next
- Expect Oracle to issue supplemental guidance or a follow-up advisory addressing WAF-bypass conditions for CVE-2026-35273, given the specificity of BleepingComputer’s report.
- Higher-education IT departments, already stretched thin, are likely to face renewed pressure from cyber-insurance underwriters to prove PeopleSoft patch status before 2027 policy renewals.
- WAF and web application security vendors will likely market updated, normalization-aware detection specifically referencing this bypass class through year-end.
- Additional victim disclosures tied to the September exploitation wave are likely over the coming weeks as affected organizations complete incident response.
- ShinyHunters-linked activity, given its 2026 track record across education, gaming, and retail targets, will probably resurface against a different high-value enterprise platform before the year is out.
The Bottom Line
CVE-2026-35273 was already one of 2026’s more serious enterprise vulnerabilities: a 9.8-severity, zero-day-exploited flaw in software that sits underneath university and enterprise HR operations, tied to a known extortion crew, and confirmed by two of the security industry’s most credible sources, Google and Mandiant. The September revival, using a technique built specifically to defeat the defense many organizations deployed in June, is the more uncomfortable half of the story. It is a reminder that a patch and a firewall rule announced months ago are not permanent, and that verifying they still work is now part of the job.
Frequently Asked Questions
What is CVE-2026-35273?
It is a critical remote-code-execution vulnerability in the Environment Management component of Oracle PeopleSoft, carrying a CVSS severity score of 9.8, according to Google Threat Intelligence Group’s June 2026 report.
Who is exploiting the flaw?
Google and Mandiant attribute the campaign to a cluster it tracks as UNC6240, widely referred to in public reporting as ShinyHunters.
Was this a zero-day?
Yes. Google’s report states the observed exploitation, from May 27 to June 9, 2026, predates Oracle’s June 10, 2026 advisory, meaning attackers were using it before a patch existed.
What changed in September 2026?
BleepingComputer reported on September 26, 2026, that ShinyHunters began using a URL-encoding trick to bypass web application firewall rules that had been mitigating the flaw, allowing renewed widespread exploitation.
Who was targeted?
Early exploitation mainly affected universities and academic institutions, per Google’s reporting, though Mandiant said it notified more than 100 global organizations with vulnerable, internet-facing PeopleSoft infrastructure, most located in the United States.
Is patching alone enough to stay protected?
Organizations should confirm Oracle’s June 10, 2026 patch is applied to every PeopleSoft instance and should not rely solely on WAF rules against this CVE, since a bypass for those rules has now been reported.
How did attackers move around inside compromised networks?
Mandiant reported that attackers deployed a MeshCentral agent for persistence and moved laterally between PeopleSoft machines over SSH, often using known username-and-password combinations rather than additional exploitation.
Has ShinyHunters targeted PeopleSoft before this campaign?
This specific campaign, tracked by Google as UNC6240, is the incident in question; ShinyHunters-linked activity has separately been tied to a range of other 2026 breaches across different sectors, as this site has reported.
Related Coverage
- ZcopyReaper Linux Bug Hits CVSS 7.8, Root Since 2018 [2026]
- WSO2's CVSS 10 API Flaw Exploited 12 Days Before KEV [2026]
- ShinyHunters Breach Rockstar Again, Leak 8.1GB Code [2026]
- Microsoft Fixes Bug That Broke File History Backups [2026]
- ShinyHunters Say They Hacked FBI, Hold 2-3TB Data [2026]
