Enterprise IT News

Enterprise IT News: PeopleSoft WAF Bypass Exploited

Published September 27, 2026 · DNS Benchmark Pro Editorial · Reading time: 7 minutes

The most useful enterprise IT news of the week is not a new vulnerability. It is a reminder that a compensating control you never tested is a control you do not have. Oracle shipped a fix for this zero-day vulnerability more than three months ago. The organisations being compromised right now are, in many cases, ones that chose to block the vulnerable path at the edge instead of patching — and the operator defeated that decision by typing one character differently.

One percent-encoded character, one bypassed WAF

The flaw lives in PeopleSoft's Environment Management Hub, a deployment-support component exposed by the web tier at /PSEMHUB/hub. It accepts serialised Java objects without authentication, and a crafted object leads directly to code execution as the application service account.

Because the entry point is a single well-known path, the obvious short-term mitigation was to block it. Plenty of teams did exactly that, in WAF rules, reverse-proxy configuration or load-balancer policy. Google's write-up describes what happened next in one sentence: rules that match the literal string /PSEMHUB before decoding do not match /%50SEMHUB/, while WebLogic decodes the path and serves the application normally. %50 is simply the letter P.

This is a URL normalisation mismatch, and it is one of the oldest defects in layered web architecture: two components in the same request path disagree about what a string means. The security device makes its decision on the raw bytes; the application makes its decision on the decoded path. Anywhere those two views diverge, a filter becomes decorative.

From June zero-day vulnerability to September mass exploitation

The June campaign was narrow and deliberate. Mandiant dated hands-on activity to 27 May – 9 June 2026, notified more than 100 organisations with exposed endpoints, and found that roughly 68% of confirmed victims were universities and colleges — institutions that run PeopleSoft Campus Solutions as the system of record for student data.

September looks different. The targeting has widened from education into technology, IT services, healthcare, agriculture, transportation and government, and Google describes web shells deployed on dozens of systems globally. That shift — from a curated victim list to indiscriminate sweeping — is the normal second act once an exploit is no longer worth protecting, and it is why a flaw that read as sector-specific cybersecurity news in June is general enterprise IT news in September.

What lands after the request gets through

The post-exploitation chain is disciplined, and worth reading as a template rather than a curiosity.

Web shells and file staging

Two JSP shells go in first. x.jsp takes hex-encoded commands over POST, detects the operating system and spawns cmd.exe or /bin/sh. u.jsp is an upload servlet that writes Base64 chunks in 150 KB increments, sized to slip under request-size limits — the same evasion logic as the path encoding, applied to payload delivery.

Signed backdoor, tunnel and RMM abuse

Persistence arrives as Ple64.exe, a trojanised media-player installer carrying SIDEEYE, a C++ backdoor with credential theft, an interactive reverse shell and a reverse proxy. It was signed with a fraudulently obtained extended-validation certificate, so code-signing alone did not flag it. Neo-reGeorg provides a SOCKS5 tunnel over HTTPS for internal discovery, and MeshCentral agents give the operator a legitimate remote-management channel that blends into normal administrative traffic.

Privilege and blast radius

The privilege detail is the one to take to a change board: about a quarter of observed commands executed as root or NT AUTHORITY\SYSTEM. A web-tier compromise became full host control, which in turn exposed database connection strings in psappsrv.cfg, Integration Broker credentials and any cloud credentials reachable from the web tier — a cloud security problem that begins with an unpatched on-premises servlet.

Why DNS security catches this before your server infrastructure does

Every element of that chain has to resolve a name. MeshCentral agents in this campaign were configured against domains chosen to look boring in a log: azurenetfiles.net, microsoft-entra.net, enroll.azuredevice.cloud and, in the September variant, winmanage-me.network. None belong to Microsoft. All of them are visible in resolver logs before a single byte of data leaves the building.

That makes recursive DNS the cheapest detection surface in the stack. A protective resolver that scores newly registered and lookalike domains catches these callbacks at the query, not the connection — and unlike deep packet inspection, it costs almost nothing per request. The corollary is that resolver logging has to be complete: an application server that bypasses the enterprise resolver, or a host quietly using an external DNS over HTTPS endpoint, is a blind spot the operator will happily use for command and control. Our explainer on DNS over HTTPS and DoT covers where those queries go and why encrypted transports change what your logs can see.

Resolver choice is also an availability decision. If you centralise egress on one recursive service, its DNS server performance becomes a dependency for every agent, integration and patch download you run, and a DDoS attack against that resolver is felt as an application outage. Measuring network latency per resolver from your own vantage point — rather than trusting a marketing figure — is a ten-minute job with a free network diagnostic tool that benchmarks real DNS resolution latency, and it is the baseline you will want on hand the next time server infrastructure starts timing out and nobody can say whether resolution or the service is at fault.

The IT security checklist for PeopleSoft operators

If you take one operational item from this week's enterprise IT news, take this list — in order.

1. Patch, do not filter. Apply Oracle's Security Alert fix for CVE-2026-35273. Google is explicit that WAF rules and path blocking are not a substitute — this week is the proof.
2. Remove the component. Disable the Environment Management Hub in multi-server configurations, or remove the PSEMHUB application entirely in single-server deployments. An absent servlet cannot be encoded around.
3. Grep for the encoding, not the path. Search web logs for /%50SEMHUB/, mixed-case spellings and other percent-encoded variants, plus external POSTs to /hub and /PSIGW/HttpListeningConnector.
4. Look for the artefacts. Unexpected .jsp files under PSEMHUB.war/, new logs, persistantstorage or scratchpad directories, and altered XML under envmetadata/data/environment/.
5. Rotate everything the web tier could read — database strings, Integration Broker credentials, cloud keys. Assume a SYSTEM-level shell read them.
6. Query your DNS logs for the lookalikes above, and for unexpected MeshCentral or RMM agents. Then verify no host is resolving outside your approved resolvers.
7. Prepare for extortion. This crew publishes. Legal, comms and regulatory notification paths should be warm before the email arrives, not after.

Industry impact

Two lessons survive this news cycle. The first is narrow and technical: any control that inspects a URL must normalise it the same way the application does, and if you cannot prove that, the control is a delay rather than a barrier. Teams that inherited a "temporary" edge rule in June should treat this as a prompt to audit every other virtual patch they are still relying on.

The second is organisational, and harder. Three and a half months elapsed between a patch and a mass-exploitation campaign against systems that never took it. The gap was not caused by a lack of information — the CVE was in CISA's KEV catalog within 48 hours. It was caused by the ordinary friction of patching a business-critical ERP platform: change windows, regression testing, a vendor integration nobody wants to break. That friction is real, which is exactly why the interim control has to be something an attacker cannot re-encode. Removing the component, restricting the path to an allow-listed management network, or taking the web tier off the public internet are all durable. A string match is not.

The enterprise IT news cycle will produce another CVSS 9.8 next week. The organisations that fare well will be the ones whose answer to "are we exposed?" comes from an inventory and a log query rather than a firewall rule someone wrote in June and never tested again.

Sources

• Google Cloud Threat Intelligence — ShinyHunters renewed mass exploitation campaign targeting Oracle PeopleSoft
• The Hacker News — Attackers bypass WAFs to exploit Oracle PeopleSoft flaw and deploy web shells
• BleepingComputer — ShinyHunters uses WAF bypass trick in Oracle PeopleSoft attacks
• Rapid7 — Active exploitation of Oracle PeopleSoft zero-day CVE-2026-35273
• Google Cloud Threat Intelligence — ShinyHunters targets education sector with Oracle PeopleSoft exploit
• SecurityWeek — Oracle addresses PeopleSoft vulnerability amid reports of zero-day attacks

Independent editorial analysis published by DNS Benchmark Pro / Genext Information Systems. The Oracle headquarters photograph is by Håkan Dahlström, licensed CC BY 2.0 via Wikimedia Commons; the PeopleSoft wordmark is the vendor's official logo, public domain, via Wikimedia Commons; the benchmark screenshots are original captures of the DNS Benchmark Pro engine. No images on this page are AI-generated.