What is confirmed
On September 25, 2026, Google Threat Intelligence and Mandiant reported a new mass-exploitation wave of CVE-2026-35273, an unauthenticated remote code execution flaw (CVSS 9.8) in Oracle PeopleSoft's Environment Management Hub (PSEMHUB).
The timeline:
- The cluster tracked as UNC6240 (which Google links to ShinyHunters) exploited it as a zero-day from May 27;
- Oracle shipped an emergency fix on June 10;
- In September the new wave hits organizations that blocked the endpoint with a WAF rule and never patched.
The trick: request /%50SEMHUB/ instead of /PSEMHUB/. A WAF rule that matches the literal path fails, and the PeopleSoft server decodes %50 back to P and reaches the vulnerable servlet.
What is a claim (still unconfirmed)
On September 22, ShinyHunters defaced a page on FBIJobs.gov and claimed it stole 2–3 TB of data, saying it used this same flaw (and, according to them, another unknown one). The FBI said it is investigating unauthorized activity and has not confirmed the point of breach or data theft. Google's research does not name the FBI as a victim.
Why it matters
A WAF rule is not a patch. Attackers try encodings your rule never considered. Any "temporary mitigation" needs an expiry date and continuous testing.
What to do now
- If you run PeopleSoft: apply the June 10 patch and do not rely on the WAF alone.
- Search logs for requests to
/%50SEMHUB/and variants. - Treat FBI claims as unconfirmed until the agency says otherwise.