Oracle PeopleSoft CVE-2026-35273 exploited, web shells

What Happened

Google’s Threat Analysis Group is warning of renewed mass exploitation of CVE-2026-35273, an unauthenticated takeover vulnerability in Oracle PeopleSoft Enterprise. The campaign, linked to the ShinyHunters ecosystem, targets organizations across multiple sectors worldwide. Attackers are not relying on novel exploits - they are reusing a known flaw and wrapping it in WAF-evasion techniques to push past perimeter defenses that many defenders assumed were sufficient.

According to the correlated reporting, exploitation has moved beyond initial access. Successful intrusions are followed by web shell deployment, giving operators persistent, interactive control over compromised PeopleSoft application servers.

Why It Matters

PeopleSoft sits at the center of HR, finance, and student information systems for large enterprises, universities, and government agencies. These systems hold payroll data, personally identifiable information, and in many cases the crown-jewel records that feed downstream identity and access management pipelines. A web shell on a PeopleSoft server is not just a foothold - it is a bridge into the identity tier.

The ShinyHunters association raises the probability that stolen data feeds extortion and downstream breach reports rather than remaining a pure espionage play. The WAF bypass angle is equally significant: organizations that treated their WAF as a compensating control for an unpatched PeopleSoft instance now have direct evidence that this assumption is unsafe.

Technical Details

The attack chain exploits the unauthenticated access path in CVE-2026-35273 to reach the PeopleSoft application layer, where attackers then write web shells to web-accessible directories. Because the payloads arrive as legitimate-looking HTTP traffic and are often encoded or split across requests, signature-based WAF rules tuned to older exploit variants miss them.

A public proof-of-concept, documented in our advisory on the PeopleSoft Enterprise unauth takeover, has lowered the skill floor for copycat actors. Defenders should hunt for anomalous file creation under PeopleSoft web roots, unexpected outbound connections from application servers, and authentication events that originate from application server IPs rather than user endpoints.

Immediate Risk

Severity is critical. Any internet-facing PeopleSoft instance running an unpatched version is a candidate for compromise, and web shells may already be resident on systems where exploitation succeeded silently. Organizations that cannot confirm patch status should treat their PeopleSoft servers as potentially compromised and initiate compromise assessment rather than routine patching. The presence of a WAF should not reduce urgency.

Security Insight

WAF bypass campaigns like this one quietly invalidate a common risk-acceptance argument: that a perimeter control buys time to defer patching an internal-facing or “protected” application. Historically, the same reasoning preceded mass exploitation of Apache Struts and later Confluence and MOVEit - each time, attackers engineered around the compensating control rather than through it. The defensive takeaway is not “buy a better WAF.” It is that control stacking only works when each layer is independently verified, and a WAF that has never been tested against the specific exploit it is supposedly blocking is a policy document, not a security boundary.

Further Reading

• Chrome V8 RCE exploited in the wild (CVE-2026-87491) [PoC]
• Chrome 152 sandbox RCE actively exploited (CVE-2026-85046) [PoC]
• PeopleSoft Enterprise unauth takeover (CVE-2026-35273) [PoC]
• Latest Security News
• CVE Advisories
• Data Breach Reports