Recommended Free Tools
The documented PeopleSoft attack is a bypass of a WAF rule protecting against a known vulnerability—not confirmation of a second zero-day. Mandiant and Google reported that ShinyHunters exploited CVE-2026-35273 again by encoding one character in the vulnerable URL path, potentially evading filters that matched only the literal path. Separately, an October 5, 2026 report said the group claimed to have used another, previously undocumented flaw; that claim had not been independently confirmed or acknowledged by Oracle in the reporting.
Is this a new PeopleSoft zero-day?
There are two separate issues in the reporting, with different evidence behind them. The confirmed one is CVE-2026-35273, a PeopleSoft PeopleTools vulnerability addressed by Oracle on June 10, 2026. The alleged second flaw is a separate claim made by ShinyHunters and reported by CIO on October 5, 2026.
As an Amazon Associate I earn from qualifying purchases.
| Issue | What is established | What is not established |
|---|---|---|
| CVE-2026-35273 | Oracle’s June 10 Security Alert identifies a remotely exploitable, unauthenticated vulnerability that may allow remote code execution. Oracle lists PeopleTools versions 8.61 and 8.62 and assigns a CVSS 3.1 base score of 9.8. Oracle’s Security Alert | The 9.8 score applies to this CVE; it is not a severity rating for the alleged second flaw. |
| Alleged second flaw | CIO reported on October 5, 2026 that ShinyHunters claimed to have used a distinct, previously undocumented PeopleSoft pre-authentication RCE in a claimed FBI-related breach and against other unnamed targets. CIO’s October 5 report | That report said the claim lacked independent forensic confirmation; no CVE had been assigned, Oracle had not commented, and the issue was not listed in CISA’s Known Exploited Vulnerabilities catalog. The reported FBI-related breach and data theft are not independently confirmed there. |
Do not treat the September WAF-bypass reporting as proof of the alleged second flaw. Mandiant and Google described renewed exploitation of the already documented CVE-2026-35273. The existence and use of the separate flaw remained an allegation in the October 5 reporting.
How did the PeopleSoft WAF bypass work?
The bypass changed the request path from /PSEMHUB/ to /%50SEMHUB/. The characters %50 are the URL encoding for the letter “P.” A WAF or reverse proxy configured to match only the literal, unencoded path may not recognize the altered request. If the PeopleSoft application server decodes the URL before routing it, the request can still reach the vulnerable servlet.
#1 Best Overall
- INTEGRATED FIREWALL APPLIANCE AND SECURITY SERVICES: Comes with FortiGate-40F Firewall Appliance, 1 year of FortiCare Premium, and FortiGuard Unified Threat Protection.
- UTP SECURITY FEATURES: Offers protection from advanced threats with DNS filtering, URL filtering, video filtering, and controls against botnets.
- IDEAL FOR SMALLER SETTINGS: Best suited for small to mid-sized businesses needing reliable security without the complexity of larger systems.
- CONTINUOUS SUPPORT AND MAINTENANCE: FortiCare Premium ensures that technical help is readily available to manage and troubleshoot issues.
- COMPACT AND EFFECTIVE: Provides a powerful, yet compact security solution that effectively protects against a wide range of cyber threats.
This is a mismatch between how the perimeter filter checks a path and how the application interprets it. It does not, by itself, indicate a new vulnerability. Mandiant noted that an organization could believe a WAF rule had mitigated exposure while leaving the vulnerable PeopleSoft system unpatched. Mandiant and Google’s September 25 campaign report describes the renewed exploitation; TrendAI’s October 1 analysis also discusses the one-character path bypass.
Why literal matching can fail
- A request arrives with an encoded path such as
/%50SEMHUB/. - A perimeter rule checks the raw path and looks only for the literal text
/PSEMHUB/, so the encoded form may not match. - The application server decodes
%50toPand routes the request to the same PeopleSoft endpoint.
The defensive implication is straightforward: normalize or decode paths before applying path-based rules, and do not rely on those rules in place of Oracle’s patch. TrendAI also advises validating whether /PSEMHUB/hub is reachable from outside the network.
Rank #2
- Compact and Efficient Design: The FortiGate 40F is designed for small to mid-sized businesses and enterprise branch offices, featuring a compact, fanless desktop form factor that ensures quiet operation and minimizes space usage.
- Robust Connectivity Options: Equipped with 5 GE RJ45 ports, including 1 WAN port and 4 internal ports, this model provides essential connectivity and flexibility for various network configurations in a small-scale environment.
- High-Performance Security: Offers up to 1 Gbps IPS throughput and 600 Mbps threat protection throughput, using Fortinet’s purpose-built security processor technology to deliver industry-leading performance and protection for SSL encrypted traffic.
- Advanced Threat Protection: Integrated with Fortinet’s AI-powered FortiGuard Labs, the FortiGate 40F offers comprehensive cybersecurity, identifying and mitigating both known and unknown threats to maintain robust security across your network.
- Simplified Management and Deployment: Features a user-friendly management console that provides comprehensive network automation and visibility, coupled with Zero Touch Integration with Fortinet’s Security Fabric for easy deployment.
What happened, and how broad was the activity?
Mandiant and Google reported that UNC6240, which they identified as ShinyHunters, exploited CVE-2026-35273 from May 27 through June 9, 2026—before Oracle’s June 10 alert. That earlier activity was concentrated in higher education. Their September 25 report described renewed exploitation with broader international, cross-sector targeting and web shells deployed on dozens of systems.
Google said it notified over 100 organizations whose IP addresses correlated with potentially vulnerable endpoints in its June response. Those notifications do not mean that all recipients were confirmed victims. Google also reported that 68 percent of that notified organization set was in higher education; that is not the share of all exposed PeopleSoft deployments. Mandiant and Google’s description of web shells on dozens of systems in the September campaign is not a complete victim count or an infection rate. The cited reporting does not establish the total number of exposed installations or confirmed victims.
Rank #3
- SonicWall NSa4700 Appliance Only - No Service Subscription (02-SSC-4328) - Delivers very high firewall and threat prevention throughput with millions of concurrent connections for large enterprise networks and aggregation sites.
- Defends against ransomware, zero-day exploits, and encrypted malware with Capture ATP sandboxing and RTDMI for precise detection and blocking.
- Enterprise connectivity with multiple 10 GbE SFP+ and 1 GbE ports supports bandwidth-heavy applications and east-west segmentation.
- Scales for thousands of VPN tunnels and large remote workforces, enabling secure connectivity across global sites and data centers.
- Redundant power options and high availability modes provide resiliency for mission-critical operations.
For Oracle’s confirmed CVE, the alert lists PeopleTools 8.61 and 8.62. Oracle says patches and mitigations under its Security Alert program cover product versions in Premier or Extended Support and recommends that customers remain on actively supported releases. Confirm the applicable patch and support status for each deployed node against Oracle’s advisory.
Why this changes enterprise risk management
The incident exposes a practical weakness in treating a perimeter control as if it were remediation. A path rule can reduce traffic that matches its pattern, but it does not remove the vulnerable code. If the filter and application normalize the same request differently, a rule can create a false sense of protection. For the known CVE, the supported response is to patch affected systems and use Oracle’s configuration guidance—not to assume a WAF block makes an unpatched node safe.
Rank #4
- 150W High Output Power Supply – Delivers stable 12V DC 12.5A output for Sophos XGS desktop firewall appliances requiring a 150W external power adapter. Designed for continuous network security operation in business and enterprise environments.
- Compatible Sophos XGS Models – Compatible with Sophos XGS 116, XGS 116w, XGS 118, XGS 118w, XGS 126, XGS 126w, XGS 128, XGS 128w, XGS 136, XGS 136w and XGS 138 firewall security appliances.
- Reliable Enterprise Performance – Built for firewall, network gateway and security appliance applications where stable power delivery is critical for uninterrupted network operation and security services.
- Universal AC Input – Supports worldwide input voltage 100-240V AC, 50/60Hz for business, IT deployment and enterprise network installations across multiple regions.
- Professional Replacement Power Solution – Ideal replacement for aging, damaged or missing power adapters used with Sophos XGS Series security appliances. Provides dependable power for long-term deployment in office, MSP, education and enterprise environments.
The second-flaw allegation calls for disciplined uncertainty rather than either dismissal or escalation as confirmed fact. The October 5 report had no Oracle acknowledgment, assigned CVE, or independent forensic confirmation. Organizations should distinguish indicators and evidence tied to CVE-2026-35273 from claims tied to an unverified separate flaw, while promptly checking their PeopleSoft exposure and investigating any signs of compromise.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11| Control | What it does | What it does not establish |
|---|---|---|
| Oracle patch for CVE-2026-35273 | Remediates the known vulnerability on affected, supported PeopleSoft deployments when applied according to Oracle guidance. | It does not verify that a host was never compromised, nor does it establish remediation of the alleged second flaw. |
| WAF or reverse-proxy path rule | Can filter requests matching its configured conditions. | A literal-path rule may miss an encoded variant; path blocking alone does not patch the known vulnerability. |
| Disable or remove Environment Management Hub | Reduces exposure of the hub service or application when performed in the appropriate configuration. | It is not a substitute for patching or for investigating possible compromise. |
What PeopleSoft operators should do now
Use Oracle’s Security Alert and support guidance for the affected environment. The following checks reflect the incident-specific recommendations reported by Mandiant and Oracle; they do not replace an organization’s incident-response process or Oracle support advice.
Best Value
- Built on a purposed-built secure processor, this compact network firewall delivers the highest level of security performance and energy efficiency in its class – 2.5 Gbps IPS throughput | 1.3 Gbps threat protection | 1.4 Gbps SSL Inspection throughput.
- User-friendly management console gives you centralized visibility and simplifies policy enforcement across your network. Its zero-touch deployment helps you optimize your onboarding experience.
- Compact design equipped with 10 x GE RJ45 ports (including 7 x Internal Ports, 2 x WAN Ports, 1 x DMZ Port) provide essential connectivity and flexibility for various network configurations in branch offices.
- Patch the known vulnerability. Apply Oracle’s Security Alert patch for CVE-2026-35273 to affected PeopleSoft nodes. Do not treat WAF rules or path blocking as a substitute.
- Reduce Environment Management Hub exposure according to topology. In a multi-server configuration, disable the Environment Management Hub service. In a single-server configuration, remove the PSEMHUB application where appropriate, following Oracle’s guidance.
- Review PIA WebLogic access logs. Search for requests to
/PSEMHUB/and encoded or otherwise normalized variants, including/%50SEMHUB/. Pay particular attention to POST requests to/huband external requests to JSP files. - Inspect the deployed hub directory. Check
<PS_CFG_HOME>/webserv/<domain>/applications/peoplesoft/PSEMHUB.war/for files not included in the shipped product. Mandiant names examples includingx.jsp,u.jsp,tunnel.jsp,tunnel.jspx, andPle64.exe. Their presence warrants investigation; assess them in context rather than assuming a filename alone proves compromise. - Rotate credentials the application service account could read. Include database connection strings, Integration Broker credentials, and cloud credentials reachable from the web tier.
- Check host behavior and investigate evidence. Monitor outbound traffic from PeopleSoft hosts and investigate unexpected remote-management agents. If web shells or other evidence of compromise are found, treat the host as compromised and follow the organization’s incident-response process.
- Make perimeter inspection consistent. Configure and validate the WAF and reverse proxy so paths are decoded and normalized before rules match them. Separately verify whether
/PSEMHUB/hubis externally reachable.
Mandiant and Google’s technical reporting and Oracle’s advisory provide the primary incident and patch details: Google Cloud’s June 11 report on the education-sector exploitation, Google Cloud’s September 25 report on renewed exploitation, and Oracle’s June 10 Security Alert.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
