ShinyHunters percent-encode one letter to slip PeopleSoft's 9.8 RCE past the WAF

The bypass works because the WAF and the application decode the URL at different times. A signature that inspects the request path looks for the literal string /PSEMHUB/. The attacker sends /%50SEMHUB/hub instead, and %50 is the percent-encoding of a capital P, so the rule never matches ^[4]. WebLogic decodes the path before it routes the request, reads /PSEMHUB/hub, and passes it to the Environment Management Hub, the vulnerable feature ^[5].

Mandiant's September 25 report describes the requests as POSTs carrying serialized Java objects, sent to /%50SEMHUB/hub typically 5 to 15 times against unpatched hosts ^[3][6]. First the attacker reads the operating-system information the server returns to judge whether a host is worth pursuing, and some probed hosts showed no follow-on activity ^[15]. When a host is worth it, the pre-authentication RCE drops a JSP web shell such as x.jsp; Mandiant assesses the repeated, sequential JSPs as an attempt to propagate files to nodes behind a load balancer ^[7].

Scanning disk for x.jsp will not catch everything. Mandiant also observed commands running through shell processes that WebLogic spawns, with no JSP written to the file system, and the output returned inside the HTTP response body, which the report says avoids file-based detection on disk ^[8].

After the foothold the tooling splits by platform. On Windows, u.jsp and u2.jsp perform segmented uploads that reassemble into Ple64.exe, and SIDEEYE is loaded into memory from a modified but valid EV-signed file built on the Light Alloy installer; Mandiant confirmed credential theft and reverse-proxy capability in the malware ^[9]. Neo-reGeorg stands up a SOCKS proxy tunneled over HTTP(S) to reach internal systems ^[10]. On Linux, the group deploys MeshAgent, an open-source remote management tool, to hold its access ^[11].

Commands run as the OS account behind the WebLogic service ^[13]. Mandiant found that account was root or NT AUTHORITY\SYSTEM on some hosts, and the report is explicit that this alone does not mean the vulnerability escalated privileges ^[13].

The affected releases are PeopleTools 8.61 and 8.62, and Oracle has published a Security Alert Advisory for CVE-2026-35273 ^[14][16]. The attacker needs no account and works from outside the network, so any internet-reachable, unpatched EMHub is exploitable by whoever finds it first ^[12].