Attackers Bypass WAFs to Exploit Oracle PeopleSoft Flaw and Deploy Web Shells

Google has warned of renewed mass exploitation of a known security vulnerability in Oracle PeopleSoft as part of a campaign targeting multiple sectors globally. The activity, linked to threat actors associated with ShinyHunters, involves the weaponization of CVE-2026-35273, a critical security flaw with a CVSS score of 9.8 that could result in unauthenticated remote code execution.

The vulnerability, CVE-2026-35273, affects Oracle PeopleSoft environments. According to reports, attackers are bypassing Web Application Firewalls (WAFs) to exploit the flaw and deploy web shells for unauthorized access. The exploitation was first observed as a zero-day and has been renewed as a mass exploitation campaign in September 2026, targeting various sectors worldwide.

Oracle PeopleSoft deployments face the risk of unauthenticated remote code execution, which could lead to data exfiltration and full system compromise. The attackers' ability to bypass WAF protections increases the risk for organizations that rely on these security controls to shield their PeopleSoft instances.

Google and The Hacker News have reported on the campaign, attributing the activity to ShinyHunters-linked threat actors. However, the exact zero-day timeline, the full scope of affected sectors, and the definitive linkage to ShinyHunters remain unconfirmed and should be monitored through official Oracle security advisories and Google threat intelligence updates. Oracle has released a security update to address CVE-2026-35273, and immediate patching is recommended for all affected PeopleSoft environments.