Mandiant Uncovers WAF Bypass Campaign Exploiting Critical Oracle PeopleSoft CVE-2026-35273
Mandiant has identified an ongoing campaign exploiting CVE-2026-35273, a critical vulnerability in Oracle PeopleSoft with a CVSS score of 9.8. The flaw resides in the Environment Management Hub, known as PSEMHUB, and enables unauthenticated remote code execution.
The distinctive element of this wave is a simple web application firewall bypass that depends on a single character. Attackers substitute the path /PSEMHUB/ with /%50SEMHUB/, where %50 represents the URL encoding of the letter P. Many WAF and reverse-proxy rules compare the literal path before decoding the URL, while the PeopleSoft application server decodes the request and forwards it to the vulnerable servlet.
Exploitation and Web Shell Deployment
Exploitation occurs through Java object deserialization. Attackers send specially crafted POST requests to /%50SEMHUB/hub containing serialized Java objects. Successful exploitation results in the installation of two JSP web shells inside the PSEMHUB.war directory.
- x.jsp executes operating-system commands across multiple platforms.
- u.jsp supports chunked file uploads and execution via cmd.exe.
Persistence and Tooling
Following initial access, the operators deploy a trojanized installer named Ple64.exe that loads the SIDEEYE backdoor. They additionally install the Neo-reGeorg tunneling tool and the remote administration framework MeshAgent. Approximately one quarter of observed commands were executed with root or SYSTEM privileges.
The activity is attributed to UNC6240, a group linked to ShinyHunters. The campaign began as a zero-day targeting educational institutions in June 2026 and has since expanded to higher education, technology, healthcare, agriculture, transportation, and government organizations. No Oracle patch is referenced in the current analysis.
Related articles
Critical Vulnerability CVE-2026-76519 in Cisco Secure Email Gateway Allows Arbitrary File Writes Without Authentication
Cisco Systems has disclosed a critical vulnerability in its Cisco Secure Email Gateway product that affects the Advanced Malware Protection feature responsible for processing email attachments. The flaw, tracked as CVE-2026-76519, permits unauthenticated attackers to write arbitrary files to the underlying operating system by sending a specially crafted email attachment. Successful exploitation can lead to remote command execution with root privileges. The vulnerability received a CVSS v3.1 base score of 9.8 and is rated Critical. Cisco confirmed active exploitation of the issue in October 2026, shortly after publishing the security advisory on October 14, 2026. This marks the second publicly disclosed exploited vulnerability in the product within a short period, though the flaws are unrelated.
Cyberattack Exploits Exposed Danfoss Refrigeration Controllers Across French Supermarkets
A remote cyberattack targeted Danfoss AK-SM 8xxA Series controllers in French supermarkets, allowing attackers to manipulate refrigeration parameters and trigger defrost cycles that raised temperatures and spoiled food stock. The incident impacted an estimated 250 to 350 stores belonging to major chains including Intermarché, Carrefour Market, Leclerc, and others. Paris prosecutors have opened a large-scale investigation into the attack and associated damages, including potential fires. The root cause traces to outdated software on internet-exposed OT management interfaces, with multiple CVEs enabling authentication bypass and remote code execution. Thousands of similar Danfoss systems remain publicly accessible worldwide, highlighting persistent OT exposure risks. Immediate remediation steps include closing web consoles, enforcing VPN access, and applying updates to versions 4.2 and 4.3.1 or later.
Three Zero-Days Chained in Ivanti Connect Secure Grant Root Access Without Login
An attacker chained three zero-day vulnerabilities in Ivanti Connect Secure to execute commands as root without authentication. The compromised appliance was running the fully patched version 22.8R2.4 when exploitation began on October 3. Volexity discovered the intrusion, attributed the activity to UTA0576 with low confidence in criminal rather than espionage motives, and reported the flaws to the vendor. Ivanti acknowledged limited in-the-wild exploitation on October 13. The first two issues, an authentication bypass and remote code execution, were combined under CVE-2026-104935 with a CVSS score of 8.6, allowing code execution as the cgi-server user. A third privilege-escalation flaw then elevated access to root. The final flaw lacked a patch at disclosure time, with a fix promised in an upcoming release. CISA classified the exploitation as active with total technical impact.
CTEM Without the Hype: Understanding Gartner's Continuous Threat Exposure Management Framework
The article explains the evolution of vulnerability management from basic scheduled scanning to risk-based approaches and finally to Continuous Threat Exposure Management (CTEM). It positions CTEM as a comprehensive program introduced by Gartner in 2022 that integrates asset management, EASM, CAASM, automated pentesting, and business-context prioritization. The five-stage cycle of Scoping, Discovery, Prioritization, Validation, and Mobilization is detailed with practical examples such as protecting customer databases in an e-commerce environment. Gartner predicts organizations prioritizing CTEM will suffer three times fewer breaches by 2026, though only 16% have reached operational maturity. The piece also covers common implementation pitfalls and the emergence of the first Magic Quadrant for Exposure Assessment Platforms featuring vendors like Tenable, Qualys, and Rapid7.