← Tuesday, September 29, 2026SecurityVulnerability

ShinyHunters bypassed PeopleSoft WAF rules with a URL-encoded path

cloud.google.com by Mandiant 12 min read Editor score 7/10

The campaign encoded one character in the PeopleSoft endpoint path, bypassing literal-path WAF rules before the application decoded and routed the request. The mismatch is a useful reminder that filtering and application routing must normalize paths consistently.

What: - ShinyHunters renewed mass exploitation of Oracle PeopleSoft's CVE-2026-35273, expanding targeting across multiple sectors.
How: - The attackers URL-encoded one character in the request path to bypass literal-string WAF rules; PeopleSoft decoded it and routed the request to the vulnerable servlet.
Why it matters: - WAF path blocking alone may leave systems exposed; Mandiant advises patching and checking logs for encoded path variants.

A URL-encoded path can pass WAF rules before PeopleSoft routes it to the vulnerable servlet. Sketched from the article's own text.

Read on cloud.google.com →

Discussion

Discussion is not switched on yet. Use Note above to keep your own thoughts on this story.

Headline, summary, brief and diagram are written by a model from the source's own text; the link, byline and numbers come from the source. Read the original before relying on a claim.