CVE-2026-35273: ShinyHunters WAF Bypass on Oracle PeopleSoft — Detection and Hardening Guide

Security teams running Oracle PeopleSoft behind a web application firewall need to hear this plainly: the mitigation you deployed may no longer be holding. The ShinyHunters extortion gang — a group with a long track record of mass data theft and extortion against enterprise platforms — is actively using a URL-encoding trick to bypass WAF rules written to mitigate CVE-2026-35273, a critical vulnerability in Oracle PeopleSoft. The result is that exploitation of vulnerable servers has resumed at scale, even in environments where defenders believed the WAF had bought them time to patch.

This is a pattern I have seen repeatedly across 15 years of incident response: a virtual patch is deployed, the ticket is closed as 'mitigated,' and the underlying vulnerable application stays unpatched while the attacker iterates on encoding until the rule stops matching. If your PeopleSoft remediation plan was 'the WAF blocks it,' you are exposed right now.

Technical Analysis

What We Know

• Threat actor: ShinyHunters — a financially motivated extortion group known for stealing large datasets and extorting victim organizations.
• Affected product: Oracle PeopleSoft (exposed via the PeopleSoft Internet Architecture / PIA web tier, typically fronted by WebLogic and often load balancers, reverse proxies, or cloud WAFs).
• Vulnerability: CVE-2026-35273 — a 2026 flaw in Oracle PeopleSoft that was previously being mitigated at the network edge via WAF signatures.
• Bypass technique: URL-encoding manipulation. Attackers encode characters in the request URI or payload so that the WAF's pattern-matching engine fails to normalize and match the malicious request, while the origin PeopleSoft application decodes the same request successfully and processes the exploit. Classic variants of this technique include double percent-encoding (e.g., %25 sequences), encoding of path and parameter delimiters (e.g., %2F, %3F, %26), and mixed-case or overlong encodings that the WAF treats as benign but the application layer resolves.
• Exploitation status: Confirmed active, in-the-wild, and described as widespread. This is not a theoretical bypass — it is being used in an ongoing extortion campaign.

Why the WAF Bypass Works

The root cause of this class of failure is a canonicalization mismatch between the inspection layer and the application layer:

1. The WAF receives the request and applies its rule against the raw or singly-decoded URI.
2. The attacker has encoded one or more signature-critical characters — sometimes twice — so the WAF rule never matches.
3. The web tier (WebLogic/PIA) decodes the request one or more times before the PeopleSoft application logic processes it, reconstituting the original exploit payload.
4. The exploit executes exactly as if no WAF existed.

Any WAF rule for CVE-2026-35273 that does not perform recursive decoding before pattern matching should be assumed bypassable. Additionally, rules anchored to a single literal URI path will fail if the attacker encodes path segments or injects encoded traversal sequences that resolve to the same endpoint.

What Is at Risk

PeopleSoft environments commonly hold HR records, payroll data, student records (in higher education), financial data, and identity information — precisely the high-value datasets ShinyHunters monetizes through extortion. Successful exploitation means data theft followed by an extortion demand, with regulatory exposure layered on top (state breach notification laws, FERPA for education, HIPAA where health-adjacent HR data is involved).

Detection & Response

Detection for this campaign lives at the web tier. Your WAF will not alert on the bypassed requests — that is the entire point of the technique — so you need telemetry downstream of the WAF: origin web server access logs (WebLogic/PIA access logs, reverse proxy logs) and any full-URI logging that preserves the raw, encoded request.

Key detection hypotheses:

• Requests to PeopleSoft PIA endpoints containing percent-encoded characters that are abnormal for legitimate traffic — especially %25 (double encoding), %2F, %2E, %3F, %26, and backslash encodings in the URI path.
• Repeated requests from a single source probing encoded variants of the same endpoint (an iterative bypass attempt pattern).
• Requests where the encoded URI decodes to a path that matches a known exploit signature for CVE-2026-35273.

The following Sigma rules target web server log sources (Apache/Nginx/IIS-format access logs ingested via your SIEM pipeline):

---
title: Suspicious URL Encoding Targeting Oracle PeopleSoft PIA Endpoints
id: 3b7f2a91-4c6d-4e58-a921-8f0c3d5e7a12
status: experimental
description: Detects requests to PeopleSoft PIA paths containing double-encoding or encoded delimiters consistent with the ShinyHunters WAF bypass technique against CVE-2026-35273.
references:
  - https://www.bleepingcomputer.com/news/security/shinyhunters-uses-waf-bypass-trick-in-oracle-peoplesoft-attacks/
  - https://attack.mitre.org/techniques/T1190/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.initial_access
  - attack.t1190
logsource:
  category: webserver
detection:
  selection_peoplesoft_path:
    cs-uri|contains:
      - '/psp/'
      - '/psc/'
      - '/cs/'
      - '/EMPLOYEE/'
      - '/peoplesoft'
  selection_encoded:
    cs-uri|contains:
      - '%25'
      - '%252e'
      - '%252f'
      - '%2e%2e'
      - '%2f%2f'
      - '%3f'
      - '%00'
  condition: selection_peoplesoft_path and selection_encoded
falsepositives:
  - Legitimate applications that URL-encode query parameter values containing reserved characters
  - Scanner/vulnerability assessment traffic
level: high
---
title: High-Volume Encoded Request Probing Against Web Applications
id: 9d1e4c73-2b8a-4f17-93c6-5a2d8e1f6b04
status: experimental
description: Detects iterative probing behavior where a single source issues multiple encoded-URI requests, consistent with an attacker fuzzing WAF decoding behavior to bypass CVE-2026-35273 mitigations.
references:
  - https://www.bleepingcomputer.com/news/security/shinyhunters-uses-waf-bypass-trick-in-oracle-peoplesoft-attacks/
  - https://attack.mitre.org/techniques/T1190/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.initial_access
  - attack.t1190
logsource:
  category: webserver
detection:
  selection:
    cs-uri|contains: '%'
  condition: selection | count(cs-uri) by c-ip > 25
  timeframe: 5m
falsepositives:
  - API clients with heavy query-string usage
  - Load balancer health checks misconfigured with encoded parameters
level: medium

For Microsoft Sentinel, hunt WAF and proxy telemetry ingested via CEF. The critical point: compare what the WAF logged against what reached the origin. Requests present in origin logs but absent from WAF logs (or logged as allowed) with heavy encoding are your smoking gun.

// Hunt encoded requests reaching PeopleSoft endpoints via WAF/proxy CEF logs
CommonSecurityLog
| where TimeGenerated > ago(24h)
| where RequestURL contains "%25"
   or RequestURL contains "%2e%2e"
   or RequestURL contains "%252f"
   or RequestURL contains "%252e"
   or RequestURL has_any ("/psp/", "/psc/")
| where RequestURL has_any ("psp", "psc", "peoplesoft", "EMPLOYEE")
   or DeviceAction =~ "allowed"
| extend EncodedIndicator = extract(@"(%25[0-9a-fA-F]{2}|%2[eE]%2[eE]|%2[fF])", 1, tostring(RequestURL))
| summarize RequestCount = count(), EncodedVariants = dcount(EncodedIndicator), SampleURLs = make_set(RequestURL, 5)
  by SourceIP, DestinationHostName, DeviceAction, bin(TimeGenerated, 15m)
| where EncodedVariants > 1 or RequestCount > 10
| order by RequestCount desc

If you collect origin web server access logs into Sentinel via the Syslog/AMA pipeline, run the same logic against Syslog where ProcessName matches your log shipper and the message contains encoded URI patterns — the WAF is blind to these requests by design, so the origin log is ground truth.

For endpoint forensics on the web tier itself, use Velociraptor to sweep origin access logs for encoded requests, bypassing SIEM ingestion gaps entirely:

-- Hunt PeopleSoft access logs for URL-encoding bypass artifacts
LET logs = SELECT FullPath
FROM glob(globs=['/u01/*/access.log', '/opt/*/logs/access_log', '/var/log/nginx/access.log', '/var/log/apache2/access.log', 'C:/Oracle/**/access_log'])

SELECT FullPath, Line,
       parse_regex(string=Line, regex='GET\s+([^\s]+)').g1 AS RequestURI
FROM foreach(row=logs,
  query={
    SELECT FullPath, Line
    FROM parse_lines(filename=FullPath, accessor='file')
    WHERE Line =~ '%25|%2e%2e|%252f|%2f%2f'
      AND Line =~ 'psp|psc|EMPLOYEE|peoplesoft'
  })

Immediate Verification Script

Run this on (or against) your PeopleSoft web tier to pull candidate bypass requests from local access logs. This gives you a same-day answer on whether you have been probed or exploited, independent of your SIEM coverage.

#!/bin/bash
# ShinyHunters CVE-2026-35273 WAF-bypass log sweep
# Searches web tier access logs for encoded URI patterns hitting PeopleSoft endpoints

LOG_DIRS="/var/log/nginx /var/log/apache2 /var/log/httpd /u01 /opt/oracle /opt/Oracle"
OUT="peoplesoft_bypass_sweep_$(date +%Y%m%d_%H%M%S).txt"

echo "[+] Searching access logs for encoded PeopleSoft requests..."

find $LOG_DIRS -type f \( -name "access*log*" -o -name "access_log*" \) 2>/dev/null | while read -r f; do
  matches=$(zgrep -aE '%25[0-9a-fA-F]{2}|%2e%2e|%252e|%252f|%2f%2f' "$f" 2>/dev/null \
    | grep -aiE 'psp|psc|EMPLOYEE|peoplesoft' | grep -aiE 'GET|POST')
  if [ -n "$matches" ]; then
    echo "=== $f ===" >> "$OUT"
    echo "$matches" >> "$OUT"
  fi
done

if [ -s "$OUT" ]; then
  echo "[!] Suspicious encoded requests found — review $OUT and treat as active probing."
  echo "[!] Extract unique source IPs:"
  grep -aoE '^([0-9]{1,3}\.){3}[0-9]{1,3}' "$OUT" | sort | uniq -c | sort -rn | head -20
else
  echo "[+] No matching encoded PeopleSoft requests found in scanned logs."
fi

echo "[+] Reminder: absence of findings in WAF logs is NOT evidence of absence. Verify against ORIGIN logs."

Remediation

1. Patch the application — the WAF is not a fix. Apply the Oracle Critical Patch Update (CPU) that remediates CVE-2026-35273 to every PeopleSoft/PIA instance, including non-production environments reachable from the internet. Consult the Oracle Security Alert advisory at https://www.oracle.com/security-alerts/ for the exact patch set for your PeopleTools version. A WAF rule is a compensating control, and this campaign demonstrates it is a bypassable one.
2. Audit and rebuild your WAF rules. Confirm your WAF performs recursive/multi-pass URL decoding before signature evaluation. Rules must match against the fully canonicalized URI, not the raw request. Test explicitly with double-encoded payloads (%252e, %252f) against a staging rule set — if the rule misses them, it misses ShinyHunters.
3. Normalize at the edge. Where possible, configure your reverse proxy or load balancer to reject requests containing double-encoded sequences (%25 followed by hex) outright. There is almost no legitimate business reason for a doubly-encoded URI to reach PeopleSoft.
4. Restrict PeopleSoft exposure. PIA portals should not be internet-facing without strong justification. Place them behind authenticated gateways, VPN/ZTNA, or IP allowlists where feasible. Every day the portal is publicly reachable, it is being scanned.
5. Retrohunt now. Use the queries above against at least 30 days of origin web logs. ShinyHunters' model is steal first, extort later — you may already be compromised without knowing it. If you find hits, pivot to full IR scoping: authentication logs, database access audit trails, and egress traffic for bulk data exfiltration.
6. Prepare for the extortion phase. If exploitation is confirmed, engage your IR retainer and legal counsel early. Preserve WAF, proxy, and database audit logs before retention windows expire.

The Bottom Line

This campaign is a textbook lesson in defense-in-depth failure. The industry response to CVE-2026-35273 was heavily weighted toward edge mitigation, and ShinyHunters simply encoded their way around it. Virtual patching buys time — it does not close vulnerabilities. If PeopleSoft is in your environment, treat patch deployment as urgent this week, verify your WAF's decoding behavior with live testing, and assume probing has already occurred until your origin logs prove otherwise.

Related Resources

Security Arsenal Healthcare Cybersecurity AlertMonitor Platform Book a SOC Assessment healthcare Intel Hub