Exploiting vulnerabilities in Oracle PeopleSoft systems to hide a web presence

Reporting by Uzbekistan UZCERT IncidentsRead the original at uzcert.uz

Executive Summary

Attackers exploited a critical vulnerability, CVE-2026-35273, within the Environment Management component of Oracle PeopleSoft systems to gain unauthenticated network access. This vulnerability has a CVSS score of 9.8 and allows remote code execution. The compromise of PeopleSoft servers risks exposing sensitive organizational data, including employee information, financial records, student data, and internal resources. Attacks were actively observed between May 27 and June 9, 2026, primarily targeting higher education institutions. Perimeter defenses like Web Application Firewalls (WAF) proved insufficient because attackers bypassed them by exploiting differences in request processing, such as URL encoding a single character to evade pattern matching. Subsequent exploitation involved installing web shells, such as x.jsp and u.jsp, and deploying remote control tools like SIDEEYE or MeshCentral. The danger extends beyond the server itself, as successful compromise can lead to access to database credentials and integration accounts.

Facts Only

* Vulnerability: CVE-2026-35273 exists in the Environment Management component of Oracle PeopleSoft PeopleTools versions 8.61 and 8.62.
* Exploitation method: Attackers gained access without authentication over the network.
* Impact: Successful exploitation allows remote code execution and takeover of the PeopleSoft environment.
* Affected data types: Employee/personnel data, payroll/financial information, student information, database connection settings, inter-system integration data, and internal resources.
* Exploitation timeline: Attacks were actively exploited between May 27 and June 9, 2026, with a zero-day assessment before official announcement.
* Bypass technique: Attackers bypassed WAF by sending URL-encoded paths, such as /%50SEMHUB/, exploiting differences between the WAF and PeopleSoft server's request processing.
* Payloads identified: Web shells included x.jsp, u.jsp, tunnel.jsp, and tunnel.jspx, along with Ple64.exe.
* Fileless technique: Commands were executed directly in memory; shell processes like cmd.exe or /bin/sh from the WebLogic Java process were suspicious.
* Post-exploitation tools: A trojanized installer leading to a SIDEEYE backdoor and remote control infrastructures like MeshCentral/MeshAgent were identified.
* Privilege escalation: Commands were sometimes executed with root or NT AUTHORITY\SYSTEM privileges, leveraging PeopleSoft service accounts for access to configuration files and database information.

Full Take

The narrative highlights a critical failure in layered security defense, where reliance on perimeter controls like WAF proved insufficient against sophisticated internal logic manipulation. The successful bypass using URL encoding of single characters exposes a fundamental gap: defenses focused solely on surface-level text matching fail when the underlying application layer interprets data differently than the security inspection layer. This suggests that contextual understanding of application flow—the difference between an external request handler and an internal server process—must be integrated into defense strategy, rather than treating perimeter rules as absolute barriers. Furthermore, the post-exploitation phase demonstrates a clear pattern where attackers pivot from initial access to leveraging legitimate system components (like WebLogic) for command execution and lateral movement via seemingly benign tools like remote management platforms. The finding that fileless execution avoids traditional antivirus signatures underscores a systemic shift in threat modeling away from static file monitoring toward continuous behavioral process monitoring within complex application stacks. The risk is amplified because the compromise grants access not just to data, but to the intricate relationships within an organization's interconnected processes, making remediation require deep auditing of system service accounts and application configurations, rather than isolated endpoint patching.

From the original · Uzbekistan UZCERT Incidents

They are installing hidden web shells by exploiting weaknesses in Oracle PeopleSoft systems! New attacks have been identified against Oracle PeopleSoft systems.

Read the full story at uzcert.uz

Sentinel — Human

Confidence

This text appears to be a detailed security advisory synthesized from technical research, demonstrating strong coherence and specific detail typical of expert analysis, though some elements may have been structured by an LLM.

Signals Detected

Sentence length variance and structural complexity are varied, typical of complex technical reporting.

The text maintains a strong, focused argumentative thread linking a specific vulnerability (CVE) to exploitation techniques and remediation steps without excessive hedging.

Structured presentation of technical details (exploits, IoCs, mitigation steps) suggests organized source material, even if synthesized.

Specific CVE numbers, version references, and technical flow are highly specific, requiring deep domain knowledge, which slightly reduces the confidence that this is pure synthetic generation without human oversight or primary source material.

Human Indicators

The detailed breakdown of the WAF bypass mechanism (%50SEMHUB vs /PSEMHUB) and the subsequent technical exploitation steps (shell files, tunneling) suggests deep, operational knowledge that is typically embedded by human analysts or reporters.

The final section acts as a clear, prescriptive set of actionable recommendations based on threat intelligence, which reflects an intent to guide readers based on specific findings.