ShinyHunters renews mass exploitation of critical Oracle PeopleSoft flaw

Some organizations put a guard at the front door instead of fixing the broken lock. Attackers changed how they wrote the address, got past the guard, and reached the same broken lock. The real fix is installing Oracle's security update and checking for signs attackers already got in.

PeopleSoft commonly handles HR and other sensitive enterprise data, exploitation is active, affected systems span government, healthcare, transportation, technology, agriculture and higher education, and the bypass undermines a mitigation some defenders relied on.

Mandiant observed renewed exploitation after earlier defensive guidance, with attackers bypassing literal-path WAF rules using URL encoding and compromising dozens of systems.

The material novelty is not another article about the summer campaign; it is Mandiant's confirmation that mass exploitation resumed and that attackers adapted specifically to bypass WAF mitigations used by organizations that had not installed Oracle's patch.

• Risk of unauthenticated remote code execution on vulnerable PeopleSoft systems
• Web-shell deployment and persistent unauthorized access
• Potential exposure of HR, personnel and other enterprise data
• Incident-response and service-disruption costs for affected organizations

• Higher third-party and supply-chain cyber risk where PeopleSoft integrates with identity, payroll or enterprise systems
• Increased regulatory and disclosure risk for compromised organizations
• Pressure on organizations to accelerate Oracle patching and credential rotation

The campaign is operationally significant but there is not yet evidence of broad market-wide disruption or a systemic outage. Cybersecurity vendors may see higher defensive demand, but direct financial impact remains organization-specific.

• The vulnerability is known and Oracle has issued an update
• Mandiant's reporting indicates organizations that patched are not relying solely on the bypassed WAF mitigation
• Public evidence reviewed does not establish compromise of every exposed PeopleSoft deployment
• No evidence reviewed shows systemic disruption of national critical infrastructure from this campaign

• Oracle patching removes the known vulnerable condition
• Disabling or removing the exposed Environment Management Hub/PSEMHUB component can reduce attack surface where operationally feasible
• Log review, web-shell hunting and credential rotation can contain post-exploitation risk

Shock Absorbers

• Existing vendor patch availability
• Network segmentation and least-privilege service accounts
• Endpoint and application monitoring capable of detecting web-shell or command-execution behavior

• Additional Mandiant or Oracle advisories confirming expanded exploitation
• CISA or other national cyber authorities adding emergency guidance or exploited-vulnerability directives
• More independently confirmed compromises across government or critical-infrastructure operators

• Evidence that reported renewed activity was limited or misattributed
• Rapid patch adoption accompanied by a sustained collapse in exploitation telemetry
• Mandiant materially revising its assessment

• Confirmed compromise of major national critical-infrastructure operators
• Large-scale theft of sensitive government or healthcare records
• Evidence of destructive activity, ransomware, or widespread service outages
• A distinct unpatched zero-day becoming part of the same campaign

• Broad patch adoption and declining exploitation telemetry
• No additional material compromises over the next several days
• Confirmed containment of affected systems without secondary propagation

Next 24 hours: additional victim disclosures and government advisories

Next 72 hours: evidence of campaign expansion, data theft or secondary extortion

Next 7 days: patch adoption, new indicators of compromise and attribution confidence

• Total number of compromised organizations is not yet public
• Full volume and sensitivity of stolen data are unknown
• Relationship between this campaign and separate claims involving FBI systems remains incompletely verified

Active exploitation has moved beyond the original wave because attackers adapted to defender behavior. The key risk distinction is patched versus merely WAF-mitigated PeopleSoft deployments.

• United States
• Multiple countries

• Government
• Higher Education
• Healthcare
• Technology
• IT Services
• Agriculture
• Transportation

• Oracle
• Google

• Oracle PeopleSoft
• CVE-2026-35273
• Enterprise HR and administrative systems

1. 01
   Source 1

   2026-09-25
2. 02
   Source 2

   2026-09-26