Urgent Patching Required for Oracle PeopleSoft Servers
Threat actors, specifically the ShinyHunters group, are successfully bypassing Web Application Firewalls (WAFs) to exploit a critical vulnerability in Oracle PeopleSoft (CVE-2026-35273). By utilizing a URL-encoding technique, attackers are circumventing security mitigations to deploy web shells and compromise vulnerable servers.
- Action Required: Ensure your Oracle PeopleSoft instances are fully patched against the latest CVE-2026-35273 exploits.
- Monitor Traffic: Check server logs for unusual URL-encoded requests that may indicate bypass attempts.
- Visibility is Key: With AI agents and various software suites experiencing recent security incidents, maintaining strict monitoring of all internet-facing infrastructure is essential.
In addition to the PeopleSoft threat, CISA has added critical vulnerabilities in Microsoft SharePoint and MikroTik RouterOS to its Known Exploited Vulnerabilities (KEV) catalog. We strongly recommend immediate review of these systems to ensure they are updated to the latest secure versions.