Attackers evade firewall rules to exploit Oracle PeopleSoft flaw

Attackers have renewed widespread exploitation of an Oracle PeopleSoft vulnerability by altering requests to evade web application firewall rules, Google's Mandiant said. The campaign has targeted organizations in several sectors, including healthcare, government and higher education, and placed web shells on dozens of systems. A web shell lets an attacker run commands through a compromised server. The attackers encode one character in the path to PeopleSoft's vulnerable Environment Management Hub. Some firewalls check the literal path before decoding it, while the application decodes the request and routes it to the vulnerable component. Google urged affected organizations to patch CVE-2026-35273 and check for encoded requests and malicious files.