Exploitation of PSEMHUB Endpoint (CVE-2026-35273)

Ethan Andrews@eandrews

•updated Jun 12, 2026•5•0•20

Detects external HTTP POST requests to vulnerable Oracle PeopleSoft Environment Management Hub (PSEMHUB) and Integration Broker endpoints. This behavior is associated with UNC6240 (ShinyHunters) zero-day exploitation of CVE-2026-35273.