UNC6240 ShinyHunter PeopleSoft PSEMHUB Exploitation Followed by Suspicious JSP Web Shell Write

Arnold Chan@slaz

•updated Sep 27, 2026•2•0•4

This rule detects potential exploitation of the Oracle PeopleSoft PSEMHUB component vulnerability (CVE-2026-35273). It identifies suspicious POST requests to the PSEMHUB HttpListeningConnector servlet, including obfuscated URL paths, followed by the creation of suspiciously named .jsp or .jspx files in the PSEMHUB.war application directory, which is indicative of a web shell deployment.