WAF-bypass exploitation burst against PSEMHUB endpoint (CVE-2026-35273)

Ankit Mehta@Secvyn

•updated Sep 27, 2026•7•0•26

Detects potential exploitation attempts targeting the vulnerable Oracle PeopleSoft PSEMHUB Environment Management Hub endpoint (associated with CVE-2026-35273 and UNC6240). The rule identifies suspicious bursts of POST requests where the URI path uses percent-encoding or mixed-case characters to evade Web Application Firewall (WAF) filtering.