Oracle PeopleSoft CVE-2026-35273 - PSEMHUB WAF Bypass Request

Georg Lauenstein@gsec

•updated 4 days ago•0•0•4

Detects HTTP requests to the PeopleSoft PSEMHUB servlet using alternate encodings such as the percent-encoded path %50SEMHUB. ShinyHunters/UNC6240 mass-exploit Oracle PeopleSoft CVE-2026-35273 against internet-facing systems and encode the path to defeat literal WAF signatures for /PSEMHUB/ (T1190, T1027).