Threat actors are getting creative—and it’s working. The ShinyHunters extortion group has discovered a deceptively simple technique to circumvent web application firewall protections designed to block exploitation of a critical Oracle PeopleSoft vulnerability. By leveraging URL encoding manipulation, they’re sidestepping defenses that organizations believed would keep them safe. This development underscores a sobering reality in modern cybersecurity: even well-intentioned security measures can fall short against determined attackers who understand the gaps.
The vulnerability in question, CVE-2026-35273, represents a significant threat to organizations running PeopleSoft infrastructure. When Oracle initially disclosed this flaw, many security teams deployed WAF rules as a quick protective measure while planning longer-term remediation. Those rules were meant to catch malicious requests targeting the vulnerability pattern. What ShinyHunters has demonstrated is that threat actors can obfuscate their attack payloads using URL encoding techniques—essentially disguising the malicious traffic in a way that passes through WAF filters undetected.
How the WAF Bypass Works
URL encoding is a fundamental web technology where special characters are represented by a percent sign followed by hexadecimal values. For instance, a forward slash becomes %2F, and other characters follow similar encoding patterns. Security teams implementing WAF rules typically look for specific strings or patterns in their raw form. If they’re not accounting for encoded variations, attackers can slip encoded payloads right past the defenses.
ShinyHunters appears to understand this weakness intimately. By encoding portions of their exploit code or request structure, they’re able to reach vulnerable PeopleSoft servers even when WAF protection is nominally active. The server processes the URL-decoded request on the backend, revealing the true malicious intent only after it has already bypassed the firewall layer. It’s a straightforward technique in concept, but remarkably effective in practice because it exploits the gap between what the WAF inspects and what the backend application actually processes.
The Data Breach Risk and Organizational Impact
PeopleSoft infrastructure often holds crown-jewel data for enterprises. These systems typically manage human resources information, payroll records, financial data, and other sensitive organizational assets. A successful data breach through PeopleSoft exploitation doesn’t just compromise individual records—it can expose comprehensive employee and financial information at scale. ShinyHunters’ demonstrated ability to resume widespread exploitation means organizations thought to be protected are potentially at risk right now.
The extortion angle makes this particularly concerning. ShinyHunters operates as an extortion gang, meaning their typical playbook involves stealing data, then demanding payment to prevent its public release or sale. Organizations that believed their WAF rules were mitigating this threat may discover they were never actually protected. The group can extract valuable data, contact victims with proof of compromise, and demand ransom before organizations even realize they’ve been breached. The reputational damage and regulatory consequences (GDPR, HIPAA, etc.) compound the financial threat.
The Security Patch Imperative
This situation crystallizes why security patches remain fundamental to enterprise defense strategy. WAF rules are a tactical holding action—useful, certainly, but never a substitute for actually fixing the underlying vulnerability. Organizations that have delayed patching PeopleSoft systems while relying on WAF protection need to reassess their timeline immediately. The existence of this bypass technique means WAF reliance is no longer viable; actual patching has moved from important to urgent.
Oracle released a security patch for this vulnerability, and deployment should now be treated as critical priority rather than standard maintenance window scheduling. The challenge, of course, is that PeopleSoft environments often run mission-critical systems, making patching complex and disruptive. But leaving systems vulnerable to known exploitation techniques that threat actors actively use in the wild is riskier than managing the patching process carefully but decisively.
Key takeaway: This incident demonstrates that cybersecurity defense requires layered approaches, and that individual controls—even expensive ones like WAF infrastructure—can become ineffective against sophisticated threat actors. Organizations must pair preventive controls with the foundational practice of applying security patches promptly. Relying exclusively on WAF protection while deferring patches is a losing strategy, particularly for critical vulnerabilities actively exploited by groups like ShinyHunters.
The message to security teams is clear: audit your current PeopleSoft deployments, verify patch status, and don’t trust WAF rules alone to protect business-critical systems. How many systems in your infrastructure are running behind WAF protection while waiting for patches that should have been applied months ago?
Get Tech Savvy Digest in your inbox
IT news, cybersecurity, and crypto — the signal, not the noise. No spam, unsubscribe anytime.