Attackers Bypass WAFs to Exploit Oracle PeopleSoft Flaw and Deploy Web Shells

Google has issued a warning about mass exploitation of CVE-2026-35273, a critical vulnerability (CVSS 9.8) in Oracle PeopleSoft. The flaw allows unauthenticated remote code execution and is being actively weaponized by threat actors linked to ShinyHunters. Attackers are bypassing Web Application Firewalls (WAFs) to exploit the vulnerability and deploy web shells on compromised systems. The campaign targets multiple sectors globally and the vulnerability was initially exploited as a zero-day. The activity represents a significant threat to organizations using Oracle PeopleSoft across various industries.