CVE-2026-35273 Triage Runbook: Hardening PeopleSoft Against the ShinyHunters PSEMHUB Zero-Day

Executive Summary & Threat Analysis

n mid-2026, threat research groups and CISA issued critical advisories regarding active exploitation of CVE-2026-35273 (CVSS score 9.8), an unauthenticated Remote Code Execution (RCE) vulnerability targeting the PeopleSoft Environment Management Hub (PSEMHUB). Threat actors associated with the ShinyHunters adversary group leveraged this zero-day vector to breach over 100 enterprise environments, with higher-education institutions and state government agencies representing over 65% of confirmed targets.

The Attack Vector: Unauthenticated PSEMHUB Web Shell Injection

The vulnerability resides within the legacy PeopleSoft Environment Management (PSEMAgent / PSEMHUB) servlet infrastructure deployed on WebLogic application servers. The PSEMHUB servlet (/PSEMHUB/hub) is designed to receive environment diagnostics, heartbeat metrics, and patch deployment packages from distributed PSEMAgents running across database and application server nodes.

Due to missing authentication validation in unpatched PeopleTools releases (PeopleTools 8.61 and 8.62), an unauthenticated external attacker can submit crafted multipart HTTP POST requests to the PSEMHUB listener. The servlet deserializes malicious Java payloads or writes arbitrary JSP web shells directly into the public WebLogic expanded EAR directory structure (appserv/PORTAL/WEB-INF/ or applications/peoplesoft/).

<div class="process-flow">
  <div class="process-step">
    <div class="step-number">1</div>
    <div class="step-title">Attacker Scanning</div>
    <div class="step-desc">Attacker scans public Internet for exposed /PSEMHUB/hub endpoints.</div>
  </div>
  <div class="process-arrow">➔</div>
  <div class="process-step">
    <div class="step-number">2</div>
    <div class="step-title">Payload Upload</div>
    <div class="step-desc">Crafted HTTP POST bypasses auth and writes malicious JSP shell to web root.</div>
  </div>
  <div class="process-arrow">➔</div>
  <div class="process-step">
    <div class="step-number">3</div>
    <div class="step-title">RCE Execution</div>
    <div class="step-desc">Attacker invokes JSP shell to execute OS commands as the psadmin user.</div>
  </div>
  <div class="process-arrow">➔</div>
  <div class="process-step">
    <div class="step-number">4</div>
    <div class="step-title">Lateral Movement</div>
    <div class="step-desc">Attacker extracts db_connection_string and pivots into production database.</div>
  </div>
</div>

---

🔍 Emergency IOC Hunting (Indicators of Compromise)

Before applying web tier blocks, PeopleSoft administrators and security operations (SOC) teams must immediately inspect WebLogic access logs and filesystem directories to determine if active exploitation has occurred.

1. WebLogic Access Log Query for Suspicious PSEMHUB POST Requests

Run the following command on your WebLogic web server nodes (pia_domain/servers/PIA/logs/access.log) to search for unauthenticated HTTP POST requests directed to /PSEMHUB:

# Search for HTTP 200/500 POST requests targeting PSEMHUB endpoints
grep -i "POST /PSEMHUB" /psoft/pt860/webserv/peoplesoft/servers/PIA/logs/access.log | grep -E " 200 | 500 "

# Extract top external IP addresses submitting POST requests to PSEMHUB
awk '$7 ~ /\/PSEMHUB/ && $6 == "\"POST" {print $1}' /psoft/pt860/webserv/peoplesoft/servers/PIA/logs/access.log | sort | uniq -c | sort -nr

🚨 Warning Signal: If external IP addresses outside your internal admin management subnet are returning HTTP 200 on POST /PSEMHUB/hub, assume the system has been targeted and proceed to filesystem inspection immediately.

2. Inspect WebLogic Expanded Application Directories for Rogue .jsp Files

ShinyHunters actors typically drop randomized or obfuscated JSP files (e.g., cmd.jsp, system_check.jsp, cmd_win.jsp, or 8-character random names like x7k9p2a.jsp). Run find to scan for recently modified web files within the WebLogic domain:

# Scan WebLogic expanded web application directory for JSP files created/modified in the last 14 days
find /psoft/pt860/webserv/peoplesoft/applications/peoplesoft/ -type f -name "*.jsp" -mtime -14 -ls

# Search for suspicious Java runtime execution calls within JSP files
grep -rnw '/psoft/pt860/webserv/peoplesoft/applications/peoplesoft/' -e 'Runtime.getRuntime().exec' -e 'ProcessBuilder'

If suspicious .jsp files are identified, isolate the host node from the network, capture a memory dump for forensics, and preserve log files before taking remediation action.

---

🛡️ Emergency Mitigation: Isolating PSEMHUB at Web Tier & WebLogic

If immediate patching cannot be executed within 2 hours, administrators MUST isolate the /PSEMHUB endpoint at the reverse proxy (Nginx / F5 Big-IP) and WebLogic application server layer.

Step 1: Block /PSEMHUB via Nginx Reverse Proxy Rules

If your PeopleSoft Internet Architecture (PIA) is fronted by Nginx reverse proxies, add an explicit location block in your /etc/nginx/conf.d/peoplesoft.conf configuration to restrict /PSEMHUB access strictly to internal administrative jump boxes:

# Security Hardening for CVE-2026-35273: Restrict PSEMHUB to Admin Subnet
location /PSEMHUB {
    # Allow internal DBA & PSADMIN management subnets only
    allow 10.250.45.0/24;
    allow 192.168.100.50;
    
    # Deny all public and untrusted traffic
    deny all;

    proxy_pass http://peoplesoft_weblogic_cluster;
    proxy_set_header Host $host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto https;
}

Validate and reload Nginx configuration:

# Test Nginx syntax
nginx -t

# Reload configuration gracefully without dropping active sessions
nginx -s reload

Step 2: Disable PSEMHUB Web Application in WebLogic Console

For environments not using a reverse proxy, disable the PSEMHUB web application directly inside WebLogic Server:

1. Log into the WebLogic Server Administration Console (https://pia-host.example.com:7002/console).
2. Navigate to Domain Structure $\rightarrow$ Deployments.
3. Locate PSEMHUB in the deployments table.
4. Select the checkbox next to PSEMHUB, click Stop, and select Force Stop Now.
5. Once stopped, select PSEMHUB, click Delete, and confirm removal.

💡 Tip: Stopping or deleting PSEMHUB disables automated Environment Management Framework (EMF) diagnostic polling across agents, but has zero impact on end-user PIA access, Finance/HCM self-service, or batch Process Scheduler operations.

---

🔧 Permanent Remediation: Applying CPU Security Patches

To permanently resolve CVE-2026-35273, administrators must apply the official Oracle PeopleTools Security Patch Update or upgrade to the minimum secure PeopleTools maintenance release:

PeopleTools Release	Minimum Secure Release / Patch	Action Required
PeopleTools 8.61.x	Patch 8.61.08+	Apply PeopleTools 8.61.08 DPK Patch & redeploy WebLogic PIA domain
PeopleTools 8.62.x	Patch 8.62.02+	Apply PeopleTools 8.62.02 DPK Patch & update WebLogic binaries

Post-Patch Verification Runbook

After applying the PeopleTools patch and redeploying the PIA domain, verify that PSEMHUB enforces strict authentication tokens:

# Execute unauthenticated test request (Should return HTTP 403 Forbidden or 404 Not Found)
curl.exe -sL -w "%{http_code}" -A "Mozilla/5.0" "https://peoplesoft.example.com/PSEMHUB/hub" -o NUL

A secure response must return HTTP 403, HTTP 404, or HTTP 401. Any return of HTTP 200 indicates that unauthenticated servlet routing remains exposed.

---

📚 Official Documentation & Technical References

• Oracle Critical Patch Update Advisory — Official Oracle Security Advisory Portal
• Oracle PeopleTools Documentation — Official Oracle PeopleTools Documentation Portal
• Nginx Reverse Proxy Security Hardening — Official Nginx Access Control Documentation

---

Need an urgent security audit of your PeopleSoft PIA, WebLogic, or Oracle Database infrastructure? Contact our Security & ERP Specialists or explore our Enterprise Health Audits.