title: 'T1190 Oracle PeopleSoft PSEMHUB Request via a Non-Canonical Path (UNC6240 WAF Bypass)'
id: 'd933d5bb-9db8-5657-96dc-5ed0bb53671c'
status: 'experimental'
description: 'A web request for the PeopleSoft Environment Management Hub (PSEMHUB) written any way other than the literal /PSEMHUB/: a percent-encoded letter (/%50SEMHUB/hub), mixed or lower case (/psemhub/hub), an encoded slash or a path parameter after it, or a JSP under PSEMHUB or PORTAL. UNC6240 (ShinyHunters) exploits CVE-2026-35273, a Java deserialization flaw in the PSEMHUB hub servlet, and since September 2026 routes around WAF and reverse-proxy rules that match the literal string /PSEMHUB before decoding: WebLogic decodes the path and serves the vulnerable servlet anyway. Before exploiting, the actor sends five to fifteen POST requests to the hub to confirm the host is unpatched, so this fires on reconnaissance that may never be followed by a web shell. Google advises assuming any percent-encoded, mixed-case or otherwise non-normalized variant. EMHub agents in multi-server installs request the literal path, so only the non-canonical forms are the signal; a JSP under PSEMHUB or PORTAL is how the dropped web shells are reached. Match the raw request line, before the logging proxy normalizes it.'
references:
    - 'https://cloud.google.com/blog/topics/threat-intelligence/shinyhunters-renewed-mass-exploitation-campaign-targeting-oracle-peoplesoft/'
    - 'https://thrunt.me/hunt/shinyhunters/'
    - 'https://attack.mitre.org/techniques/T1190/'
author: 'Applied Cybernetics Group (via thrunt.me)'
date: '2026-10-24'
modified: '2026-10-24'
tags:
    - 'attack.initial_access'
    - 'attack.t1190'
    - 'cve.2026-35273'
    - 'detection.emerging-threats'
    - 'tlp.clear'
logsource:
    category: 'webserver'
detection:
    # PSEMHUB in any case, any letter optionally percent-encoded, followed by a
    # slash, an encoded slash, a path parameter or the end. No lookahead or
    # inline flags, so the pattern ports to backends with plain regex.
    selection_hub:
        cs-uri-stem|re: '/([pP]|%50|%70)([sS]|%53|%73)([eE]|%45|%65)([mM]|%4[dD]|%6[dD])([hH]|%48|%68)([uU]|%55|%75)([bB]|%42|%62)([/;]|%2[fF]|$)'
    filter_canonical:
        cs-uri-stem|re: '/PSEMHUB(/|$)'
    selection_jsp:
        cs-uri-stem|re: '/(([pP]|%50|%70)([sS]|%53|%73)([eE]|%45|%65)([mM]|%4[dD]|%6[dD])([hH]|%48|%68)([uU]|%55|%75)([bB]|%42|%62)|[pP][oO][rR][tT][aA][lL])(/|%2[fF])[^?]*\.[jJ][sS][pP][xX]?$'
    condition: '(selection_hub and not filter_canonical) or selection_jsp'
falsepositives:
    - 'None expected for the non-canonical path; nothing legitimate encodes or re-cases a static servlet path.'
    - 'The JSP selection can match a PeopleSoft build that serves JSP pages under PSEMHUB or PORTAL. Compare against a clean PSEMHUB.war and PORTAL.war before tuning it out.'
    - 'EMHub agent traffic in multi-server configurations requests the literal /PSEMHUB/hub path and is excluded by filter_canonical.'
level: 'high'