Topic

Cve 2026 35273

Coverage tagged cve 2026 35273.

Articles: 1
Desk: 1

Data graphic: one percent-encoded letter, /%50SEMHUB/, gets past WAF rules that block /PSEMHUB/. The attack path runs from the POST request through the WAF, which matches the literal path, to the app server that decodes it, then the PSEMHUB servlet and a web shell or fileless commands, for CVSS 9.8 Critical CVE-2026-35273.

criticalExploits Cve 2026 35273

ShinyHunters Exploits Oracle PeopleSoft CVE-2026-35273 via WAF Bypass

GTIG says UNC6240 (ShinyHunters) is again exploiting PeopleSoft CVE-2026-35273, using /%50SEMHUB/ to slip past WAF rules. Patch, then hunt.

Oct 2 · 5 min