oracle Archives | Security Sense

Overview

The ShinyHunters extortion gang is actively targeting Oracle PeopleSoft servers, utilizing a sophisticated URL-encoding trick to circumvent Web Application Firewall (WAF) protections. This technique allows them to bypass rules intended to block exploitation of CVE-2026-35273, enabling continued widespread attacks against vulnerable systems. Organizations running Oracle PeopleSoft are at risk of data exfiltration and extortion if their WAFs are not configured to detect these bypass methods.

Technical Analysis

Target: Oracle PeopleSoft applications.
Vulnerability: Exploitation of CVE-2026-35273. Specific details of the underlying flaw are not provided in the source, but it is described as an Oracle PeopleSoft vulnerability.
Attack Vector: Web-based requests to the PeopleSoft application.
WAF Bypass Method: Threat actors employ a URL-encoding trick. This involves encoding parts of the malicious payload or request in a way that WAFs fail to properly decode or inspect, allowing the exploit payload to reach the application layer.
Impact: Successful exploitation can lead to unauthorized access, data exfiltration, and subsequent extortion demands by the ShinyHunters group.

Detection

Web Server Logs: Monitor web server access logs (e.g., Apache, Nginx, IIS) for requests targeting PeopleSoft application paths.
URL Encoding Anomalies: Look for unusually high levels of URL encoding (%xx sequences) within cs-uri-stem, cs-uri-query, or request bodies, especially when combined with common exploit patterns.
WAF Alerts: Review WAF logs for blocked requests that might indicate attempted exploitation, and analyze patterns of requests that are not blocked but contain suspicious encoding.
Application Logs: Monitor Oracle PeopleSoft application logs for signs of unusual activity, unauthorized access, or unexpected commands being executed.

Sigma Detection Rules

⚠️ AI-generated detection rules. These are experimental starting points. Review field names, EventIDs, and logic against your environment’s schema before deploying. Tune to reduce false positives.

Web Server – Suspicious URL Encoding in Request

title: Web Server - Suspicious URL Encoding in Request
id: 6a3e5b1c-d7f8-4e9a-b0c1-2f3d4e5a6b7c
status: experimental
description: Detects web requests containing multiple or specific URL-encoded characters often used in WAF bypasses or obfuscated attacks against web applications like Oracle PeopleSoft.
logsource:
  category: webserver
detection:
  selection_encoded_chars:
    cs-uri-stem|contains:
      - '%252f' # Double encoded slash
      - '%2f'   # Encoded slash
      - '%5c'   # Encoded backslash
      - '%3c'   # Encoded less than
      - '%3e'   # Encoded greater than
      - '%22'   # Encoded double quote
      - '%27'   # Encoded single quote
      - '%7b'   # Encoded open brace
      - '%7d'   # Encoded close brace
      - '%20'   # Encoded space
      - '%u002f' # Unicode encoded slash
      - '%u005c' # Unicode encoded backslash
  condition: selection_encoded_chars
level: high

Mitigations

Patch Oracle PeopleSoft: Apply all available security patches for Oracle PeopleSoft, specifically addressing CVE-2026-35273 and any related vulnerabilities.
Enhance WAF Rules: Review and update WAF configurations to ensure robust decoding capabilities and comprehensive inspection of URL-encoded content. Implement rules that specifically look for double-encoding or other bypass techniques.
Input Validation: Implement strict input validation at the application layer to sanitize and validate all user-supplied data, reducing the effectiveness of encoded payloads.
Network Segmentation: Isolate PeopleSoft servers on a dedicated network segment with strict ingress/egress filtering to limit potential lateral movement in case of compromise.
Regular Audits: Conduct regular security audits and penetration tests on PeopleSoft deployments to identify and remediate vulnerabilities and WAF bypasses.

References

https://www.bleepingcomputer.com/news/security/shinyhunters-uses-waf-bypass-trick-in-oracle-peoplesoft-attacks/

Indicators of Compromise

No public IOCs available at time of writing.

MITRE ATT&CK

T1190 — Exploit Public-Facing Application
T1562.007 — Disable or Modify Cloud Firewall

  🤖 AI Attribution

  Generated by gemini-2.5-flash ·

  1,512 input / 1,216 output tokens ·

  Reviewed and approved by a human analyst before publication

Overview

CVE-2026-46817 is a critical improper privilege management vulnerability affecting Oracle E-Business Suite’s Oracle Payments product. An unauthenticated attacker with network access via HTTP can exploit this flaw to achieve complete takeover of the Oracle Payments component. This vulnerability is easily exploitable and carries a CVSS 3.1 Base Score of 9.8, indicating severe impacts on confidentiality, integrity, and availability.

Technical Analysis

The vulnerability resides within the Oracle Payments product, specifically in the File Transmission component of Oracle E-Business Suite. It is an improper privilege management flaw (CWE-269, CWE-287, CWE-306) that allows an unauthenticated attacker to bypass security controls. By sending specially crafted HTTP requests, an attacker can gain unauthorized administrative control over the Oracle Payments module.

Affected Versions: Oracle E-Business Suite versions 12.2.3 through 12.2.15 are vulnerable.
Attack Vector: Network access via HTTP. No authentication or user interaction is required.
Impact: Successful exploitation results in full takeover of Oracle Payments, implying complete control over payment processing, configuration, and data within that module.
Prerequisites: The vulnerable Oracle Payments component must be accessible via HTTP from the attacker’s network location.

Detection

Detecting exploitation attempts for CVE-2026-46817 involves monitoring web server logs for suspicious activity targeting Oracle E-Business Suite’s Payments module.

Web Server Logs: Monitor access logs (e.g., Apache, Nginx, IIS) for requests targeting paths associated with Oracle Payments or File Transmission components (e.g., /OA_HTML/ or /OA_CGI/ paths related to payments processing or file handling).
Unusual Request Patterns: Look for HTTP requests from unauthenticated sources to sensitive Oracle Payments endpoints that typically require authentication or are not part of normal user workflows.
Error Codes followed by Success: Hunt for sequences of failed (e.g., 401, 403) or unusual (e.g., 500) HTTP status codes immediately followed by successful (200) requests to sensitive payment-related URLs from the same source IP, potentially indicating an authentication bypass or exploit attempt.
Post-Exploitation Activity: Monitor for any unusual process creation, file modifications, or network connections originating from the Oracle E-Business Suite server that are not part of normal operations, which could indicate a successful takeover.

Sigma Detection Rules

Suspicious Unauthenticated Access to Oracle Payments Component

title: Suspicious Unauthenticated Access to Oracle Payments Component
id: f0e1d2c3-b4a5-6789-cdef-0123456789ab
status: experimental
description: Detects unauthenticated or unusual HTTP requests targeting Oracle E-Business Suite's Payments or File Transmission components, potentially indicating an exploitation attempt for CVE-2026-46817.
logsource:
  category: webserver
detection:
  selection_paths:
    cs-uri-stem|contains:
      - '/OA_HTML/jsp/fnd/payments/'
      - '/OA_CGI/fnd/payments/'
      - '/OA_HTML/jsp/fnd/file_transmission/'
      - '/OA_CGI/fnd/file_transmission/'
  condition: selection_paths
level: high

Mitigations

Prioritize the following actions to mitigate CVE-2026-46817:

Apply Vendor Patches: Immediately apply the security updates provided by Oracle in their May 2026 Critical Patch Update (CPU) advisory. This is the primary and most effective mitigation.
Restrict Network Access: Limit direct network access to Oracle E-Business Suite components, especially the Oracle Payments module, from untrusted networks. Implement strict firewall rules to only allow necessary traffic from authorized sources.
Implement Web Application Firewall (WAF): Deploy and configure a WAF to detect and block known exploit patterns or suspicious requests targeting Oracle E-Business Suite applications.
Regular Auditing: Conduct regular security audits and penetration tests on Oracle E-Business Suite deployments to identify and address potential vulnerabilities.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-46817
https://www.oracle.com/security-alerts/cspumay2026.html
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-46817

Indicators of Compromise

No public IOCs available at time of writing.

MITRE ATT&CK

T1190 — Exploit Public-Facing Application

  🤖 AI Attribution

  Generated by gemini-2.5-flash ·

  2,162 input / 1,298 output tokens ·

  Reviewed and approved by a human analyst before publication

Tag: oracle

ShinyHunters Exploits Oracle PeopleSoft via WAF Bypass

Overview

Technical Analysis

Detection

Sigma Detection Rules

Web Server – Suspicious URL Encoding in Request

Mitigations

References

Indicators of Compromise

MITRE ATT&CK

CVE-2026-46817: Oracle E-Business Suite Payments Takeover Vulnerability

Overview

Technical Analysis

Detection

Sigma Detection Rules

Suspicious Unauthenticated Access to Oracle Payments Component

Mitigations

References

Indicators of Compromise

MITRE ATT&CK