{"uuid": "91f0e2b2-d336-4074-8f12-1fc3945b9483", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-35273", "type": "seen", "source": "https://infosec.exchange/users/edwardk/statuses/117344052132384599", "content": "The ShinyHunters extortion gang is using a URL-encoding trick to bypass WAF rules protecting Oracle PeopleSoft servers from the CVE-2026-35273 vulnerability. Experts urge organizations to apply the latest security updates rather than relying on firewall mitigations to prevent further data theft and web shell deployments.https://www.bleepingcomputer.com/news/security/shinyhunters-uses-waf-bypass-trick-in-oracle-peoplesoft-attacks/", "creation_timestamp": "2026-09-27T16:55:45.375313Z"}