Will CVE-2026-35273 PeopleSoft WAF-bypass exploitation be documented by Oct 11?
[Auto-closed — deadline passed with no qualifying event] Deadline has passed (Oct 11, 2026; today is Oct 12, 2026). No public documentation from CISA, vendor advisories, or security research disclosing ShinyHunters or similar actors exploiting CVE-2026-35273 with WAF-bypass techniques has emerged in the recent intelligence feed or public sources. The initial Bleeping Computer report (Sept 27) documented the vulnerability and threat actors' interest, but no subsequent exploitation documentation meeting resolution criteria was disclosed by the deadline.
Evidence: https://threatodds.com/markets/08eb23f9-24fa-4625-876a-45a056e4f76aMarket Overview
AI GENERATEDShinyHunters extortion gang is actively exploiting CVE-2026-35273 (Oracle PeopleSoft) using URL-encoding WAF bypass tricks, as reported by Bleeping Computer on Sept 27, 2026. This enables widespread attacks on vulnerable PeopleSoft servers.
Primary SourceResolution Criteria
Public disclosure or CISA alert documenting ShinyHunters or similar actors exploiting CVE-2026-35273 with WAF-bypass techniques in the wild by Oct 11, 2026.