FBI PeopleSoft Breach: WAF Bypass and Missed Patch Behind It

What happened

The FBI has removed a contractor after concluding that a missing security patch left open the system at the center of a breach affecting thousands of bureau employees. 3 The bureau confirmed to Reuters that the incident involved a security failure on a third-party-managed platform and that a contractor had not applied an available fix. Officially, the FBI did not name the platform or the vendor. 3 Reuters, citing two people familiar with the matter, identified the system as Oracle's PeopleSoft ERP suite and the third party as Accenture. 34

The attackers were the ShinyHunters extortion group. They reportedly reached the agency's job portal and took personal information belonging to FBI staff. 2

The technical picture: more than one failure

The simple version of this story is that a contractor forgot to patch. The more detailed reporting suggests something more uncomfortable. Security Boulevard reports that the intruders exploited CVE-2026-35273. They also got past the FBI's web application firewall by URL-encoding a single character in their requests. 2

If that account holds, the perimeter defense meant to filter malicious traffic was beaten by one of the oldest evasion tricks there is. The firewall was not a backstop for the missing patch. It was a speed bump.

Oracle's July 2026 Critical Patch Update adds further context. That release covered five critical and more than a dozen high-severity flaws across WebLogic, PeopleSoft, Identity Manager, WebCenter and VirtualBox. 1 Threat-Modeling.com describes a related PeopleSoft PeopleTools bug, CVE-2026-35278, as actively exploited by ShinyHunters. It carries a CVSS score of 9.8, is reachable over HTTP, and is chained with CVE-2026-35273 to achieve remote code execution. The outlet urges PeopleSoft operators to treat the update as an emergency. 1

The accounts differ in emphasis and certainty:

• Security Boulevard focuses on CVE-2026-35273 plus the firewall evasion. 2
• Threat-Modeling.com frames the threat as a two-CVE chain with CVE-2026-35278 as the actively exploited piece. 1
• InformationWeek is more cautious. It notes the investigation is ongoing and the bureau has not publicly said exactly how the attackers got in. 3

These accounts don't necessarily conflict. A chained exploit delivered through encoded requests that a WAF failed to normalize would fit all of them. Still, the precise intrusion path has not been officially confirmed.

Why it matters

InformationWeek treats the case as a symptom of a wider problem. Critical systems now span multiple vendors and service providers, so applying a fix often depends on people a CIO does not directly control. 3 The outlet also points to a shrinking window between Oracle's security alerts and real-world exploitation. 3 When a group like ShinyHunters can weaponize a disclosed flaw quickly, any lag in a contractor's change process becomes a gap attackers can use.

The WAF detail sharpens that point. Many organizations, government agencies included, quietly rely on perimeter filtering to buy time while patches move through testing and approval. Security Boulevard notes that this case shows the danger of assuming such controls can make up for unpatched software. 2 A firewall rule that matches a literal attack string but not its encoded form gives a false sense of coverage. That is arguably worse than having no rule, because it may lower the urgency to patch.

Accountability and the contractor question

Removing the individual contractor answers the immediate question of who missed the update. It does not settle the structural ones:

• Who verifies that a managed-service provider has applied critical patches?
• How quickly must it do so?
• Who tests whether compensating controls such as a WAF actually block known exploit variants?

The FBI has not said whether it is reviewing its broader arrangement with the provider. Accenture's role rests on Reuters' sourcing rather than official confirmation. 3

Our read

The evidence points to layered failure, not a single lapse:

1. A critical PeopleSoft update went unapplied on a sensitive, internet-facing system.
2. The control that might have contained the risk was reportedly bypassed with trivial encoding.

Blaming one contractor is the easiest narrative, and the least useful. For any organization running PeopleSoft, the practical lessons are:

• Apply Oracle's July update now. 1
• Write contractual patch deadlines into managed-service agreements and audit them.
• Test WAF rules against encoded and obfuscated variants of known exploits, rather than assuming the perimeter will hold.