PENTESTY · EDITORIAL ANALYSIS · · 4 min read
PeopleSoft and WAFs: does the application receive a different request?
Blocking one visible address does not establish that every equivalent route is blocked. A review must connect the edge decision with the service receiving the request.
By Pentesty
What the sources document
On September 25, 2026, Mandiant/GTIG reported renewed exploitation of PeopleSoft CVE-2026-35273 using encoded path variations to bypass literal WAF rules. Oracle describes unauthenticated remote execution and published its alert on June 10. The report does not establish that every WAF is vulnerable. The analysis below proposes verification criteria for authorized environments.
Each decision needs to concern the same resource
A request crosses components that may interpret its address at different stages. The operational question is which resource each layer understood was requested. An inventory containing only the address displayed in a browser may fail to represent the route the application actually serves.
Choose a relevant workflow and map its passage through the edge, intermediaries and final server. Record the identifier used to correlate events. Two teams should be able to explain the same transaction without depending on an isolated screenshot of the WAF interface.
Define equivalence and exceptions before testing
The application owner should identify valid representations and resources that must remain inaccessible from each origin. Infrastructure staff explain where the decision occurs. Together, these details turn a generic rule into a testable hypothesis, with expected outcomes for permitted and denied access.
Begin with a harmless staging route whose behavior is known. A matrix can compare representations the service itself accepts without sending exploitation objects or installing files. The vulnerability queue analysis helps connect this exercise with the asset, owner and outstanding remediation task.
Retain three outcomes from one exercise
Pentesty proposes retaining the edge decision, receipt at the origin and observed effect. Interpret an absent application event alongside logging coverage, rather than automatically treating it as proof of blocking. A missing identifier can reveal an observation gap.
Agree on a window, volume limits and stopping conditions with the owners. Keep a legitimate path working and use synthetic data throughout the exercise. Document the configuration applied during testing, including temporary exceptions that could explain differences.
- Permitted path: the reference operation succeeds and its records can be correlated.
- Denied path: the expected control decision appears and the prohibited effect does not occur in the test service.
- Divergent interpretation: the team identifies where the recognized resource changed and who must review the rule.
- Observability: timestamps, identifiers and logging coverage support the conclusion.
Remediation and temporary blocking need separate evidence
A compensating rule needs an owner, deadline and review condition. Do not close an update task solely because the edge test passed. Acceptance should cover the installed component and the nodes able to receive traffic, within the scope agreed with operations.
If evidence suggests earlier compromise, involve the responsible investigators before changing evidence. The Hafnium and Exchange analysis addresses the difference between installing a fix and examining access already obtained. The product differs; this comparison concerns only closure criteria.
Deliver a conclusion someone can repeat
The report should connect each outcome to the observed path, identity, configuration and version. Identify intermediaries or environments that could not be assessed. A successful staging test does not independently measure production configuration.
Repeat relevant cases when routing, proxies or the application change. A useful deliverable explains where the decision was enforced and what remains unresolved. The objective is to demonstrate that the service received only the operations intended for that access.
Frequently asked questions
Does having a WAF mean I can postpone the PeopleSoft fix?
Assess the rule as a compensating control with limits and a deadline. Update acceptance needs evidence of the component’s state alongside the blocking observed at the edge.
Does the report establish a flaw in every WAF product?
No. It describes literal rules bypassed in observed environments. Review the actual configuration and path interpretation in the specific environment.
Must I install a web shell to test equivalence?
Not for this objective. A harmless staging route and correlated records can demonstrate how layers interpret a request without reproducing exploitation.
Does an edge block close a suspicion of earlier compromise?
No. Investigating previous access needs separate evidence. Preserve records and coordinate the investigation with service owners and incident responders.
Sources and references
Original Pentesty analysis, published October 16, 2026. The proposed scenarios are editorial guidance, with scope and validation to be defined for each environment.