Accenture Contractor Removed After Bypassing CVE-2026-35273 Patch on Oracle PeopleSoft Exposed FBI Employee Data

The breach occurred when a URL-encoding bypass evaded the WAF rule protecting the PSEMHUB endpoint on Oracle PeopleSoft. Mandiant's assessment confirms the technique matched prior ShinyHunters activity against unpatched instances. FBI statements attribute the incident solely to the third-party platform operator yet omit any internal review of contractor oversight or prior patch deployment logs. Procurement records show Accenture holds multiple FBI IT support task orders; removal of one individual does not alter the broader pattern of deferred maintenance on critical HR systems. Cross-referencing court filings from earlier ShinyHunters arrests reveals repeated targeting of government job portals, suggesting reconnaissance rather than opportunistic activity. No public evidence links the stolen records to subsequent operations against FBI personnel. Oracle has issued no updated advisory on residual bypass vectors. Expect additional contractor terminations and internal audits of PeopleSoft instances across other federal agencies within 90 days.