Hermes CTI

← Back to canonical report

Hunt

CISA KEV additions: Cisco Secure Firewall Management Center and Oracle PeopleSoft exploitation

Hunt Strategy & Objective

Determine whether public exploitation of CVE-2026-35273 against Oracle PeopleSoft Environment Management endpoints, or CVE-2026-20079 against the Cisco Secure Firewall Management Center web interface, is represented in available web, authentication, application, and system telemetry.

⏱️ Lookback: 2026-05-27 to present

Hunt Hypothesis

If exploitation of CVE-2026-35273 or CVE-2026-20079 occurred against monitored public-facing services, web access logs and authentication records will show unauthenticated or anomalous requests to the documented exposure surfaces within the reported activity windows.

Target Platforms & Environment

Oracle PeopleSoft Enterprise PeopleTools Cisco Secure Firewall Management Center

Publicly documented exploitation activity between 2026-05-27 and 2026-06-09 for Oracle PeopleSoft, and exploitation reported for Cisco Secure Firewall Management Center from 2026-09-09 onward.

Required Telemetry & Data Sources

Web or HTTP access logs for PeopleSoft application servers and the FMC management interface Authentication and administrative audit logs Application and database audit trails for PeopleSoft Management-plane and system logs for FMC

✓ Operational Execution Phases

4 Structured Investigation Phases
1

Preparation

Asset inventory Log retention configuration

🎯 Phase Goal: Establish scope, coverage, and a baseline of legitimate activity.

Procedural Actions

  1. 1.1 Enumerate in-scope PeopleSoft and FMC services and their externally reachable interfaces.
  2. 1.2 Confirm retention, time synchronization, and field availability for web, authentication, application, database, and system logs.
  3. 1.3 Document approved administrators, scanners, monitoring sources, and maintenance windows.
2

Sweeps

Web access logs Authentication logs

🎯 Phase Goal: Search telemetry for the documented exposure surfaces within the reported windows.

Procedural Actions

  1. 2.1 Query web access logs for requests to PeopleSoft Environment Management Hub (PSEMHUB) paths.
  2. 2.2 Query web access logs for unexpected requests to the FMC management interface.
  3. 2.3 Correlate matches with authentication outcomes and administrative activity.
3

Triage

Proxy and firewall logs Identity logs Application audit trails

🎯 Phase Goal: Separate legitimate activity from suspicious or unauthorized activity.

Procedural Actions

  1. 3.1 Exclude approved scanners, monitoring, vendor support, and maintenance after validating ownership and timing.
  2. 3.2 Pivot from suspicious source addresses and timestamps into proxy, firewall, VPN, identity, application, and database telemetry.
  3. 3.3 Record absence of logs as a visibility gap.
4

Forensics and escalation

System and application logs Configuration records

🎯 Phase Goal: Preserve evidence and escalate confirmed unauthorized access.

Procedural Actions

  1. 4.1 Preserve logs and relevant configuration before rotation or remediation.
  2. 4.2 Capture affected service versions, access-control state, active sessions, and evidence of unauthorized changes.
  3. 4.3 Escalate through the authorized incident-response process when unauthorized access is confirmed.
✓

True Positive Confirmation Evidence

● Unauthenticated or unexpected requests to PeopleSoft Environment Management Hub endpoints
● Unexpected administrative, session, or configuration activity following such requests
● Unusual authentication outcomes on FMC management interfaces
!

Benign & False Positive Explanations

● Approved vulnerability scanners, availability monitoring, and penetration tests
● Vendor support sessions and scheduled maintenance windows
● Internal integration or batch jobs that legitimately call Environment Management endpoints

🔬 Forensic Artifacts to Collect & Preserve

Web access logs covering the reported windows
Authentication and administrative audit records
PeopleSoft application and database audit trails
FMC management-plane and system logs
Current service version and access-control configuration

Validation Checklist

Log sources and retention confirmed for every in-scope service
Approved administrative and monitoring sources documented before alerting
Matches triaged with source address, timestamp, account, and change-record correlation
Absence of telemetry recorded as a visibility gap, not as evidence of no activity

Escalation Criteria

Confirmed unauthenticated access to an affected service
Evidence of privilege escalation, persistence, data access, or unexplained configuration change following suspected exploitation

Traceability & Related Detections

🔍 Evidence: ca65d2c9-e5… 🔍 Evidence: 5fcf2be5-02… 🔍 Evidence: a75f0460-e3… 🛡️ Detection: dd543943-4d… 🛡️ Detection: ee105837-96…