SAP has addressed CVE-2026-44756, a maximum-severity memory corruption vulnerability in Extended Passport (EPP) Processing that could let a remote, unauthenticated attacker execute arbitrary operating system commands on vulnerable SAP systems. The issue, dubbed OVERPASS by Onapsis Research Labs, carries a CVSS score of 10.0 and resides in shared SAP kernel code used by multiple products and communication protocols.

The flaw stems from missing boundary validation while EPP data is deserialized. A specially crafted request containing a malformed EPP header can cause unsafe memory behavior and potentially allow an attacker to take control of the receiving process. Because EPP is processed when a new session opens, exploitation can occur before SAP evaluates user roles, authorization objects, logon policies, or other application-level access controls.

Security teams seeking CVE-2026-44756 detection content can use the SOC Prime Platform to explore behavior-based detection rules and hunting queries mapped to MITRE ATT&CK®. Teams can also use Uncoder AI to convert threat intelligence into detection logic and hunting queries.

Contact Sales

CVE-2026-44756 analysis

Onapsis Research Labs discovered the vulnerability in SAP’s processing of the Extended Passport, a tracing structure attached to requests across the SAP ecosystem. CVE-2026-44756 affects shared kernel functionality used by a broad range of SAP technologies, including S/4HANA, ERP and Business Suite (ECC), NetWeaver, Web Dispatcher, BW/4HANA, Enterprise Portal, PI/PO, Solution Manager, and other products that rely on vulnerable kernel code.

The vulnerability results from insufficient validation of externally supplied length fields during EPP deserialization. An unauthenticated attacker can send a crafted network request with a malformed EPP header, causing a memory safety violation. Successful exploitation can move beyond a crash and allow arbitrary operating system command execution under the account that owns the SAP installation, effectively giving the attacker SAP administrative-level control over the host.

The attack surface is particularly significant because EPP processing is shared across multiple protocols. The flaw can be reached through internet-facing web requests, the SAP GUI protocol used by end users, and Remote Function Call (RFC) connections between SAP systems. EPP is processed as a session is created, before standard SAP authorization checks take effect. As a result, user locks, roles, password policies, Segregation of Duties controls, and transaction restrictions do not block this exploitation path.

A successful attack could expose the SAP secure store, database credentials, password hashes, business information, and live session data. Attackers could also recover stored credentials for lateral movement into other SAP systems and modify application data, system configuration, or SAP binaries. This combination of remote reachability, no authentication requirement, and potential full compromise explains the maximum CVSS 10.0 rating.

Defenders should not rely only on static CVE-2026-44756 IOCs because there is currently no confirmed in-the-wild campaign described by the vendors. Monitoring should instead focus on suspicious requests reaching exposed SAP services, abnormal application-server behavior, unexpected process execution under SAP operating system accounts, and post-exploitation access to credentials or sensitive business data.

CVE-2026-44756 Mitigation

SAP released Security Note 3747649 on September 8, 2026, to address the issue. The patch covers affected ABAP and Java kernels and supported SAP Web Dispatcher versions. SAP lists impacted kernel families and versions in its September 2026 Security Patch Day advisory, and organizations should use the vendor note to determine which systems require updates.

The recommended remediation approach is to inventory the entire SAP landscape and apply the relevant kernel patch immediately, prioritizing internet-facing systems before internal instances. Onapsis emphasizes that a single kernel patch closes the known exploitation vectors. Organizations should also reduce unnecessary external exposure and maintain application-layer monitoring while patches are being rolled out.

No network-only workaround should be considered equivalent to patching. Because the vulnerable EPP functionality is reachable across web, SAP GUI, and RFC communications, blocking one protocol may leave another attack path open. Likewise, strengthening SAP roles or authentication policies does not stop exploitation because the vulnerable code is reached before authentication and authorization controls are evaluated.

To Detect CVE-2026-44756 exploitation attempts, security teams should correlate anomalous activity at SAP-facing services with unusual operating system command execution and changes to sensitive SAP data or binaries. The most authoritative details for CVE-2026-44756 remediation remain SAP Security Note 3747649 and SAP’s September 2026 Security Patch Day guidance.

Disclaimer: Detection content may not be available for every CVE. Check the SOC Prime Platform for current coverage. If you do not find relevant detections now, please check back later.

The post CVE-2026-44756: Critical SAP Kernel Flaw Enables Unauthenticated Remote Code Execution appeared first on SOC Prime.

Microsoft’s September 2026 Patch Tuesday addresses two Windows privilege escalation vulnerabilities already exploited in the wild. Tracked as CVE-2026-85880 and CVE-2026-81963, both flaws carry a CVSS score of 7.8 and can enable attackers with initial local access to escalate privileges to SYSTEM, potentially turning an initial foothold into complete control over a compromised Windows device.

The first vulnerability affects Windows Advanced Local Procedure Call (ALPC), while the second resides in the Windows Update Stack. Despite targeting different Windows generations and components, both vulnerabilities require low privileges, have low attack complexity, require no user interaction, and have been confirmed as exploited before patches became available. CISA added both flaws to its Known Exploited Vulnerabilities (KEV) catalog on September 8, 2026, setting September 22 as the remediation deadline for US federal civilian agencies.

Security teams looking for CVE-2026-85880 detection content can explore SOC Prime’s Detection Intelligence to identify behavioral patterns potentially associated with privilege escalation and post-exploitation activity. Click Explore Detections to access detection rules and hunting queries mapped to MITRE ATT&CK® and compatible with multiple SIEM, EDR, and Data Lake technologies.

Defenders can also Detect CVE-2026-81963 exploitation and related post-compromise behavior by focusing on suspicious privilege elevation, system-level file modifications, and anomalous activity involving Windows update processes. Uncoder AI can help security teams convert relevant threat intelligence and indicators into hunting queries and detection logic across multiple security platforms.

Contact Sales

CVE-2026-85880 and CVE-2026-81963 analysis

The CVE-2026-85880 analysis centers on a heap-based buffer overflow in Windows Advanced Local Procedure Call (ALPC), a core Windows mechanism used for communication between processes. According to Microsoft, an attacker who can already execute code inside a low-privilege AppContainer can exploit the vulnerability locally, escape the sandbox, and elevate privileges to SYSTEM. No additional user interaction is required.

The flaw is classified under CWE-122 for heap-based buffer overflow and is rated High with a CVSS v3.1 score of 7.8. The attack vector is local, attack complexity is low, privileges required are low, and successful exploitation can have a high impact on confidentiality, integrity, and availability. The published details for CVE-2026-85880 show that affected systems include Windows 10 versions 1607, 1809, 21H2, and 22H2, along with Windows Server 2012, 2012 R2, 2016, 2019, and 2022, including applicable Server Core installations.

Notably, the affected product range does not include Windows 11 or Windows Server 2025 in Microsoft’s current applicability data. Rapid7 researchers noted that this distinction could potentially be related to Microsoft’s ongoing memory-safety improvements in newer Windows components, although this remains an interpretation rather than an explanation confirmed by Microsoft.

Microsoft credited researchers from Volexity and Proofpoint with reporting the ALPC flaw. However, Microsoft has not disclosed how attackers are currently exploiting it, which threat actors are responsible, or the scale of observed attacks. As of September 9, public reporting also does not identify a verified CVE-2026-85880 PoC, despite confirmed exploitation in real-world attacks.

CVE-2026-81963 is a separate elevation-of-privilege vulnerability affecting the Windows Update Stack. The flaw results from improper link resolution before file access, categorized as CWE-59, together with improper access control under CWE-284. An authorized local attacker can abuse the weakness to elevate privileges to SYSTEM.

CVE-2026-81963 affects newer Windows platforms, including Windows 11 versions 23H2, 24H2, 25H2, and 26H1, as well as Windows Server 2025 and Server Core. This creates an important distinction between the two actively exploited flaws: organizations running older Windows 10 and server generations need to prioritize CVE-2026-85880, while newer Windows 11 and Server 2025 estates require urgent attention to CVE-2026-81963.

The vulnerability also carries a CVSS score of 7.8 and requires local, low-privileged access without user interaction. Security researchers note that local privilege escalation bugs are especially valuable as part of multi-stage attacks. Instead of developing a complex remote exploit that immediately provides SYSTEM access, adversaries can combine an initial access technique with an elevation-of-privilege vulnerability to achieve essentially the same end result.

Microsoft credited Romain Deperne of Airbus Helicopters and the Microsoft Threat Intelligence Center (MSTIC) with the discovery of the Update Stack issue. Microsoft confirmed exploitation before the September security update but has not disclosed information about the threat actors, initial access vectors, or targeted organizations.

As a result, defenders looking for CVE-2026-81963 IOCs should be aware that no campaign-specific indicators have been publicly disclosed by Microsoft in the cited reporting. Detection should therefore prioritize behavioral evidence of privilege escalation, unusual SYSTEM-level activity, suspicious manipulation of files or links, and follow-on actions performed immediately after a low-privilege process gains elevated permissions.

CVE-2026-85880 and CVE-2026-81963 Mitigation

Microsoft released security updates addressing both actively exploited vulnerabilities on September 8, 2026. Because exploitation has already been observed in the wild, organizations should prioritize these updates rather than treating them as part of the normal vulnerability management cycle. CISA’s inclusion of both vulnerabilities in the KEV catalog further reinforces the urgency of patching.

For CVE-2026-85880, administrators should identify vulnerable Windows 10 and Windows Server installations and ensure they have received the corresponding September security updates. Published fixed build thresholds include Windows 10 22H2 build 19045.7725, Windows Server 2016 build 14393.9512, Windows Server 2019 build 17763.9245, and Windows Server 2022 build 20348.5622, with equivalent updates available for the other affected releases.

The recommended CVE-2026-81963 mitigation is similarly straightforward: deploy Microsoft’s September updates to affected Windows 11 and Windows Server 2025 systems. Fixed build levels include Windows 11 23H2 build 22631.7582, Windows 11 24H2 build 26100.9445, Windows 11 25H2 build 26200.9445, Windows 11 26H1 build 28000.2954, and Windows Server 2025 build 26100.33438.

Security teams should verify successful installation across the entire Windows estate rather than relying solely on update deployment status. Because both vulnerabilities are local privilege escalation flaws, monitoring should also focus on potentially compromised low-privilege accounts, sandbox escape behavior, unusual SYSTEM-level processes, unauthorized changes to protected files, and suspicious activity immediately following execution from user-controlled contexts.

Organizations should prioritize systems exposed to untrusted code execution, including user workstations, shared endpoints, development environments, application servers, and systems where an attacker could already obtain limited local access. Privilege escalation vulnerabilities can become particularly dangerous when chained with phishing, malware, browser exploits, stolen credentials, or other initial access techniques.

Additionally, by leveraging SOC Prime’s AI-Native Detection Intelligence Platform backed by collective cyber defense expertise, organizations can strengthen their security posture against emerging zero-day exploitation and accelerate detection engineering across heterogeneous environments.

Disclaimer: Detection content may not be available for every CVE. Check the SOC Prime Platform for current coverage. If you don’t find relevant detections now, please check back later.

The post CVE-2026-85880 and CVE-2026-81963: Microsoft Patches Two Actively Exploited Windows Zero-Days appeared first on SOC Prime.

Google has released Chrome 153 with a fix for another zero-day vulnerability already being exploited in real-world attacks. Tracked as CVE-2026-87491, the flaw is an out-of-bounds write vulnerability in V8, the JavaScript and WebAssembly engine at the core of Google Chrome. Successful exploitation can allow a remote attacker to execute arbitrary code inside the browser sandbox through a specially crafted HTML page.

The vulnerability was fixed in Chrome 153.0.8010.36/.37 for Windows and macOS and 153.0.8010.36 for Linux as part of the September 8, 2026 Stable Channel release. Google confirmed that an exploit already exists in the wild but has not disclosed who is using it, which organizations have been targeted, or how the exploit is being delivered.

Despite Google assigning the vulnerability a Medium Chromium security severity, its exploitation status significantly raises the operational risk. Memory corruption in V8 can provide attackers with code execution in a renderer process and may become part of a larger browser exploit chain when paired with another flaw capable of escaping Chrome’s sandbox.

The new Chrome zero-day bug exploited in attacks is the seventh Chrome vulnerability patched by Google this year after being used as a zero-day, highlighting how browser engines remain a high-value target for sophisticated threat actors.

Contact Sales

CVE-2026-87491 analysis

CVE-2026-87491 is categorized as CWE-787: Out-of-Bounds Write. This type of memory-safety weakness occurs when software writes data outside the boundaries of the memory buffer allocated for a particular object or operation. In a highly complex JavaScript engine such as V8, such corruption can affect adjacent memory structures and potentially alter program execution.

The most important details for CVE-2026-87491 are contained in Google’s CVE description: Chrome versions before 153.0.8010.36 can allow a remote attacker to execute arbitrary code inside the browser sandbox by delivering a crafted HTML page.

This gives attackers a relatively familiar browser-based delivery scenario. A victim could be directed to malicious web content through a phishing link, compromised website, malicious advertisement, redirect chain, or another web-based lure. When Chrome processes specially crafted JavaScript or HTML, the vulnerable V8 code path can trigger an out-of-bounds write and corrupt memory.

CVE-2026-87491 affects Google Chrome releases earlier than 153.0.8010.36. The CVE record identifies 153.0.8010.36 as the first non-affected version boundary.

Successful exploitation can provide arbitrary code execution within Chrome’s sandbox. That distinction matters because sandboxing creates an additional boundary between malicious browser content and the underlying operating system.

An attacker exploiting CVE-2026-87491 alone should therefore not automatically be described as gaining complete control of Windows, macOS, or Linux. A more complete endpoint compromise could require another vulnerability that allows the attacker to escape the renderer sandbox or elevate privileges after initial browser code execution.

Nevertheless, browser-sandbox code execution is a powerful first stage. It can allow an adversary to manipulate the compromised renderer process and potentially prepare a second-stage exploit against another browser or operating-system weakness.

BleepingComputer also notes that corruption resulting from the out-of-bounds write may allow access beyond the intended memory buffer, potentially exposing sensitive process information or causing Chrome to crash.

The flaw was reported to Google by Jihyeon Jeong of Compsec Lab at Seoul National University, who was also working as a research intern. Google’s release notes list the report date as August 6, 2026 and award a $2,500 bug bounty for the finding.

Google publicly shipped the security fix with Chrome 153 on September 8, 2026. The release contains 230 security fixes in total, making it a substantially larger security update than the emergency releases typically issued for individual zero-days.

In addition to CVE-2026-87491, Chrome 153 addresses five Critical-rated vulnerabilities, including use-after-free and out-of-bounds write issues affecting WebGL and Cast. Dozens of High-severity issues were also fixed across components including V8, ANGLE, PDFium, DevTools, Web Authentication, Payments, and other browser subsystems.

Google has intentionally restricted access to the Chromium issue associated with the zero-day. The company routinely limits vulnerability details until most Chrome users have received security updates, reducing the likelihood that additional threat actors can quickly reproduce an exploit from detailed technical information.

At the time of publication, no reliable public CVE-2026-87491 PoC had been identified in the reviewed sources. Google’s statement that an exploit exists in the wild confirms that functional exploitation capability exists privately, but that does not mean the actual attack code has been publicly released.

Google has likewise not published campaign-level CVE-2026-87491 IOCs such as malicious domains, IP addresses, exploit files, payload hashes, or details about targeted organizations. This limits defenders’ ability to rely on conventional static indicators when looking retrospectively for exploitation.

The absence of those indicators makes endpoint and browser telemetry particularly important. Organizations should combine version assessment with investigation of suspicious browser behavior, renderer crashes, unusual process relationships, and follow-on activity occurring after visits to potentially malicious sites.

The vulnerability follows closely behind CVE-2026-85046, another actively exploited V8 zero-day that Google patched on September 3. CVE-2026-85046 is a type confusion flaw, whereas CVE-2026-87491 is an out-of-bounds write. Both demonstrate the continuing attacker interest in V8 as an entry point for browser exploitation.

CVE-2026-87491 Mitigation

The primary remediation is to upgrade Chrome immediately to the latest Stable Channel release. Google has released:

• Windows: Chrome 153.0.8010.36/.37 or later
• macOS: Chrome 153.0.8010.36/.37 or later
• Linux: Chrome 153.0.8010.36 or later

Chrome normally downloads updates automatically, but users must relaunch the browser for the new executable to replace the vulnerable running version. Because Google says the staged rollout can take days or weeks, organizations should not assume every endpoint has already received the patch.

Users can manually verify their installed version by opening:

Chrome → Help → About Google Chrome

Enterprise security and IT teams should use browser-management or endpoint-management tooling to verify versions across the entire fleet rather than relying solely on individual users to restart their browsers.

CVE-2026-87491 detection should start with an inventory of Chrome installations. Any endpoint running a desktop version earlier than 153.0.8010.36 should be considered exposed and prioritized for immediate updating.

To Detect CVE-2026-87491 exploitation attempts or suspicious post-exploitation activity, defenders should investigate combinations of:

• Unexpected Chrome renderer crashes
• Browser memory-corruption alerts generated by EDR or exploit-protection tooling
• Unusual Chrome child-process behavior
• Unexpected processes launched shortly after suspicious browser activity
• Visits to newly registered, compromised, or known malicious domains shortly before a browser crash
• Executable or script activity immediately following a Chrome session
• Suspicious files downloaded or created by browser-related processes
• Attempts to exploit an additional sandbox escape or privilege-escalation vulnerability
• Unexpected outbound connections from processes spawned after Chrome activity
• New persistence mechanisms appearing shortly after suspicious web browsing

These behaviors should be treated as investigation leads rather than vulnerability-specific signatures because Google has not disclosed the exploit used in observed attacks.

Security teams should correlate endpoint telemetry with DNS, secure web gateway, proxy, email, and network records. If a system running an affected Chrome version visited suspicious infrastructure immediately before memory corruption, abnormal browser behavior, or post-exploitation activity, that endpoint warrants deeper forensic examination.

Organizations should also confirm that Chrome was restarted after the update. An installer may download a secure version while an older vulnerable Chrome process remains active until the browser is relaunched.

For managed environments, administrators should consider enforcing rapid browser restart policies for high-priority security releases and monitoring compliance with the fixed version across endpoints.

The CVE-2026-87491 mitigation process should also include retrospective investigation for high-risk endpoints that were exposed before the September 8 update. Since Google has already confirmed exploitation in the wild, installing the patch prevents future exploitation but cannot establish whether an endpoint was compromised earlier.

Users of other Chromium-based browsers should monitor security releases from their respective vendors and install versions incorporating the relevant Chromium/V8 fixes when available.

The post CVE-2026-87491: Chrome V8 Zero-Day Exploited in the Wild Enables Arbitrary Code Execution appeared first on SOC Prime.

Adobe has released an emergency security update addressing a maximum-severity vulnerability in Adobe Commerce and Magento Open Source that attackers are already exploiting in the wild. Tracked as CVE-2026-75650 and rated 10.0 on the CVSS scale, the flaw enables unauthenticated remote code execution on vulnerable e-commerce servers.

The vulnerability, dubbed StyleSmuggler by e-commerce security company Sansec, abuses Magento’s template-processing functionality to inject and execute malicious PHP code. Attacks were first confirmed on September 4, 2026, several days before Adobe released its emergency hotfix on September 7.

Threat actors have already used the zero-day to deploy a Rust-based Linux backdoor and, in separate attacks, a PHP web shell capable of executing arbitrary PHP commands. Because exploitation requires no valid Magento account or user interaction, internet-facing stores running vulnerable builds should be treated as high-priority targets for patching and retrospective investigation.

CVE-2026-75650 analysis

Adobe classifies the vulnerability as CWE-1336: Improper Neutralization of Special Elements Used in a Template Engine. Its CVSS vector indicates network-based exploitation, low attack complexity, no privileges, and no user interaction, with potentially high impact to confidentiality, integrity, and availability.

The most important details for CVE-2026-75650 concern the way Magento turns attacker-controlled data into executable PHP during normal application processing. StyleSmuggler abuses template directives and internal dependency-injection functionality rather than relying on a malicious extension or administrator account.

At a high level, the known attack follows two stages. First, attacker-controlled PHP content is written into a file Magento can later access, such as an application log or report. A second request then causes Magento’s template-processing chain to reach dependency-injection scanner functionality that loads the poisoned file using PHP include or require_once. Because these functions interpret PHP rather than merely reading the file, the attacker-controlled code executes on the server.

Sansec describes another observable aspect of the chain: attackers deliberately trigger Magento’s normal Payment Transaction Failed Reminder email. The malicious code runs while Magento renders the template, so a customer or administrator does not need to open the email. The exploit can even succeed when actual email delivery fails.

Contact Sales

CVE-2026-75650 affects the following Adobe Commerce branches according to Adobe’s emergency bulletin:

• 2.4.9-2026-aug and earlier
• 2.4.8-2026-aug and earlier
• 2.4.7-2026-aug and earlier
• 2.4.6-2026-aug and earlier
• 2.4.5-2026-aug and earlier
• 2.4.4-2026-aug and earlier

Affected Adobe Commerce B2B versions include:

• 1.5.3-2026-aug and earlier
• 1.5.2-2026-aug and earlier
• 1.4.2-2026-aug and earlier
• 1.3.4-2026-aug and earlier
• 1.3.3-2026-aug and earlier

Magento Open Source branches through 2.4.9-2026-aug are also covered by Adobe’s bulletin.

Sansec independently reproduced the full unauthenticated attack chain on clean Magento Open Source 2.4.7, 2.4.8, and 2.4.9 installations. Its first confirmed compromised customer was running Magento 2.4.6-p15 with both the July and August security updates applied, demonstrating that systems considered fully patched before September 7 were still vulnerable to the zero-day.

Once remote code execution is obtained, compromise extends beyond Magento itself. The first observed campaign deployed a small Rust-based Linux implant that established persistence and communicated with attacker infrastructure while disguising itself as legitimate system activity.

Early versions masqueraded as a kernel worker process named:

[kworker/u:8:0]

Later builds adopted names including:

fc-cache

and:

chronyd

The fc-cache variant stored itself under ~/.cache/fontconfig/fc-cache, added a cron entry to restart twice per hour, and used UDP port 123 traffic designed to resemble NTP communications. Sansec reported that related domains resolved to 185.157.160.251 as of September 7.

A separate attacker was observed abusing the same vulnerability to deliver a small PHP dropper. That payload created a hidden PHP web shell under a path resembling:

pub/media/catalog/product/cache/ss_<10hex>/sync_<10hex>.php

The shell normally returned an HTTP 404 response, but requests containing the required X-Cache-Token header could provide PHP code through a POST parameter for execution.

These observations show that StyleSmuggler is not tied to a single malware family or threat actor. Multiple adversaries can independently use the underlying RCE to deploy their preferred persistence and post-compromise tooling.

Sansec recorded the first confirmed exploitation on September 4 at 22:20 UTC. Another Magento server investigated by Disrex was compromised approximately 50 minutes later. Adobe released bulletin APSB26-146 and the official emergency hotfix on September 7, confirming that exploitation was already occurring in the wild.

Sansec and Disrex have published extensive technical information about the underlying chain but intentionally withheld a fully weaponized request that would make exploitation trivial to reproduce.

Useful CVE-2026-75650 IOCs include suspicious processes and files associated with the Rust implant, unusual PHP files beneath Magento media directories, unexpected Payment Transaction Failed Reminder activity, and the infrastructure identified by Sansec. Defenders should also search for malicious report or log content rather than limiting investigations to the Magento webroot.

CVE-2026-75650 Mitigation

Adobe has classified APSB26-146 as Priority 1 and instructs affected customers to apply the dedicated VULN-39341 hotfix immediately. The official patch package is distributed through Adobe’s Magento repository for affected Commerce and Magento Open Source releases.

Adobe additionally instructs customers to rotate their encryption keys after applying the hotfix. This is particularly important for stores that were exposed before September 7 because successful arbitrary code execution may have allowed attackers to access application secrets and sensitive server-side configuration.

CVE-2026-75650 detection should therefore begin with three questions:

1. Was the store accessible from the internet between September 4 and installation of Adobe’s hotfix?
2. Was VULN-39341 successfully applied?
3. Are there signs that PHP or native processes were launched before remediation?

To Detect CVE-2026-75650 exploitation or post-compromise activity, security teams should look for:

• Unexpected bursts of Payment Transaction Failed Reminder emails
• Suspicious PHP content in Magento logs or files under var/report/
• Report files containing unusual x_trace_ strings
• Processes masquerading as [kworker/u:8:0], fc-cache, or chronyd
• ~/.local/share/.gvfsd/ or ~/.cache/fontconfig/fc-cache
• Suspicious cron jobs restarting unknown binaries
• Unexpected PHP files underneath pub/media/
• Web shells under pub/media/catalog/product/cache/
• Outbound traffic to known StyleSmuggler infrastructure
• Abnormal UDP/123 communications from the Magento application host
• Unexpected HTTP requests involving unusual template-processing behavior
• New application users, changed credentials, or modified server configuration following suspicious web activity

Administrators should not assume that deleting a suspicious file from the Magento directory removes the compromise. In investigated incidents, malware relocated outside the webroot, created cron-based persistence, continued executing from deleted files, and could recreate parts of its persistence after removal.

The CVE-2026-75650 mitigation process should therefore include incident response for stores that were publicly reachable before patching. If compromise indicators are discovered, isolate the host, preserve forensic evidence, terminate malicious processes, identify persistence mechanisms, review filesystem changes, and rotate credentials and secrets accessible from the affected server.

Particular attention should be paid to:

• Magento administrator credentials
• Adobe Commerce encryption keys
• Database credentials
• API and integration secrets
• Payment and third-party service credentials
• SSH credentials
• Cloud or hosting tokens accessible from the application host

Security teams should also validate the integrity of Magento application files and extensions and investigate outbound network activity for signs that an implant communicated with external command-and-control infrastructure.

Because the initial StyleSmuggler attacks occurred before an official patch or public detection signatures were available, simply confirming that a store is now updated does not establish that it was never compromised. Any internet-facing vulnerable system operating during the September 4–7 zero-day window warrants historical review.

The post CVE-2026-75650: Adobe Patches Actively Exploited Magento Zero-Day Used to Deploy Backdoors appeared first on SOC Prime.

MikroTik has released emergency RouterOS security updates after researchers confirmed that attackers are actively exploiting a high-severity SSH authentication bypass against internet-facing routers. Tracked as CVE-2026-67276 and rated 9.2 on the CVSS scale, the flaw allows an attacker to authenticate as an existing RouterOS user without possessing that user’s legitimate RSA private key.

The vulnerability becomes significantly more dangerous when combined with CVE-2026-86060, a separate SSH privilege-escalation weakness. CERT Polska has named the two-stage attack chain MikroTrick and confirmed that attackers are using it to obtain full administrative control of RouterOS devices whose SSH service is reachable from public networks.

Evidence indicates that exploitation began as early as September 2, 2026, one day before MikroTik publicly released patched RouterOS builds on September 3. Successful attacks have created highly privileged accounts, modified device configuration, and established access that may survive until administrators actively investigate and rebuild compromised systems.

The broader group of MikroTrick Flaws disclosed by CERT Polska includes six RouterOS vulnerabilities affecting SSH server and client functionality, the bandwidth-test service, X.509 certificate validation, and the WebFig management interface. However, CVE-2026-67276 and CVE-2026-86060 form the combination currently confirmed in active full-device takeover attacks.

CVE-2026-67276 analysis

The vulnerability originates in the way RouterOS validates RSA public keys during SSH authentication. RouterOS did not compare the complete public key associated with an authorized user. Instead, only part of the RSA key was sufficiently validated, allowing a specially constructed alternative key to be accepted under conditions where it should have been rejected.

The most important details for CVE-2026-67276 are that an attacker needs to know a valid RouterOS username and the public modulus associated with that user’s authorized RSA SSH key. The attacker can then construct another key that passes the vulnerable validation process and authenticate without possessing the corresponding private key.

Successful exploitation of this flaw alone gives the attacker the same RouterOS permissions assigned to the impersonated account. If the targeted user already has administrative rights, that may directly provide significant control over the device. When the user’s permissions are more limited, attackers can combine the flaw with CVE-2026-86060 to escalate further.

CVE-2026-86060 stems from improper handling of specially crafted SSH usernames beginning with a prohibited character. The flaw allows manipulation of the RouterOS policy mask associated with the SSH session, enabling privilege escalation to full administrative rights. CERT Polska confirms that exploiting the two weaknesses together enables unauthenticated takeover of a RouterOS device when SSH is exposed.

This chain is especially important because it removes the usual requirement to steal a valid administrator password or private SSH key. An external actor capable of reaching the SSH service may be able to move from crafted authentication attempts to a privileged RouterOS session and then perform administrative operations.

Attempts to exploit MikroTik RouterOS in observed attacks have focused on devices exposing SSH directly to the internet. MikroTik notes that default home configurations are generally not immediately exposed, but administrators who have enabled public SSH or changed firewall rules may face substantially greater risk.

CVE-2026-67276 affects the following RouterOS release ranges:

• RouterOS 7.24 through versions before 7.24.2
• RouterOS 7.0.0 through versions before 7.23.4
• RouterOS 6.0.0 through versions before 6.49.21

CERT Polska categorized the vulnerability as CWE-347: Improper Verification of Cryptographic Signature. All six RouterOS security issues disclosed in the same research share the same broad affected release ranges.

The vulnerability was discovered by CERT Polska as part of security research performed in coordination with MikroTik. Researchers used an agent-based laboratory environment supported by AI models to analyze RouterOS components, compare software versions, model protocol states, and validate hypotheses against real test systems. Each finding was subsequently confirmed manually and through repeat testing before disclosure.

The precise private discovery date has not been published. MikroTik released the security fixes on September 3, 2026, while CERT Polska published technical information and the assigned CVEs on September 5. Real-world evidence indicates that attackers were already exploiting the chain by September 2, giving the campaign zero-day characteristics.

Researchers have confirmed successful attacks originating from 82.192.72[.]4, with exploitation attempts also associated with 103.102.31[.]18. Observed compromises created a highly privileged RouterOS user named ops.

Security Affairs also reported infrastructure at 82.192.72[.]4 hosting a MIPS BusyBox binary and files named ftpsrv.py, launch.sh, and serve.py. The available evidence has not yet tied the activity to a named threat group or established whether the compromised routers are being assembled into a botnet, proxy network, espionage infrastructure, or another operation.

The observed attack chain leaves particularly useful artifacts in RouterOS logs and configuration history. Failed exploitation attempts can generate entries resembling:

login failure for user -2 from <ip> via ssh

Successful activity may subsequently appear as:

user <name> added by ssh:-2@<ip>

The string -2 is especially suspicious because it is not a normal RouterOS username and has been associated with exploitation of the privilege-manipulation stage.

A public CVE-2026-67276 PoC has now appeared for controlled laboratory testing of the SSH authentication weakness. Its availability further lowers the barrier for independent reproduction of the flaw, reinforcing the need to patch before scanning and exploitation become more widespread.

Useful CVE-2026-67276 IOCs currently include the two observed source IP addresses, the abnormal -2 SSH username, the ops account, and configuration changes attributed to ssh:-2@<IP>. Security Affairs additionally published hashes for several files recovered from associated attacker infrastructure.

CVE-2026-67276 Mitigation

MikroTik and CERT Polska recommend upgrading RouterOS immediately. Fixes are available in:

• RouterOS 7.25 beta 3 or later
• RouterOS 7.24.2 or later
• RouterOS 7.23.4 or later
• RouterOS 6.49.21 or later

MikroTik subsequently released RouterOS 7.23.5 after an IPv6 DHCP regression was discovered in 7.23.4. Organizations using the long-term 7.23 branch should therefore use the latest available maintenance build rather than intentionally stopping at 7.23.4.

After updating, RouterOS performs a startup check for selected known indicators of unauthorized configuration changes. If suspicious modifications are identified, the device is assigned a Flagged status, the relevant configuration entries can be disabled, and a critical warning is written to the system log.

Administrators can inspect this state with:

/system/device-mode/print

A Flagged result should be treated as evidence that the device may have been compromised. However, both MikroTik and CERT Polska emphasize that the absence of the Flagged marker does not prove that a router is clean, because the mechanism only detects selected known artifacts.

CVE-2026-67276 detection should therefore combine patch verification with log review, configuration inspection, and analysis of recently created accounts and administrative changes.

To Detect CVE-2026-67276 exploitation or related MikroTrick activity, defenders should look for:

• login failure for user -2 … via ssh
• Administrative actions attributed to ssh:-2@<IP>
• An unexpected privileged account named ops
• Connections involving 82.192.72[.]4
• Connections involving 103.102.31[.]18
• Newly added or modified SSH public keys
• Unknown users or changed user permissions
• Unexpected RouterOS scripts
• Suspicious scheduler tasks
• Newly enabled proxies or tunnels
• Unexplained firewall or NAT modifications
• Packet-sniffing or traffic-forwarding configuration that administrators did not create
• Other unexpected configuration changes following SSH activity

If administrators cannot patch immediately, CERT Polska recommends disabling externally exposed services or restricting them exclusively to trusted management networks. This applies particularly to SSH, WWW/WWW-SSL, and the bandwidth-test server.

Unpatched devices should also avoid initiating SSH or TLS connections toward untrusted systems. CERT Polska specifically recommends avoiding RouterOS’s built-in /system ssh and /system ssh-exec clients until updates are installed because other vulnerabilities disclosed in the same research affect RouterOS client-side trust and protocol handling.

These measures reduce exposure but do not replace the vendor update.

If logs, the Flagged status, an unknown ops account, or other configuration evidence suggests compromise, administrators should treat the router as fully controlled by an attacker. The affected device should be isolated, and relevant logs and configuration evidence should be preserved before remediation.

CERT Polska then recommends restoring the device to factory settings and rebuilding the configuration from a trusted and verified source. Administrators should not simply restore a complete backup created from a potentially compromised router because malicious users, scripts, SSH keys, scheduler entries, proxies, or tunnels could be reintroduced.

All passwords, SSH keys, API credentials, VPN secrets, and other authentication material exposed to or stored on a compromised device should also be rotated.

The CVE-2026-67276 mitigation priority is particularly high for routers that exposed SSH to the public internet before September 3. Because active attacks began before the security update became publicly available, patching those systems should be accompanied by retrospective investigation rather than treated solely as preventive maintenance.

The post CVE-2026-67276: MikroTik RouterOS SSH Zero-Day Exploited in Router Takeover Attacks appeared first on SOC Prime.

Cisco has released security updates for a critical vulnerability affecting selected Nexus 9000 Series switches that can allow an unauthenticated remote attacker to execute arbitrary code with root privileges. Tracked as CVE-2026-20212 and rated 9.8 on the CVSS scale, the flaw affects Nexus 9000 models equipped with a Cisco Silicon One ASIC.

The vulnerability stems from an unintended network exposure in the Silicon One integration. TCP ports 43210 and 43211 are accessible through the default Layer 3 virtual routing and forwarding (VRF) instance, allowing an attacker who can reach either port to connect directly to the vulnerable service. Crafted input sent through the exposed service can then be executed with root privileges.

Successful exploitation can also crash the S1HAL process, potentially forcing the affected switch to reload and causing network disruption. Cisco said its Product Security Incident Response Team was not aware of malicious exploitation or public announcements targeting the flaw when the advisory was released on September 2, 2026.

The vulnerability is especially significant because Nexus 9000 switches commonly operate at the center of enterprise and data-center networks. Root-level compromise could give an attacker extensive control over network configuration and potentially create opportunities for traffic interception, service disruption, persistence, or movement toward connected infrastructure.

Contact Sales

CVE-2026-20212 analysis

The vulnerability is classified as CWE-1327: Binding to an Unrestricted IP Address. The underlying problem is not an authentication implementation error but the exposure of a privileged Silicon One service through interfaces where it should not be reachable.

Under the default Layer 3 VRF configuration, TCP ports 43210 and 43211 listen in a manner that allows remote systems to reach the service. An attacker does not need a valid Cisco account, administrator credentials, or an existing foothold on the switch. They only need network connectivity to one of the affected device’s locally configured addresses on either vulnerable port.

Once connected, an adversary can send specially crafted input to the exposed service. Cisco confirms that this input can be interpreted and executed as code with root privileges, effectively giving the attacker the highest level of operating-system control available on the device.

The most important details for CVE-2026-20212 are reflected in its CVSS vector: network-based exploitation, low attack complexity, no privileges required, and no user interaction. Successful exploitation can have high impact on confidentiality, integrity, and availability.

CVE-2026-20212 affects Nexus 9000 switches containing a Silicon One ASIC. Cisco lists the following product identifiers as vulnerable at the time of disclosure:

• N9324C-SE1U
• N9348Y2C6D-SE1U
• N9364E-SG2-O
• N9364E-SG2-Q
• N9396T12C-SE1
• N9348Y12C-SE1
• N9396Y12C-SE1
• N9336C-SE1
• N9K-C9804
• N9K-C9808

To determine the PID for a device, use the show module CLI command. In the following example, the PID of the device is N9336C-SE1, which is on the list of devices that are affected by this vulnerability.

Cisco’s CVE record lists 45 affected NX-OS releases, beginning with 10.3(1) and extending through releases including 10.6(3) and 10.6(3s). Because exposure depends on both the switch model and NX-OS version, organizations should verify each system through Cisco’s Software Checker rather than relying only on the broad version range.

Cisco has confirmed that Nexus 9000 models not listed in the advisory are not affected. Nexus 9000 Fabric Switches operating in Application Centric Infrastructure (ACI) mode are also not vulnerable.

Other confirmed unaffected products include:

• Nexus 3000 Series switches
• Nexus 7000 Series switches
• MDS 9000 Series multilayer switches
• Cisco Firepower appliances
• Secure Firewall products
• Multiple UCS Fabric Interconnect platforms

This distinction is important because the vulnerability is specifically tied to the Silicon One integration present in the affected Nexus 9000 hardware rather than to NX-OS universally.

The potential post-compromise impact is substantial. An attacker operating as root could theoretically modify switch configuration, interfere with network services, manipulate routing or forwarding behavior, monitor traffic available to the compromised device, or attempt to establish persistence. These are realistic consequences of root-level device compromise, although Cisco has not reported such activity occurring through this vulnerability.

Exploitation can also have an immediate availability impact without establishing long-term access. Cisco warns that attempts to exploit the flaw can cause the Silicon One Hardware Abstraction Layer process, S1HAL, to crash. A crash can cause the entire device to reload, potentially interrupting connectivity for systems depending on the affected switch.

Cisco discovered the vulnerability while resolving a Technical Assistance Center support case. The company has not disclosed the exact date on which the underlying security issue was first identified. The public security advisory was issued on September 2, 2026.

As of September 4, Cisco said it was not aware of malicious exploitation, and CISA’s vulnerability enrichment data classified exploitation as none while describing the issue as automatable with total technical impact.

There was also no confirmed public CVE-2026-20212 PoC identified in Cisco’s disclosure or the two requested reports. The absence of public exploit code should not significantly reduce remediation priority, however, because the basic network exposure and vulnerable ports are already publicly documented.

Cisco has not published campaign-specific CVE-2026-20212 IOCs, which is expected because no attacks have been confirmed. Defenders should instead focus on attempts to access TCP 43210 or 43211, Live Protect events, unexpected S1HAL instability, and unauthorized changes occurring on affected devices.

CVE-2026-20212 Mitigation

Cisco has released fixed NX-OS software and strongly recommends upgrading affected Nexus switches. Rather than publishing a single fixed-version table in the advisory, Cisco directs customers to its Software Checker, which identifies whether a specific NX-OS version is affected and returns the earliest fixed release for that platform.

Administrators should therefore:

1. Run show module to identify the switch model.
2. Confirm whether its PID appears in Cisco’s vulnerable-product list.
3. Determine the installed NX-OS release.
4. Use Cisco Software Checker to identify the appropriate fixed release.
5. Upgrade affected systems as soon as operationally possible.

For organizations that cannot immediately upgrade, Cisco provides an infrastructure access control list workaround. Administrators can configure iACLs to allow only required management and control-plane traffic or explicitly deny TCP traffic destined for a locally configured switch address on ports 43210 and 43211.

Cisco states that the workaround was successfully validated in a test environment, but organizations should evaluate its effect on their individual network design before deployment. Network-level mitigations can affect expected functionality when applied without considering local architecture.

Cisco has additionally released Live Protect shield lp00031 as a temporary mitigation. The shield blocks attempts to exploit CVE-2026-20212 while administrators prepare a full software upgrade. Cisco emphasizes that Live Protect is a bridge to patching rather than a permanent remediation.

The Live Protect documentation provides a useful security signal as well. Administrators can verify that the shield is in enforcement mode with:

show nxsecure policy status

They can inspect recorded events using:

show nxsecure log lp00031

When the shield blocks activity targeting the vulnerability, NX-OS can generate a critical NXSECURE syslog indicating a hit against CVE-2026-20212.

For affected systems running NX-OS 10.6(3), Cisco documents support for shield lp00031. A separate package is available for the N9324C-SE1U and N9348Y2C6D-SE1U Smart Switches running 10.6(3s). Cisco’s shield documentation states that the mitigation transitions to N/A when upgrading to NX-OS 10.6(4) or higher, but customers should still use Software Checker to confirm the correct fixed release for their specific hardware and software combination.

CVE-2026-20212 detection should start with identifying affected hardware and monitoring access to the two exposed service ports. Network telemetry, ACL logs, NetFlow data, switch logs, and intrusion detection systems can help identify suspicious attempts to reach TCP 43210 or 43211.

To Detect CVE-2026-20212 exploitation attempts or related compromise, defenders should investigate:

• Unexpected inbound connections to TCP ports 43210 or 43211
• Live Protect lp00031 hit events
• %APPMGR-2-NXSECURE_CRIT_THREAT messages associated with the vulnerability
• Unexpected crashes or restarts of the S1HAL process
• Unplanned Nexus switch reloads
• Administrative or configuration changes without a corresponding authorized activity
• New or unusual processes running on the switch
• Unexpected outbound connections originating from the network device
• Changes to access-control, routing, forwarding, or management configuration
• Attempts to disable logging or security controls following suspicious network traffic

Cisco has also published Snort Rule 67005 in connection with the advisory, providing another detection option for organizations using compatible Cisco security tooling.

If suspicious activity is identified on an unpatched switch, defenders should treat the event as potentially serious because exploitation provides root privileges. Incident response should include configuration validation, administrative account review, log preservation, comparison against known-good device state, and investigation of systems communicating with the affected switch.

The CVE-2026-20212 mitigation priority should be particularly high for devices whose affected ports are reachable from user segments, externally accessible networks, or other untrusted infrastructure. Blocking the ports can substantially reduce immediate exposure, but upgrading to Cisco’s fixed software remains the vendor-recommended permanent solution.

The post CVE-2026-20212: Critical Cisco Nexus 9000 Flaw Enables Unauthenticated Root RCE appeared first on SOC Prime.

Google has released an emergency Chrome security update addressing a high-severity zero-day vulnerability that is already being exploited in the wild. Tracked as CVE-2026-85046 and rated 8.8 on the CVSS scale, the flaw is a type confusion issue in V8, the JavaScript and WebAssembly engine used by Google Chrome.

Successful exploitation can allow a remote attacker to execute arbitrary code inside Chrome’s sandbox after a victim visits a specially crafted HTML page. Google has confirmed that an exploit exists in the wild but has not disclosed information about the threat actors, targeted organizations, or attack campaigns while the update is still rolling out.

CVE-2026-85046 affects Chrome versions earlier than 152.0.7977.82. Google has released Chrome 152.0.7977.82/.83 for Windows and macOS and 152.0.7977.82 for Linux, with the security update being distributed progressively to users.

The vulnerability is the sixth Chrome zero-day Google has addressed in 2026 after previously exploited flaws including CVE-2026-2441, CVE-2026-3909, CVE-2026-3910, CVE-2026-5281, and CVE-2026-11645.

CVE-2026-85046 analysis

The vulnerability is categorized as CWE-843: Access of Resource Using Incompatible Type, commonly referred to as type confusion. This class of memory-safety weakness occurs when software incorrectly treats an object as a different data type than the one actually stored in memory.

In JavaScript engines such as V8, incorrect assumptions about object types can become particularly dangerous because highly optimized compiler paths depend on accurate information about how arrays and objects are represented in memory.

Security researcher Salvatore Gulizia, also known as Serotav, explained that the flaw involves V8 compiler behavior where an array containing PACKED_ELEMENTS can incorrectly receive a PACKED_SMI_ELEMENTS map. That mismatch can ultimately be transformed into arbitrary read and write access within the JavaScript heap.

The most important details for CVE-2026-85046 are that exploitation is remotely reachable, requires no existing privileges, and can be delivered through malicious web content. The published CVSS vector indicates that user interaction is required, meaning the victim must load attacker-controlled content, such as by visiting a malicious or compromised page.

A typical exploitation scenario could begin when a user follows a phishing link, encounters a malicious advertisement, or visits a legitimate website that has been compromised. Crafted JavaScript or HTML content could then trigger the V8 type confusion and corrupt the assumptions Chrome uses when accessing objects in memory.

The resulting primitive can enable arbitrary code execution inside the Chrome sandbox. This distinction is important: CVE-2026-85046 alone does not necessarily provide complete control over the underlying operating system. A threat actor seeking full host compromise would normally need to combine browser code execution with an additional sandbox escape or privilege-escalation vulnerability.

Google has deliberately restricted access to the Chromium bug report while most users receive the patch. This is standard practice for actively exploited Chrome vulnerabilities because publishing complete technical details too quickly could make it easier for additional attackers to reverse-engineer and weaponize the flaw.

The vulnerability was reported to Google by Salvatore Gulizia on August 4, 2026. Google awarded the researcher a $1,000 bug bounty, and the flaw was publicly patched as part of the September 3 Stable Channel update.

The update fixes 12 security vulnerabilities in total. Besides the exploited V8 issue, Google addressed high-severity weaknesses involving CrashReporting, Network, Compositing, another V8 race condition, WebGL, CacheStorage, DevTools, and Skia, as well as two medium-severity issues.

Google has confirmed active exploitation but has not released a public CVE-2026-85046 PoC. Access to the underlying Chromium issue also remains restricted, limiting the technical information currently available for reproducing the exploit.

There are likewise no campaign-specific CVE-2026-85046 IOCs published by Google. The company has not identified malicious domains, IP addresses, payload hashes, or specific exploitation infrastructure associated with the observed attacks.

The absence of public indicators makes vulnerability exposure and behavioral telemetry more important than static threat intelligence. Organizations should assume that any endpoint running an affected browser version can remain exposed when users browse attacker-controlled content.

Contact Sales

CVE-2026-85046 Mitigation

Google recommends upgrading Chrome immediately to:

• 152.0.7977.82/.83 or later on Windows
• 152.0.7977.82/.83 or later on macOS
• 152.0.7977.82 or later on Linux

Users can verify the installed version by opening Chrome → Help → About Google Chrome. The browser will check for updates automatically, but Chrome must be relaunched after installation for the new version and security fixes to become active.

Enterprise administrators should verify deployment rather than relying exclusively on Chrome’s gradual automatic rollout. Managed endpoints that have not restarted after receiving the update may continue running the vulnerable browser process until users relaunch Chrome.

CVE-2026-85046 detection should begin with endpoint inventory. Security teams should identify systems running Chrome releases earlier than 152.0.7977.82 and prioritize endpoints exposed to external browsing, email links, web advertising, and other untrusted web content.

To Detect CVE-2026-85046 exploitation or suspicious browser activity, defenders should look for combinations of:

• Chrome renderer crashes followed by unusual process activity
• Unexpected processes launched from the Chrome process tree
• Browser exploitation alerts generated by EDR or endpoint protection tools
• Suspicious memory-corruption behavior involving Chrome or V8
• Visits to newly registered, compromised, or known malicious websites immediately before anomalous activity
• Unexpected executable or script activity following a browser session
• Attempts to exploit a second vulnerability after Chrome renderer compromise
• New persistence or privilege-escalation activity occurring immediately after suspicious browser behavior

These signals are hunting leads rather than exploit-specific signatures because Google has not disclosed the in-the-wild exploitation technique.

Organizations should also review web proxy, DNS, EDR, and email-security telemetry around suspicious Chrome events. Since exploitation requires loading crafted web content, correlating browser crashes or unusual child-process activity with recently visited domains can help identify possible attack chains.

Chromium-based browsers such as Microsoft Edge, Brave, Opera, and Vivaldi also rely on Chromium components, including V8. Users of these products should install vendor updates containing the corresponding Chromium security fix as soon as those releases become available.

Because exploitation was already underway before public disclosure, CVE-2026-85046 mitigation should include both rapid patching and retrospective investigation of suspicious browser activity on systems that remained vulnerable before September 3.

The post CVE-2026-85046: Actively Exploited Chrome V8 Zero-Day Enables Code Execution appeared first on SOC Prime.

SonicWall has released emergency security updates for two vulnerabilities affecting its Secure Mobile Access (SMA) 1000 series appliances after confirming that both flaws have been exploited in the wild. Tracked as CVE-2026-83548 and CVE-2026-83549, the issues affect the Appliance Work Place and Appliance Management Console components and may be chained to move from unauthenticated external access to arbitrary operating-system command execution.

The more severe vulnerability, CVE-2026-83548, carries a maximum CVSS score of 10.0. It is a pre-authentication server-side request forgery (SSRF) flaw caused by an unintended alternate access path in the Appliance Work Place interface. A remote attacker can exploit it without credentials to reach sensitive functionality and perform unauthorized operations.

CVE-2026-83549 is rated 7.8 and affects the Appliance Management Console. Under specific conditions, an authenticated administrator can exploit an OS command injection weakness to execute arbitrary commands, potentially resulting in remote code execution on the appliance.

The combination is what makes these SonicWall product vulnerabilities particularly dangerous. SonicWall says it investigated a case showing active exploitation of both issues, while SecurityWeek and The Hacker News note that the activity suggests attackers may be chaining the pre-authentication weakness with the command injection flaw to execute code on vulnerable SMA 1000 devices.

CVE-2026-83548 and CVE-2026-83549 analysis

CVE-2026-83548 resides in the SMA 1000 Appliance Work Place interface and is categorized as a pre-authentication SSRF vulnerability. The weakness exists because an unintended alternate access path allows requests to reach functionality that should not be accessible to an unauthenticated remote user.

The most important details for CVE-2026-83548 are reflected in its attack requirements. The vulnerability is reachable over the network, requires low attack complexity, does not require prior privileges, and does not need user interaction. Its CVSS vector indicates potentially high confidentiality, integrity, and availability impact if the vulnerable path is successfully abused.

Unlike a conventional SSRF bug that may simply force a server to make an outbound request, SonicWall describes this issue as enabling unauthorized access to sensitive functionality and unauthorized operations. That broader impact explains the maximum 10.0 severity rating and why the flaw is especially concerning on internet-facing remote-access appliances.

CVE-2026-83549 operates later in a potential attack chain. It is an OS command injection vulnerability in the Appliance Management Console. SonicWall says a remote authenticated attacker operating as an administrator can exploit the weakness under specific conditions to execute arbitrary OS commands, resulting in remote code execution.

CVE-2026-83549 affects the same SMA 1000 firmware branches as the SSRF issue. The potentially important relationship between the two flaws is that the first weakness removes the normal authentication barrier to sensitive functionality, while the second requires administrative access before command execution becomes possible.

SonicWall has not publicly documented the exact technical steps connecting the two vulnerabilities. However, because the vendor confirmed exploitation of both issues in the same investigated case, SecurityWeek and The Hacker News assess that threat actors may be combining them to achieve unauthenticated remote code execution.

This distinction matters. CVE-2026-83549 alone should not be described as a pre-authentication RCE vulnerability. Its documented prerequisite is on its own, exploitation requires an authenticated administrator and specific system conditions. The concern is that CVE-2026-83548 may provide the unauthorized access required to reach or enable the command-injection path.

The affected hardware and virtual platforms are:

• SMA 6210
• SMA 7210
• SMA 8200v, across all supported hypervisors

SonicWall lists the vulnerable firmware ranges as 12.4.3-03453 and earlier and 12.5.0-02835 and earlier.

The flaws do not affect SSL VPN functionality on SonicWall firewalls or the separate SMA 100 series. They are specific to the SMA 1000 product family covered by SonicWall advisory SNWLID-2026-0016.

The vulnerabilities are notable partly because SMA appliances are commonly placed at the enterprise perimeter and provide remote access to internal resources. Successful compromise of such a system can potentially give attackers a valuable foothold close to authentication infrastructure, internal applications, and privileged network paths.

Contact Sales

If attackers gain arbitrary command execution on the appliance, potential consequences include persistence, credential theft, configuration manipulation, traffic interception, additional malware deployment, and lateral movement toward internal systems. The public reporting does not confirm that all of these activities occurred in the current exploitation, but they represent realistic post-compromise risks once an adversary gains OS-level command execution on a remote-access gateway.

Both vulnerabilities were discovered internally by SonicWall. The Hacker News credits William Perry and Adam Babis with identifying the issues. The CVE records and vendor advisory were published on September 1, 2026, but SonicWall has not disclosed the original internal discovery date or how long the threat actors may have been exploiting the new flaws before remediation became available.

The disclosure follows a separate series of SMA 1000 zero-days patched in July 2026, CVE-2026-15409 and CVE-2026-15410. Those earlier vulnerabilities were exploited by a threat actor tracked as UTA0533 and were associated with KNUCKLEBALL malware. SonicWall explicitly states that CVE-2026-83548 and CVE-2026-83549 are unrelated to previously reported vulnerabilities in other SonicWall products.

As of the initial September disclosure, there was no indexed public CVE-2026-83548 PoC identified by the sources reviewed. Despite the absence of public exploit code, confirmed in-the-wild exploitation means defenders should assume working private exploit capability already exists.

SonicWall has also not disclosed who is behind the new attacks, which organizations were targeted, or whether the activity is linked to espionage, cybercrime, ransomware, or the actors responsible for the earlier SMA 1000 campaign.

No complete public set of CVE-2026-83549 IOCs accompanied SonicWall’s initial notice. The vendor instead instructs affected customers to contact SonicWall Technical Support for assistance reviewing appliances for evidence of compromise.

That absence of campaign-specific indicators makes configuration and behavioral monitoring particularly important. Organizations should not wait for a malicious IP address, payload hash, or exploit signature before investigating an internet-facing appliance that remained vulnerable during the exploitation window.

CVE-2026-83548 and CVE-2026-83549 Mitigation

SonicWall recommends that every organization operating affected physical or virtual SMA 1000 appliances immediately upgrade to the latest hotfix. The fixed firmware versions are:

• 12.4.3-03526
• 12.5.0-02952

Any later release containing these security fixes should also address the vulnerabilities. Organizations should verify the installed platform-hotfix version rather than assuming a system is protected simply because it runs the 12.4.3 or 12.5.0 branch.

CVE-2026-83548 detection should begin with a full inventory of SMA 1000 appliances and verification of their exact firmware builds. Systems running 12.4.3-03453 or older, or 12.5.0-02835 or older, should be considered exposed and prioritized for investigation as well as patching.

To Detect CVE-2026-83549 exploitation or suspicious activity related to the potential chain, security teams should review appliance, management, authentication, and network telemetry for signs such as:

• Unexplained administrative sessions
• Privileged actions without corresponding legitimate administrator activity
• Unexpected commands or processes executed by appliance services
• Configuration changes originating from unfamiliar sources
• Suspicious requests to the Appliance Work Place interface
• Activity reaching management functionality without a normal authentication sequence
• New or modified administrator accounts
• Unexpected outbound connections from the SMA appliance
• Changes to authentication or remote-access configuration
• Attempts to disable logging, monitoring, or security controls
• Suspicious activity immediately preceding OS command execution

These behaviors are investigation leads rather than vulnerability-specific signatures because SonicWall has not publicly documented the complete exploit chain.

Organizations should also preserve appliance logs before upgrading where practical. Installing fixed firmware prevents future exploitation through the known flaws, but it does not identify or remove persistence established before remediation.

The CVE-2026-83549 mitigation guidance is particularly important for appliances showing any suspicious indicators. SonicWall instructs customers to contact Technical Support for help reviewing the system and, when compromise indicators are detected, take the following steps:

• Upgrade to the latest hotfix version – available via https://www.mysonicwall.com
• Contact SonicWall Technical Support for assistance reviewing the system for indicators of compromise (IoCs).
• If IOCs are detected on the system:
• Re-image (hardware) or re-deploy (virtual) appliances.
• Change all user & administrator passwords.
• Reset TOTP tokens

Credential rotation is necessary because an attacker with administrative or OS-level access may have been able to obtain authentication data or establish access that remains useful after the vulnerable firmware itself has been replaced.

Organizations should also review systems reachable through the affected remote-access gateway. A compromised SMA appliance should not be treated as an isolated perimeter event if logs indicate successful arbitrary command execution. Incident response should examine downstream authentication systems, administrative interfaces, internal servers, and credentials potentially accessible from the appliance.

Reducing external exposure provides another layer of protection. Management functions should only be reachable from authorized administrative networks or controlled access paths. Organizations should restrict unnecessary internet access, enforce network segmentation, and monitor administrative interfaces for unexpected connections.

SonicWall’s response guidance is particularly important because these vulnerabilities are already being exploited. Patching should therefore be combined with retrospective threat hunting rather than treated as a purely preventive maintenance task.

The post CVE-2026-83548 and CVE-2026-83549: SonicWall SMA 1000 Zero-Days Exploited in the Wild appeared first on SOC Prime.

A critical authentication bypass vulnerability in JFrog Artifactory moved into active exploitation only days after its public disclosure. Tracked as CVE-2026-82329 and rated 9.8 on the CVSS scale, the flaw can allow an unauthenticated attacker with network access to obtain administrator-level privileges on vulnerable Artifactory instances.

JFrog disclosed and patched the issue on August 28, 2026. By September 1, exposure management company watchTowr had already observed attackers exploiting vulnerable systems to generate administrative tokens and enumerate users, groups, credentials, and federated access relationships.

The Critical JFrog Artifactory Vulnerability is particularly dangerous because Artifactory frequently occupies a privileged position in software development and delivery pipelines. Organizations use it to store and distribute binaries, containers, packages, AI models, and other software artifacts. Administrative compromise can therefore create opportunities not only for data theft but also for software supply-chain manipulation and lateral movement into production infrastructure.

JFrog Cloud environments have already been secured by the vendor. Organizations operating self-hosted Artifactory deployments must upgrade to the fixed release corresponding to their current branch.

CVE-2026-82329 analysis

The vulnerability is categorized as CWE-287: Improper Authentication. JFrog’s advisory states that “JFrog Artifactory contains an authentication weakness” that, under the default configuration, can allow a remote attacker without credentials to gain administrative privileges.

The flaw resides in JFrog Access, the platform component responsible for issuing and validating credentials. According to watchTowr’s analysis cited by The Hacker News, vulnerable installations without an additional join key configured can receive what researchers describe as a “phantom” join key. An attacker can abuse this condition to forge access and generate administrator-level token.

This is what makes the vulnerability significantly more severe than a conventional information-disclosure bug. The attacker does not need to steal a legitimate username, password, API key, or session first. The CVSS vector confirms network-based exploitation with low complexity, no privileges required, and no user interaction. Confidentiality, integrity, and availability are all rated as having high potential impact.

The most important details for CVE-2026-82329 concern what attackers can do after the authentication boundary is bypassed. WatchTowr observed threat actors minting administrator tokens, then using those privileges to inspect the environment and determine whether it was valuable enough for deeper exploitation.

Observed post-exploitation activity included enumeration of:

• Existing Artifactory users
• User groups
• Authentication tokens and credential sets
• Federated access relationships
• Other information useful for understanding how the Artifactory environment connects to surrounding infrastructure

In a limited number of attacks, threat actors went further and created backdoor users, establishing an additional path for persistent administrative access.

The exploited critical JFrog Artifactory flaw poses a broader security concern because Artifactory is often part of CI/CD and software distribution workflows. Administrator-level access may allow an adversary to inspect repositories, alter configuration, access stored credentials, or potentially interfere with artifacts that are later consumed by build and deployment systems.

WatchTowr warned that compromise of a central software supply-chain platform could allow attackers to tamper with build pipelines, move laterally toward production infrastructure, or introduce malicious changes that could ultimately propagate downstream. The available reporting does not confirm that these more severe supply-chain scenarios have occurred in the observed attacks, but administrator compromise makes them realistic post-exploitation risks.

CVE-2026-82329 affects multiple supported Artifactory 7.x branches. JFrog lists the vulnerable and fixed versions as follows:

• 7.161.x: upgrade to 7.161.20
• 7.146.x: upgrade to 7.146.38
• 7.133.x: upgrade to 7.133.29
• 7.125.x: upgrade to 7.125.20
• 7.117.x: upgrade to 7.117.28
• 7.111.x: upgrade to 7.111.21

JFrog published the vulnerability on August 28, 2026. The exact original discovery date and circumstances have not been publicly disclosed in the vendor advisory. The speed with which exploitation followed disclosure is notable: watchTowr began observing real-world activity on September 1, only four days after the advisory and fixes became public.

WatchTowr’s global honeypot network initially saw exploitation originating from a relatively small number of IP addresses across different geographic regions. Researchers said the activity had not yet developed into broad mass scanning at the time of their report.

Some attempts appeared to stop after simply verifying that exploitation worked. Others proceeded to enumerate the compromised instance, suggesting attackers were assessing exposed environments before deciding whether to continue with deeper intrusion activity.

Public technical reproduction information has also started to emerge. A CVE-2026-82329 PoC published after disclosure demonstrates an unauthenticated path to administrator-level token generation against a vulnerable Artifactory build and shows the same attempt being rejected by a patched release. This further increases the urgency of updating exposed systems because exploitation no longer requires independently reverse-engineering the vulnerability from scratch.

At the time of reporting, the activity had not been attributed to a specific ransomware operation, state-sponsored group, or other established threat actor. There was also no evidence that exploitation had reached widespread automated scanning levels.

There is currently no comprehensive vendor-published set of CVE-2026-82329 IOCs that can reliably identify every exploitation attempt. The observed attacks instead provide behavioral indicators: unexpected administrative tokens, unauthorized users, unusual account enumeration, and access to federated authentication information should all be treated as potential signs of compromise.

Contact Sales

CVE-2026-82329 Mitigation

JFrog recommends that organizations running self-hosted Artifactory installations immediately upgrade to the fixed version applicable to their release branch. The vendor confirms that affected cloud environments have already been fortified and require no customer action for this specific issue.

Self-hosted customers should update to one of the following versions or a newer supported release containing the fix:

• 7.161.20
• 7.146.38
• 7.133.29
• 7.125.20
• 7.117.28
• 7.111.21

Because active exploitation began within days of disclosure, internet-facing instances should receive the highest patching priority. Organizations should not rely solely on the absence of obvious malicious activity, particularly because some observed attackers appeared to validate the vulnerability and stop, potentially leaving few immediately visible post-exploitation artifacts.

CVE-2026-82329 detection should begin with identifying all self-managed Artifactory instances and comparing their exact versions against JFrog’s vulnerable ranges. Security teams should then determine which systems are exposed to untrusted networks and prioritize those instances for both patching and retrospective investigation.

To Detect CVE-2026-82329 exploitation or post-compromise activity, defenders should review Artifactory and JFrog Access audit data for:

• Unexpected administrator-level tokens
• Tokens created without a corresponding legitimate administrator action
• Newly created or any other accounts
• Unusual enumeration of users and groups
• Requests that enumerate token or credential information
• Sudden administrative activity originating from unfamiliar IP addresses
• Repository or permission changes following suspicious authentication activity
• New access relationships between Artifactory and connected development infrastructure
• Unexpected changes to artifacts, build configuration, or repository settings

Security teams should pay particular attention to administrator tokens created around the time of suspicious unauthenticated requests. The real-world attacks observed by watchTowr demonstrate that token minting is a central part of the exploitation path.

Patching alone may not be sufficient for an Artifactory instance that was exposed before remediation. If an attacker successfully generated administrator credentials, those credentials or backdoor accounts can potentially remain usable after the underlying vulnerability has been fixed.

Organizations should therefore inspect historical audit logs and rotate credentials that may have been exposed. The Hacker News recommends reviewing audit activity, rotating affected credentials, and examining connected systems for unauthorized modifications or persistent access.

Incident responders should also review:

• Artifactory administrator accounts
• Access and identity tokens
• Repository permissions
• Federation relationships
• CI/CD integration credentials
• Build-system secrets
• Package and artifact integrity
• Recently changed binaries and container images
• Systems reachable using credentials stored in or accessible from Artifactory

Where compromise is confirmed, teams should consider the potential impact on the broader software delivery chain rather than treating the event as an isolated Artifactory account incident. A malicious administrator may have had opportunities to inspect or alter assets later consumed by downstream development, deployment, or production systems.

The CVE-2026-82329 mitigation process should therefore combine immediate upgrading with credential rotation, account review, artifact integrity validation, and threat hunting across connected CI/CD infrastructure.

The post CVE-2026-82329: Critical JFrog Artifactory Authentication Bypass Exploited in the Wild appeared first on SOC Prime.

HPE has released security updates addressing a maximum-severity remote code execution vulnerability affecting its network fabric management platform. Tracked as CVE-2026-76658 and rated 10.0 on the CVSS v3.1 scale, the flaw can allow an unauthenticated remote attacker to gain administrative access and execute arbitrary commands as a privileged operating-system user.

The vulnerability resides in the SSH daemon used by HPE Networking Fabric Composer, a platform designed to manage and automate data-center network fabrics. Successful exploitation can result in complete compromise of the affected management host, creating a potentially serious risk because the appliance may have privileged visibility into and control over network infrastructure.

CVE-2026-76658 is one of dozens of security issues covered by HPE bulletin HPESBNW05133. Another flaw in the same release, CVE-2026-76657, also carries a CVSS score of 10.0 and can allow unauthenticated attackers to bypass API authentication and gain administrative privileges.

At disclosure, HPE said it was not aware of public exploit code or public discussion targeting the newly patched vulnerabilities. Nevertheless, the combination of remote network access, low attack complexity, no authentication requirement, and complete confidentiality, integrity, and availability impact makes CVE-2026-76658 an urgent remediation priority.

CVE-2026-76658 analysis

The flaw specifically affects the product’s SSH daemon. According to HPE’s CVE description, an attacker can remotely interact with a vulnerable Fabric Composer host without first authenticating and obtain administrative access. Successful exploitation then permits arbitrary commands to run as a privileged user on the underlying operating system, potentially leading to complete system compromise.

The most important details for CVE-2026-76658 are reflected in its CVSS vector: AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. This means exploitation is network-accessible, has low attack complexity, requires no existing privileges and no victim interaction, and can result in high confidentiality, integrity, and availability impact. The scope is also marked as changed, indicating that successful exploitation can affect security resources beyond the vulnerable SSH component itself.

CVE-2026-76658 affects Fabric Composer releases from version 7.0.0 through 7.3.3. HPE’s security bulletin recommends upgrading systems remaining on the 7.3 branch to 7.3.4 or later, while organizations moving to the newer branch should use 7.4.0 or later.

The vulnerability’s location in an SSH service is especially important from a defensive perspective. SSH management interfaces are commonly trusted administrative paths, and compromise at this layer could provide an attacker with direct control over the management appliance rather than merely access to an individual web application function.

Unlike vulnerabilities that require valid administrator credentials or an existing foothold, this issue can potentially be triggered by an external actor who can reach the vulnerable SSH service. Administrators should therefore pay close attention to whether the management interface is reachable from user networks, external infrastructure, or other untrusted segments.

HPE has not publicly documented the precise malformed packet, authentication sequence, implementation bug, or protocol state required to exploit the issue. It would therefore be inaccurate to characterize the flaw as a specific buffer overflow, hard-coded credential, command injection, or cryptographic weakness based solely on the information currently available.

What is confirmed is the resulting security boundary failure: an unauthenticated remote actor can obtain administrative access and execute commands with privileged operating-system permissions. If exploited, an attacker could potentially alter Fabric Composer configuration, access information stored on the management host, interfere with management functions, establish persistence, or leverage the system as a foothold for additional activity against reachable infrastructure. Cyber Security News specifically notes that appliance compromise may allow attackers to change configuration, steal information, or move further into the organization’s environment.

The broader HPESBNW05133 bulletin increases the risk because it contains numerous weaknesses across the API, web management interface, installation components, and underlying operating system. Reported vulnerability classes include authentication bypass, remote code execution, cross-site scripting, arbitrary file write, SQL injection, path traversal, privilege escalation, information disclosure, command injection, and denial of service.

Some of these issues may also be useful in chained attacks. For example, CVE-2026-76657 independently allows unauthenticated remote attackers to bypass API authentication and obtain administrative access, while CVE-2026-19766 can provide privileged code execution from an adjacent network under its required conditions.

The public CVE record was published on September 1, 2026. The exact original discovery date for CVE-2026-76658 has not been disclosed. The CNA metadata records the issue as externally discovered and does not identify the contributor by name, while reporting around the broader HPE bulletin notes that multiple vulnerabilities were also uncovered through HPE’s own security research.

As of September 2, there was no known public CVE-2026-76658 PoC and HPE had not reported active exploitation. The vulnerability was also not listed in CISA’s Known Exploited Vulnerabilities catalog at that time.

The absence of public exploit code should not be interpreted as low risk. A network-reachable CVSS 10.0 vulnerability in an administrative SSH service can become substantially more dangerous once researchers or threat actors determine the precise exploitation technique, particularly when vulnerable appliances are reachable from less-trusted network segments.

There are currently no vendor-published CVE-2026-76658 IOCs associated with exploitation campaigns. Defenders therefore need to focus primarily on version exposure, unexpected SSH activity, administrative behavior, and changes made on the management appliance rather than relying on known malicious hashes, domains, or attacker IP addresses.

Contact Sales

CVE-2026-76658 Mitigation

Organizations should upgrade affected Fabric Composer installations immediately. HPE recommends the following fixed versions:

• Fabric Composer 7.3.4 or later for organizations remaining on the 7.3 branch
• Fabric Composer 7.4.0 or later for deployments using the 7.4 branch

Older releases that have reached End of Maintenance should be considered potentially vulnerable unless HPE explicitly states otherwise. End-of-support versions have not necessarily been evaluated and should not be assumed secure simply because they are absent from the supported-version table.

CVE-2026-76658 detection should begin with identifying every Fabric Composer appliance, confirming its exact running version, and determining where its SSH management interface is reachable from. Any installation running version 7.3.3 or earlier should be prioritized for remediation.

Organizations should also verify whether SSH and web management interfaces are isolated from general-purpose and untrusted networks. HPE recommends placing management interfaces on a dedicated Layer 2 segment or VLAN and enforcing Layer 3 firewall controls to limit which systems can reach them.

To Detect CVE-2026-76658 exploitation attempts or suspicious post-compromise activity, security teams should review appliance, authentication, network, and management telemetry for:

• Unexpected SSH connections from unfamiliar systems or network segments
• Administrative sessions without a corresponding authorized maintenance activity
• New or modified administrator accounts
• Commands executed outside expected administrative workflows
• Unexpected changes to Fabric Composer configuration
• New outbound network connections originating from the management appliance
• Attempts to disable or modify logging and accounting controls
• Unexplained access to managed network infrastructure
• Configuration changes immediately following suspicious SSH activity
• Persistence mechanisms or unexpected operating-system processes on the appliance

These signals are behavioral hunting leads rather than vulnerability-specific signatures because HPE has not published the exact network request or protocol sequence required to trigger the flaw.

Organizations should retain and review historical logs from before patch deployment wherever possible. Updating closes the known vulnerability but cannot determine whether an exposed host was compromised before the fix was installed.

Administrators should pay particular attention to unexplained privileged activity on systems whose SSH services were reachable from untrusted networks. Because successful exploitation can provide administrative control and privileged command execution, suspicious activity should trigger investigation of the entire Fabric Composer host rather than only the SSH service.

If compromise is suspected, security teams should examine administrator accounts, authentication records, configuration history, network-management changes, system processes, persistence mechanisms, and credentials accessible from the appliance. Managed switches and other infrastructure controlled through the system should also be reviewed for unauthorized configuration changes.

The broader CVE-2026-76658 mitigation strategy should combine rapid patching with strict segmentation of management interfaces, firewall-based access restrictions, centralized logging, administrative accounting, and regular review of privileged access.

HPE specifically recommends restricting command-line and web management interfaces to dedicated management networks and using logging and accounting controls to track access and user activity. These measures do not replace patching, but they can substantially reduce exposure to future vulnerabilities affecting administrative interfaces.

Given the maximum CVSS score and lack of authentication requirements, vulnerable systems should not remain reachable from untrusted networks while organizations wait for their normal maintenance cycle.

The post CVE-2026-76658: Critical HPE Fabric Composer Flaw Enables Unauthenticated Remote Code Execution appeared first on SOC Prime.

PaperCut is responding to active attacks targeting its NG and MF print management platforms through a pair of zero-day vulnerabilities that can be chained to achieve unauthenticated remote code execution. One of the flaws, tracked as CVE-2026-81578, is a high-severity authentication bypass that enables a remote attacker to modify sensitive PaperCut configuration without first logging in.

Rated 8.8 on the CVSS v4.0 scale, the vulnerability exists in the web management interface and results from administrative actions being processed before access validation has fully completed. On its own, the flaw enables unauthorized configuration changes. Combined with the critical CVE-2026-82078 unsafe dynamic class-loading bug, however, the attack chain can result in arbitrary Java execution under the security context of the PaperCut Application Server.

The Exploited PaperCut Vulnerabilities have already been observed against customer environments. Huntress detected the first known attack activity on August 26, 2026 and reproduced a complete pre-authentication RCE chain against a standard PaperCut NG installation. CISA subsequently added both CVE-2026-81578 and CVE-2026-82078 to its Known Exploited Vulnerabilities catalog, confirming that the threat has moved beyond proof-of-concept exploitation.

PaperCut now treats all versions of PaperCut NG and PaperCut MF as potentially impacted and has released Emergency Patch Release 3 for versions 24, 25, and 26. The latest emergency update supersedes the previous patches and adds additional hardening after researchers and defenders identified further attack paths against incompletely patched systems.

CVE-2026-81578 analysis

The vulnerability is classified as a missing-authentication or improper access control issue affecting PaperCut’s administrative web interface. Under specific conditions, a specially crafted unauthenticated request can reach backend administrative functionality before PaperCut completes the expected access-control checks.

The important details for CVE-2026-81578 involve the difference between the page presented to the requester and the backend action ultimately executed. Huntress found that a crafted request can reference one page to be rendered in the response while targeting a component or action belonging to another page. PaperCut’s vulnerable authorization logic can validate the rendered page rather than correctly enforcing the authorization requirements of the underlying component.

This allows an external attacker with no valid PaperCut account to interact with administrative functionality and alter trusted server configuration.

CVE-2026-81578 affects PaperCut NG and PaperCut MF. PaperCut’s current emergency advisory conservatively applies to all versions of both products while its incident response investigation remains active. PaperCut Hive and PaperCut Pocket are not impacted, while Mobility Print and Print Deploy server components use separate architectures and are also outside the scope of this vulnerability.

The authentication bypass becomes significantly more dangerous when combined with CVE-2026-82078. That second flaw exists in PaperCut’s database connection utilities and involves unsafe dynamic class loading. The software can instantiate database driver classes using configurable driver names without restricting them to an approved allowlist.

Normally, exploiting CVE-2026-82078 requires high privileges because the attacker needs the ability to manipulate the relevant configuration parameters. CVE-2026-81578 supplies that missing step: an unauthenticated attacker can first modify trusted server settings and then abuse the class-loading behavior to execute arbitrary Java bytecode already available on the application’s classpath.

In practice, that transforms two vulnerabilities with different prerequisite conditions into a pre-authentication RCE chain.

Huntress recreated the chain against PaperCut NG version 25.0.11.75758. In its test, a remote unauthenticated request caused charmap.exe to execute as SYSTEM beneath the PaperCut pc-app.exe Application Server process, demonstrating that successful exploitation can cross from an exposed web interface into operating-system command execution with highly privileged rights.

A working CVE-2026-81578 PoC is now publicly available for the combined CVE-2026-81578/CVE-2026-82078 attack chain, and public exploit references have also appeared in vulnerability databases and security tooling. That substantially reduces the barrier for scanning and exploiting unpatched internet-facing systems.

Real-world attacks were underway even before full public technical details emerged. Huntress observed exploitation in two customer environments, with the first incident occurring on August 26. One attack lasted less than two minutes and executed Base64-encoded reconnaissance commands that decoded to:

whoami & ver

A second incident extended the reconnaissance sequence to:

whoami & ver & tasklist

These commands allowed the attackers to determine the identity under which PaperCut was running, the Windows version, and active processes.

The attackers also delivered malicious Java .class files through the vulnerable server. Huntress recovered one payload as:

lib/Udydn.class

Researchers also observed an unusual in-memory Apache Derby database path ending in:

memory:C:\Program Files\PaperCut MF\server\data\internal\pwn

The second database boot event occurred immediately before code execution, making it a high-confidence forensic artifact for the observed attack chain.

PaperCut’s subsequent investigation shows that attacker behavior has since escalated beyond basic reconnaissance. The vendor describes a second wave against public-facing systems that were not fully patched, with more sophisticated post-compromise activity than what was seen during the first days of the campaign.

Later observed command sequences included domain and session reconnaissance with nltest, quser, and directory enumeration, followed by downloads of legitimate remote-access software. PaperCut documented attackers fetching a SimpleHelp agent and AnyDesk, with SimpleHelp installed as a persistent Windows service named Remote Access Service running as LocalSystem.

The activity shows why the authentication bypass should not be evaluated in isolation. Once chained to code execution, an internet-facing PaperCut Application Server can become an initial foothold for privileged remote access, discovery, persistence, and potentially further lateral movement.

The exact original discovery date has not been publicly disclosed. PaperCut first published its urgent advisory on August 27, 2026 after confirming active customer incidents, assigned CVE identifiers as the investigation developed, and released the initial emergency patch on August 28.

CISA added the vulnerability to its KEV catalog on August 31, 2026, with a remediation due date of September 14, 2026 for affected federal organizations subject to the directive. Known ransomware use is currently listed as unknown.

PaperCut and Huntress have now published useful CVE-2026-81578 IOCs, although defenders should remember that attackers can change payload names, infrastructure, and post-exploitation tools.

CVE-2026-81578 Mitigation

PaperCut’s primary recommendation is to remove PaperCut NG/MF Application Servers from direct internet exposure immediately. If an Application Server is publicly accessible, organizations should restrict its web interfaces to trusted IP addresses using firewall rules, network access controls, a VPN, or another controlled administrative access path. This should be done even when no suspicious activity has been observed.

For supported deployments, administrators should install Emergency Patch Release 3, published September 1, 2026. Release 3 supersedes Releases 1 and 2, so customers do not need to install the earlier emergency packages first. PaperCut recommends that internet-facing systems upgrade again even if Release 1 or Release 2 has already been installed.

The current emergency patches cover PaperCut NG/MF versions:

• 26
• 25
• 24

Organizations running version 23 or older should upgrade to a current supported version rather than wait for a separate emergency patch. PaperCut explicitly recommends upgrading pre-v24 installations to the latest available release.

Administrators should also patch Site Servers and secondary/print servers, not only the primary Application Server. PaperCut states that Mobility Print, Print Deploy servers, User Client software, Print Deploy clients, and the Mobility Print installer are not affected by this incident.

CVE-2026-81578 detection should start by identifying every PaperCut NG and MF Application Server and determining whether it was externally accessible at any time beginning at least August 26, when Huntress first observed exploitation.

To Detect CVE-2026-81578 exploitation or post-compromise activity, defenders should examine PaperCut logs, endpoint telemetry, network records, and filesystem activity for the following indicators:

• Suspicious child processes originating from pc-app.exe or pc-app
• Missing, deleted, or unexpectedly truncated server.log files
• ERROR No suitable driver found for jdbc:no:x
• ERROR DatabaseUtils – Database error looking up cardID: VALUES CAST
• DB URL: jdbc:derby:memory:pwn;create=true
• Database error looking up cardID: VALUES CAST(X’cafebabe
• DB URL: jdbc:no:x DB Driver: <5-char random name>
• Unexpected five-character .class files under <install>\server\lib\
• Corresponding .cmd or .out files under <install>\server\data\content\
• cmd.exe spawned by the PaperCut service
• Execution of whoami, ver, tasklist, nltest, or quser from the PaperCut process tree
• Unexpected SimpleHelp or AnyDesk deployment
• A Windows service named Remote Access Service
• SimpleService.exe running from the JWrapper-Remote Access directory

PaperCut cautions that attackers may delete temporary files as the attack progresses, so the absence of these artifacts does not prove that a system was never compromised.

Organizations should also preserve evidence before upgrading or rebooting an exposed system. Huntress recommends capturing the entire PaperCut server/logs directory, configuration state, process trees, reverse-proxy and firewall logs, DNS and network-flow records, and evidence of recently created services, scheduled tasks, autoruns, or files.

The CVE-2026-81578 mitigation process must go beyond patching when there is evidence of compromise. PaperCut recommends securing existing backups, completely wiping and rebuilding the Application Server, and restoring from a clean backup created before suspicious activity occurred.

Security teams should also review administrative credentials, service accounts, tokens, Active Directory access, and systems reachable from the compromised server. Because the PaperCut Application Server can run with SYSTEM or similarly privileged rights, successful exploitation can provide attackers with substantial post-compromise capability.

PaperCut’s rapid sequence of emergency patches also illustrates why defenders should confirm that they are running the latest mitigation rather than assuming an earlier hotfix is sufficient. Researchers discovered additional bypass paths after the first emergency release, Release 2 added further hardening, and Release 3 subsequently closed additional attack vectors observed in the wild.

Contact Sales

 

The post CVE-2026-81578: Exploited PaperCut Authentication Bypass Chains to Pre-Auth RCE appeared first on SOC Prime.

Unit 42 details a Chinese speaking threat actor combining autonomous AI scanning across seven vulnerabilities with manual exploitation. Read more.

The post Chinese-Speaking Threat Actor Harnesses AI Models for Autonomous Cyberattacks appeared first on Unit 42.

F5 has released out-of-band security updates to address multiple NGINX Vulnerabilities, including CVE-2026-42530, a critical issue in the ngx_http_v3_module that can be exploited by a remote, unauthenticated attacker. The flaw is a use-after-free condition in NGINX’s HTTP/3 implementation that can cause worker-process restarts and denial of service, and in environments where ASLR is disabled or can be bypassed, may also open a path to arbitrary code execution.

The issue is especially important because it affects internet-facing NGINX deployments using HTTP/3 QUIC, which increasingly sits at the edge of modern web infrastructure. Public reporting also highlights a second critical bug, CVE-2026-42055, in the ngx_http_proxy_v2_module and ngx_http_grpc_module, reinforcing the broader urgency around patching current NGINX releases.

CVE-2026-42530 analysis

For CVE-2026-42530 analysis, the core issue is a use-after-free bug in the ngx_http_v3_module. According to public reporting, a remote attacker can trigger the flaw by reopening a QPACK encoder stream through a specially crafted HTTP/3 session when NGINX Open Source is configured to use the HTTP/3 QUIC module. If successful, the attack can force the NGINX worker process to restart, creating a denial-of-service condition.

The CVE-2026-42530 becomes more severe in weakened or less-hardened environments. F5 says arbitrary code execution is possible if ASLR is disabled or if an attacker can bypass it, making the flaw more than just a stability issue in some deployments.

The CVE-2026-42530 is a narrower vulnerability than a generic “all NGINX servers are vulnerable” headline suggests. The affected Open Source versions are 1.31.0 and 1.31.1, and exposure depends on HTTP/3 support being enabled. In contrast, the related CVE-2026-42055 flaw impacts the HTTP/2 proxy and gRPC path under a separate set of conditions, including use of proxy_http_version 2 or grpc_pass.

At the time of writing, the cited sources do not point to a public CVE-2026-42530 poc or concrete CVE-2026-42530 iocs. The currently available details for CVE-2026-42530 are focused on the vulnerable module, affected versions, and the conditions that increase the likelihood of code execution beyond simple worker crashes.

CVE-2026-42530 Mitigation

The most effective CVE-2026-42530 mitigation is to upgrade to a fixed release immediately. For NGINX Open Source, that means moving to 1.31.2 or later. Organizations using F5-supported distributions such as NGINX Plus and other related products should apply the vendor-issued security updates as soon as possible.

For CVE-2026-42530 detection, defenders should first inventory all NGINX systems and determine whether HTTP/3 QUIC is enabled. Security teams should prioritize internet-facing systems running NGINX Open Source 1.31.0 or 1.31.1, especially where HTTP/3 is exposed to untrusted clients.

To protect the environment while patching is underway, teams should also review whether HTTP/3 is necessary on every exposed service and limit unnecessary protocol exposure where possible. Because public reporting does not provide stable exploit indicators, the most practical way to detect risk is to identify vulnerable versions and configurations rather than rely on signature-based detection alone.

CHECK AVAILABLE DETECTIONS

Disclaimer: Detection content may not be available for every CVE. Check the SOC Prime Platform for current coverage. If you don’t find relevant detections now, please check back later.

The post CVE-2026-42530: Critical NGINX HTTP/3 Flaw Can Trigger DoS and Possible RCE appeared first on SOC Prime.

Cisco has released security updates for an SD-WAN vManage flaw exploited in zero-day attacks. The issue, tracked as CVE-2026-20262, affects Cisco Catalyst SD-WAN Manager and can allow an authenticated remote attacker to create or overwrite files on the underlying operating system, opening a path to root privilege escalation. Public reporting says the flaw was exploited in the wild before patches were broadly applied.

The bug is especially important because it targets a central management component in enterprise SD-WAN environments. BleepingComputer notes that Cisco Catalyst SD-WAN Manager, formerly known as SD-WAN vManage, can manage thousands of SD-WAN devices from one dashboard, so compromise of the management plane can have outsized downstream impact. The affected deployment models include on-prem, Cloud-Pro, Cisco Managed Cloud, and FedRAMP environments.

For defenders, the most important details for CVE-2026-20262 are the access requirement and exploit path: the flaw exists because of insufficient validation of user-supplied input during a file upload process in the web UI. A successful attack requires valid credentials with at least write access, but once that threshold is met, the attacker can use crafted HTTP requests to write files that may later be leveraged to gain root privileges.

CVE-2026-20262 analysis

For CVE-2026-20262 analysis, the key issue is that this is not a classic unauthenticated RCE. Instead, it is an arbitrary file-write bug in the web UI, or more precisely a vulnerability in the Catalyst SD-WAN Manager that lets an authenticated remote attacker create or overwrite files on the filesystem through a crafted request to an affected API endpoint. The privilege-escalation step comes after the file write, when the modified file is used to elevate to root.

Operationally, CVE-2026-20262 affects all listed Catalyst SD-WAN Manager deployment types regardless of device configuration. Cisco’s fixed-version matrix, as quoted by both articles, maps vulnerable and remediated releases as follows: 20.9.9.1 and earlier fixed in 20.9.9.2, 20.12.7.1 and earlier fixed in 20.12.7.2, 20.15.4.4 and earlier fixed in 20.15.4.5, 20.15.5.2 and earlier fixed in 20.15.5.3, 20.18.3 fixed in 20.18.3.1, and 26.1.1.1 and earlier fixed in 26.1.1.2.

At the time of disclosure, the cited sources did not describe a public CVE-2026-20262 PoC, but Cisco confirmed limited real-world exploitation in June 2026. The Hacker News says Cisco discovered the flaw during internal security testing, while BleepingComputer reports that Cisco PSIRT became aware of in-the-wild abuse earlier this month. That combination suggests defenders should treat the issue as already operationalized even without full public exploit details.

Cisco also shared CVE-2026-20262 IOCs that point to malicious file-upload activity and follow-on execution. Public reporting says administrators should inspect /var/log/nms/vmanage-server.log, vmanage-appserver, and serviceproxy-access logs for suspicious uploads of index.jsp and .war files, and for evidence that a deployed WAR was later accessed through the service proxy.

CVE-2026-20262 Mitigation

The immediate CVE-2026-20262 mitigation step is to upgrade to Cisco’s fixed releases as soon as possible. Both sources emphasize that Cisco strongly advised customers to patch their systems after confirming active exploitation, and the fix is available across the affected release trains.

From a defensive operations standpoint, CVE-2026-20262 detection should focus on historical and current log review rather than waiting for broad signature coverage. BleepingComputer says Cisco specifically told admins to check SD-WAN Manager logs for attempts to upload index.jsp and .war files, which makes filesystem and application log review central to triage.

To detect CVE-2026-20262, security teams should inventory all Catalyst SD-WAN Manager instances, map them against Cisco’s fixed versions, and review logs for suspicious uploads, deployment events, and access to unexpected JSP or WAR resources. This is especially important because the flaw requires authenticated access, which means exploitation may blend in with otherwise legitimate administrative workflows unless the file-write behavior is examined closely.

CHECK AVAILABLE DETECTIONS

Disclaimer: Detection content may not be available for every CVE. Check the SOC Prime Platform for current coverage. If you don’t find relevant detections now, please check back later.

The post CVE-2026-20262: Cisco SD-WAN Manager Zero-Day Can Lead to Root Privilege Escalation appeared first on SOC Prime.

Google has released emergency Chrome updates to address a Chrome zero-day vulnerability, a high-severity out-of-bounds read/write issue in the V8 JavaScript engine. Google says an exploit exists in the wild, and the patched Stable builds are rolling out as 149.0.7827.102.103 for Windows and Mac and 149.0.7827.102 for Linux.

Public reporting says the flaw can be triggered through a specially crafted HTML page and may allow a remote attacker to execute arbitrary code inside the browser’s sandbox. SecurityWeek adds that the bug is the fifth Chrome zero-day exploited in 2026, following CVE-2026-2441, CVE-2026-3909, CVE-2026-3910, and CVE-2026-5281.

The most important details for CVE-2026-11645 are still limited because Google has restricted bug details while updates propagate. The company says the vulnerability was reported in late April 2026 by an anonymous researcher, and SecurityWeek reports that the researcher received a $55,000 reward.

CVE-2026-11645 analysis

For CVE-2026-11645 analysis, the confirmed public description remains narrow: Google lists the issue as “out of bounds memory access in V8,” while BleepingComputer and SecurityWeek describe it as an out-of-bounds read/write flaw. In practical terms, that means malicious web content can push the engine beyond intended memory boundaries, which may expose sensitive data, crash the browser, or create a path to code execution within the sandbox.

From an exposure standpoint, CVE-2026-11645 affects Chrome desktop users who have not yet moved to the patched 149 release. BleepingComputer notes that successful exploitation can lead to heap corruption and unauthorized access beyond the intended memory buffer, and also says the flaw could help attackers bypass protections such as ASLR, potentially making a second vulnerability easier to weaponize.

At the time of writing, there is no public CVE-2026-11645 PoC in the cited sources, and Google has not disclosed technical exploit details or victimology. SecurityWeek notes that no information is available about the attacks, although it says the zero-day was likely paired with a sandbox escape flaw in real-world operations.

CVE-2026-11645 Mitigation

The immediate CVE-2026-11645 mitigation step is to update Chrome to the patched Stable versions Google released on June 8, 2026. Users who do not update manually will generally receive the fix automatically on the next browser relaunch, but Google says rollout can take days or weeks to fully reach all users.

For defenders, detection of CVE-2026-11645 is limited because Google has intentionally withheld deeper technical information, and there are no published IOCs related to exploitation of CVE-2026-11645 in the cited reporting. In practice, teams should detect CVE-2026-11645 exposure by identifying unmanaged or outdated Chrome installations, prioritizing high-risk user groups, and confirming that enterprise fleets have reached the fixed 149 builds.

CHECK AVAILABLE DETECTIONS

Disclaimer: Detection content may not be available for every CVE. Check the SOC Prime Platform for current coverage. If you don’t find relevant detections now, please check back later.

The post CVE-2026-11645: Chrome Zero-Day Vulnerability Exploited in the Wild appeared first on SOC Prime.

Organizations continue to face elevated risk from edge-device flaws that can hand attackers an initial foothold without valid credentials. CVE-2026-50751 is a critical authentication bypass issue in Check Point VPN Remote Access and Mobile Access that allows a remote, unauthenticated attacker to establish a VPN session without a valid user password. According to public reporting, the flaw stems from a logic-flow weakness in certificate validation and is being exploited in a limited number of real-world attacks.

The exposure is narrower than a generic “all Check Point gateways are vulnerable” headline suggests. Public reporting says the issue only applies when Remote Access VPN or Mobile Access is enabled, IKEv1 is enabled for remote access, legacy clients are accepted, and the gateway does not require a machine certificate. In that configuration, the flaw can open a path to unauthorized VPN access on affected Security Gateways and Spark firewalls.

CVE-2026-50751 analysis

For CVE-2026-50751 analysis, the most important takeaway is that the bug is an authentication bypass rather than a direct remote code execution issue. Help Net Security and The Hacker News both report that the weakness allows an attacker to connect through the VPN without a valid password, after which additional post-authentication activity is required to access internal resources or move toward privilege escalation. That makes the flaw especially dangerous on internet-facing gateways where remote access is broadly enabled for users and contractors.

Public reporting shows that CVE-2026-50751 affects Check Point deployments using deprecated IKEv1 for remote access, including certain Security Gateway releases and Spark firewall versions. The same reports say Check Point first noticed suspicious activity on June 4, 2026, while the earliest known exploitation dates back to May 7, 2026, with attacks increasing in early June. The observed campaigns were limited to a few dozen organizations globally, and one confirmed case involved a Qilin ransomware affiliate.

The post-compromise activity described in the reporting helps clarify the practical risk. Help Net Security says investigators saw suspected data exfiltration activity involving Rclone, possible Tox protocol usage, and attacker-operated VPS infrastructure hosted by providers including Kaupo Cloud HK, Shock Hosting, and Vultr Holdings. The Hacker News adds that once access was established, attackers attempted to download malicious ELF files from actor-controlled infrastructure. Those published indicators are the strongest public details for CVE-2026-50751 currently available.

At the time of writing, the cited reports do not point to a public CVE-2026-50751 PoC, but they do confirm live exploitation and targeted operational use. They also note that Check Point believes the same actor infrastructure may be probing or exploiting other VPN-related flaws across multiple vendors, which raises the urgency for organizations still running vulnerable remote-access configurations.

CVE-2026-50751 Mitigation

The most effective CVE-2026-50751 mitigation is to upgrade affected gateways and firewalls to fixed versions and immediately review environments for signs of compromise. The Hacker News lists affected Check Point Security Gateway and Spark branches, while Help Net Security says customers should begin forensic log audits and configuration reviews starting from the earliest observed exploitation period in May 2026.

If immediate patching is delayed, Check Point’s alternative mitigations are operationally important. Help Net Security says customers should disable use of deprecated IKEv1, remove support for legacy Remote Access clients, and require a machine certificate to establish connections. These measures directly reduce the conditions needed for exploitation and are especially relevant for exposed Check Point VPN Remote Access deployments that still support older client workflows.

For defenders focused on CVE-2026-50751 detection, the most practical path is to review vendor-published indicators and audit historical logs from the earliest known exploitation date. Help Net Security says Check Point provided CVE-2026-50751 IOCs and urged incident response teams to prioritize forensic review, while the broader operational guidance is to detect CVE-2026-50751 by correlating suspicious VPN connections, legacy IKEv1 use, unauthorized remote-access sessions, unusual VPS-originating access, and post-authentication activity tied to exfiltration tooling.

CHECK AVAILABLE DETECTIONS

Disclaimer: Detection content may not be available for every CVE. Check the SOC Prime Platform for current coverage. If you don’t find relevant detections now, please check back later.

The post CVE-2026-50751: Check Point VPN Authentication Bypass Exploited in Targeted Attacks appeared first on SOC Prime.

Cisco has disclosed a seventh SD-WAN zero-day exploited in 2026, tracked as CVE-2026-20245. The flaw affects the command-line interface of Cisco Catalyst SD-WAN Manager and can allow an authenticated remote attacker with netadmin privileges to execute arbitrary commands as root by uploading a crafted file. Cisco says exploitation has already been observed in limited cases, including incidents where configuration changes were pushed to edge devices.

The risk is amplified by the access requirements. Cisco says the attacker must already have netadmin privileges, which can come from stolen credentials or from chaining previously disclosed SD-WAN flaws such as CVE-2026-20182 or CVE-2026-20127. According to Cisco’s disclosure as summarized by Help Net Security and SecurityWeek, the issue affects all Cisco Catalyst SD-WAN deployment types, including on-prem, Cloud-Pro, Cisco Managed Cloud, and FedRAMP environments.

CVE-2026-20245 analysis

For CVE-2026-20245 analysis, the key weakness is insufficient validation of user-supplied input in the SD-WAN Manager CLI. Cisco’s public description says an authenticated attacker can upload a crafted file and trigger command injection, ultimately elevating privileges to root on the affected system. SecurityWeek adds that Cisco PSIRT learned about exploitation in June 2026, which suggests the disclosure was accelerated because the bug was already being abused in the wild.

The most important details for CVE-2026-20245 are that this is not a remote unauthenticated bug by itself, and that the exploit path appears closely tied to prior SD-WAN compromise activity. Cisco is not aware of successful exploitation by any method other than obtaining the required privileged access first, which is why defenders should treat the issue as part of a broader SD-WAN intrusion chain rather than as a standalone initial-access vector.

At the time of disclosure, the cited sources did not point to a public CVE-2026-20245 PoC, but Cisco did confirm active exploitation and said Mandiant reported the flaw. In practical terms, the attacker’s CVE-2026-20245 payload is a crafted file uploaded through the CLI workflow to trigger command injection and root-level execution, not a conventional malware dropper delivered from outside the appliance.

From an operational perspective, CVE-2026-20245 affects some of the most sensitive systems in an SD-WAN deployment because SD-WAN Manager sits at the management plane. Cisco said observed exploitation resulted in configuration changes pushed to edge devices, which means successful abuse can extend beyond the management node itself and alter the behavior of downstream network infrastructure.

CVE-2026-20245 Mitigation

There was no patch and no workaround available at disclosure, so CVE-2026-20245 mitigation is centered on hardening, evidence preservation, and compromise review. Cisco’s guidance, as quoted by Help Net Security, is to collect admin-tech data from each control component before any upgrade activity, then upgrade at the earliest opportunity and verify the configuration of edge devices. That advice matters because software updates alone may not fully resolve the situation if the system has already been compromised.

Cisco has also published CVE-2026-20245 IOCs in the form of specific log guidance. Help Net Security says customers should review those logs and, if compromise is confirmed, work directly with Cisco TAC for targeted remediation steps. SecurityWeek likewise notes that Cisco has made indicators available while it prepares a future Catalyst SD-WAN Manager release containing the fix.

For defenders trying to detect CVE-2026-20245, the most practical approach is to review SD-WAN Manager appliances for signs of unauthorized root-level activity, suspicious file uploads, and unexpected configuration pushes to edge devices. Because Cisco explicitly tied the prerequisite access to compromised credentials or earlier SD-WAN bugs, organizations should also validate that previously disclosed authentication and privilege-escalation flaws are fully remediated across the estate.

More broadly, CVE-2026-20245 detection should be treated as incident response rather than routine patch management. If logs indicate abuse, Cisco warns that simply installing the future software fix will not by itself secure the environment, and customers should engage TAC for recovery guidance tailored to the confirmed compromise.

CHECK AVAILABLE DETECTIONS

Disclaimer: Detection content may not be available for every CVE. Check the SOC Prime Platform for current coverage. If you don’t find relevant detections now, please check back later.

The post CVE-2026-20245: Cisco SD-WAN Manager Zero-Day Enables Root Command Execution appeared first on SOC Prime.

A newly disclosed denial-of-service vulnerability, tracked as CVE-2026-49975, shows how long-known HTTP/2 weaknesses can still be chained into a highly effective modern attack. SecurityWeek reports that researchers at Calif demonstrated an HTTP/2 Bomb exploit capable of knocking major web servers offline within seconds by combining a compression bomb with a Slowloris-style hold that prevents the server from releasing memory.

According to the report, the attack can potentially impact more than 880,000 websites that support HTTP/2 and run default configurations of NGINX, Apache HTTP(Web) Server, Microsoft IIS, Envoy, or Cloudflare Pingora. Calif also said the attack can be launched from a home computer on a 100 Mbps connection and still render affected servers unavailable in seconds.

CVE-2026-49975 analysis

SecurityWeek explains that the attack is not built on a single new flaw, but on a chain of known denial-of-service techniques. The first stage relies on HPACK Bomb, tracked as CVE-2016-6581, which abuses HTTP/2 header compression so that very small messages expand into extremely large memory-consuming structures on the destination server. The article notes that this technique was demonstrated against Apache HTTPD last year with a 4,000x amplification rate, and Apache addressed that issue in version 2.4.64 as CVE-2025-53020.

The second stage abuses CVE-2016-8740 and CVE-2016-1546, two HTTP/2 Slowloris-style issues tied to continuation frames and manipulated flow-control windows. As described by SecurityWeek, attackers can advertise a zero-byte flow-control window, preventing the server from sending a response, and then reset the send timeout so memory allocations remain pinned instead of being freed.

What makes this variant notable is that, according to Calif’s explanation quoted by SecurityWeek, the amplification does not come from a large decoded header value. Instead, it comes from the per-entry bookkeeping the server allocates around nearly empty headers, meaning traditional decoded-size limits may not stop the attack because there is “almost nothing to decode.” The report also says Calif found a bypass for servers that cap the header-field count and released proof-of-concept code to demonstrate the attack.

CVE-2026-49975 Mitigation

SecurityWeek reports that NGINX resolved the bug in April, while Apache rolled out fixes in late May and assigned CVE-2026-49975. At the time of reporting, Microsoft IIS, Envoy, and Cloudflare Pingora had not yet been patched.

From a practical defense standpoint, the clearest short-term priority is to identify internet-facing systems using default HTTP/2 configurations and verify whether they are running patched software. Since the article does not publish specific IOCs or deep detection telemetry, the most realistic approach is to focus on exposed HTTP/2 services, rapid memory spikes, and sudden service instability consistent with memory exhaustion. That last point is a defensive inference based on the attack behavior described in the SecurityWeek report.

CHECK AVAILABLE DETECTIONS

Disclaimer: Detection content may not be available for every CVE. Check the SOC Prime Platform for current coverage. If you don’t find relevant detections now, please check back later.

The post CVE-2026-49975: HTTP/2 Bomb Attack Can Knock Web Servers Offline in Seconds appeared first on SOC Prime.

CVE-2026-48095 in 7-Zip has raised fresh concerns around malicious archive handling and user-driven exploitation. According to GitHub Security Lab, the flaw is a heap buffer write overflow in 7-Zip’s NTFS archive handler that affects version 26.00 and can potentially lead to arbitrary code execution or application crashes. The issue was fixed in 7-Zip 26.01, released on April 27, 2026.

The bug is especially dangerous because the malformed file does not need to use a dedicated NTFS file extension to reach the vulnerable handler. Public reporting says 7-Zip’s signature-based fallback logic can route a crafted file with extensions such as .7z, .zip, or .rar into the NTFS parser after other handlers fail, broadening the practical attack surface for phishing and social-engineering delivery.

For defenders, the most important details for CVE-2026-48095 are the affected version, the archive-parsing trigger, and the existence of public exploit material. GitHub Security Lab says researcher Jaroslav Lobačevski privately reported the issue on April 24, 2026, while later public write-ups confirmed that a working Python generator was released alongside the advisory.

CVE-2026-48095 analysis

At the technical level, the flaw stems from an under-allocation bug in the NTFS compressed stream buffer, inside CInStream::GetCuSize(). GitHub Security Lab explains that a crafted NTFS image can force the shift expression used for buffer sizing to hit an exponent of 32, which triggers undefined behavior in C++ and leaves _inBuf allocated as just 1 byte. The next read operation then writes attacker-controlled data into that tiny buffer, creating a classic heap overflow condition.

That overflow becomes exploitable because the adjacent heap layout allows the attacker to corrupt the stream object’s vtable pointer. Public analysis says the first read can overwrite the vtable after only a few hundred bytes, while the second read dispatches execution through the corrupted pointer, making code execution feasible in favorable conditions. Security Online and Cyber Press both describe this as a path to arbitrary code execution, while also noting that lower-memory systems may see denial-of-service outcomes instead.

The public CVE-2026-48095 PoC further raises the risk profile. Security Online says the researcher released gen_ntfs_sparse.py, a Python script that generates a sparse NTFS image designed to trigger the flaw. In practice, the CVE-2026-48095 payload is a specially crafted archive image rather than a dropped executable, which fits common social-engineering scenarios where a victim is lured into opening what appears to be a harmless compressed file.

From an operational perspective, CVE-2026-48095 affects systems where users open untrusted archive files with vulnerable 7-Zip builds. The coordinated advisory specifically tested 26.00, while later reporting notes that the affected sizing logic predates that release, suggesting the bug may have existed longer than the tested version alone.

CVE-2026-48095 Mitigation

The primary response is to upgrade immediately to 7-Zip 26.01 or later. GitHub Security Lab’s disclosure timeline shows that the fix shipped on April 27, 2026, and 7-Zip’s official history confirms that version 26.01 was released on that date with bug fixes.

For practical CVE-2026-48095 detection, organizations should identify endpoints running 7-Zip 26.00, review environments where users frequently unpack externally sourced archives, and prioritize systems used for email triage, downloads, malware analysis, or administrative handling of compressed files. Because the exploitation path is file-driven, the most useful first step is asset and version validation rather than network hunting.

There are no vendor-published CVE-2026-48095 IOCs in the cited materials, so teams trying to detect CVE-2026-48095 should focus on suspicious archive-opening activity, crashes involving 7-Zip around NTFS-like content, and user workflows where disguised archive extensions could reach the vulnerable handler. In the absence of stronger telemetry, patching and user caution remain the most reliable defenses.

CHECK AVAILABLE DETECTIONS

Disclaimer: Detection content may not be available for every CVE. Check the SOC Prime Platform for current coverage. If you don’t find relevant detections now, please check back later.

The post CVE-2026-48095: 7-Zip Heap Buffer Overflow Can Lead to Code Execution appeared first on SOC Prime.

Phishing remains one of the most effective tools in the cybercriminal arsenal, especially when threat actors abuse trusted identities, compromised legitimate accounts, and familiar online services to increase victim interaction. Europol notes that phishing techniques remain a main distribution vector for data-stealing malware, while CERT-UA’s latest advisory shows that the same social engineering logic continues to drive targeted campaigns against Ukrainian public-sector organizations.

In its May 21, 2026 advisory, CERT-UA warned that UAC-0057 had updated its malware toolkit and was using OYSTERFRESH, OYSTERSHUCK, and OYSTERBLUES in a phishing campaign targeting Ukrainian state organizations. The lure theme centered on obtaining certificates through the Prometheus educational platform, while the broader tradecraft overlaps with the long-running Ghostwriter / FrostyNeighbor / UNC1151 activity cluster that security researchers continue to associate with Belarus-aligned espionage operations against Ukrainian government entities.

Recent reporting shows that Ghostwriter’s 2026 activity against Ukraine is not isolated to a single infection chain. ESET documented fresh March 2026 campaigns targeting Ukrainian government organizations with geofenced PDF lures that ultimately delivered Cobalt Strike, underscoring how the actor continues to refresh both its delivery mechanisms and its malware stack. CERT-UA’s latest UAC-0057 advisory fits that same pattern of ongoing adaptation, this time with a newly documented OYSTER-branded toolset distributed through phishing emails sent from compromised real-world accounts.

Sign up for the SOC Prime Platform to proactively defend your organization against UAC-0057 attacks. Just press Explore Detections below and access a relevant detection rule stack, enriched with AI-native CTI, mapped to the MITRE ATT&CK® framework, and compatible with a wide range of SIEM, EDR, and Data Lake technologies.

Security teams can search the Threat Detection Marketplace library using the “UAC-0057” tag to identify relevant detections and track related content updates. Cyber defenders can also rely on Uncoder AI to turn fresh threat reports into performance-optimized queries, document and improve detection logic, and generate Attack Flows based on the latest CERT-UA reporting.

Explore Detections

Analyzing UAC-0057 Attacks Using OYSTERFRESH, OYSTERSHUCK, and OYSTERBLUES

According to reporting that summarizes CERT-UA’s advisory, the campaign has been active since spring 2026 and relies on large-scale phishing emails sent to Ukrainian state organizations from compromised accounts belonging to real employees. The lure theme is framed around obtaining certificates via the Prometheus educational platform, which helps the emails appear plausible to recipients and increases the odds of interaction.

The infection chain begins with a PDF document that contains an active link leading to a ZIP archive. That archive contains a JavaScript file classified as OYSTERFRESH. When launched, the script displays benign decoy text to the victim while quietly starting the malicious workflow in the background. From there, OYSTERFRESH performs two main tasks: it stores an encoded and obfuscated OYSTERBLUES payload in the Windows Registry and downloads OYSTERSHUCK, which acts as the decoder component for the next stage.

For deobfuscation, OYSTERSHUCK reportedly applies a sequence of string reversal, ROT13, and URL decoding before restoring the OYSTERBLUES payload. Once decoded, OYSTERBLUES fingerprints the compromised machine by collecting the device name, current username, operating system version, last boot time, and the list of running processes. The harvested data is sent to a command-and-control server via HTTP POST, and the server responds with arbitrary JavaScript that is executed through eval, effectively giving the operators remote control over the host.

CERT-UA-linked reporting further indicates that the next stage commonly involves the delivery of Cobalt Strike components. This aligns with the broader UAC-0057 / Ghostwriter tradecraft documented by ESET, which shows the group continuing to use phishing-delivered JavaScript downloaders and staged payload validation before deploying higher-value implants. In other words, the newly documented OYSTER toolset appears to extend an already familiar post-compromise pattern rather than replace it.

Infrastructure choices also support the attribution. Reporting on the advisory says the actor’s command-and-control layer remains masked behind Cloudflare, while many of the associated domains are registered in the .icu zone. Together with the campaign’s tooling style and targeting, these characteristics are consistent with activity tracked by CERT-UA as UAC-0057, also known publicly as Ghostwriter, UNC1151, and FrostyNeighbor.

MITRE ATT&CK Context

Leveraging MITRE ATT&CK helps contextualize the latest UAC-0057 phishing activity targeting Ukrainian state organizations. Based on the TTPs described in CERT-UA-linked reporting, the most relevant ATT&CK techniques likely include Spearphishing Link (T1566.002), User Execution (T1204), Command and Scripting Interpreter: JavaScript (T1059.007), Registry-based storage or abuse for payload staging, System Information Discovery (T1082), Process Discovery (T1057), Ingress Tool Transfer (T1105), and Command and Control over Web Protocols (T1071.001). The likely use of Cobalt Strike in follow-on stages also points to broader post-exploitation, persistence, and lateral movement opportunities once initial foothold is established.

The post UAC-0057 Attack Detection: OYSTERFRESH, OYSTERSHUCK, and OYSTERBLUES Fuel Phishing Campaigns Against Ukrainian State Organizations appeared first on SOC Prime.