Cisco has released security updates for a critical vulnerability affecting selected Nexus 9000 Series switches that can allow an unauthenticated remote attacker to execute arbitrary code with root privileges. Tracked as CVE-2026-20212 and rated 9.8 on the CVSS scale, the flaw affects Nexus 9000 models equipped with a Cisco Silicon One ASIC.

The vulnerability stems from an unintended network exposure in the Silicon One integration. TCP ports 43210 and 43211 are accessible through the default Layer 3 virtual routing and forwarding (VRF) instance, allowing an attacker who can reach either port to connect directly to the vulnerable service. Crafted input sent through the exposed service can then be executed with root privileges.

Successful exploitation can also crash the S1HAL process, potentially forcing the affected switch to reload and causing network disruption. Cisco said its Product Security Incident Response Team was not aware of malicious exploitation or public announcements targeting the flaw when the advisory was released on September 2, 2026.

The vulnerability is especially significant because Nexus 9000 switches commonly operate at the center of enterprise and data-center networks. Root-level compromise could give an attacker extensive control over network configuration and potentially create opportunities for traffic interception, service disruption, persistence, or movement toward connected infrastructure.

Contact Sales

CVE-2026-20212 analysis

The vulnerability is classified as CWE-1327: Binding to an Unrestricted IP Address. The underlying problem is not an authentication implementation error but the exposure of a privileged Silicon One service through interfaces where it should not be reachable.

Under the default Layer 3 VRF configuration, TCP ports 43210 and 43211 listen in a manner that allows remote systems to reach the service. An attacker does not need a valid Cisco account, administrator credentials, or an existing foothold on the switch. They only need network connectivity to one of the affected device’s locally configured addresses on either vulnerable port.

Once connected, an adversary can send specially crafted input to the exposed service. Cisco confirms that this input can be interpreted and executed as code with root privileges, effectively giving the attacker the highest level of operating-system control available on the device.

The most important details for CVE-2026-20212 are reflected in its CVSS vector: network-based exploitation, low attack complexity, no privileges required, and no user interaction. Successful exploitation can have high impact on confidentiality, integrity, and availability.

CVE-2026-20212 affects Nexus 9000 switches containing a Silicon One ASIC. Cisco lists the following product identifiers as vulnerable at the time of disclosure:

• N9324C-SE1U
• N9348Y2C6D-SE1U
• N9364E-SG2-O
• N9364E-SG2-Q
• N9396T12C-SE1
• N9348Y12C-SE1
• N9396Y12C-SE1
• N9336C-SE1
• N9K-C9804
• N9K-C9808

To determine the PID for a device, use the show module CLI command. In the following example, the PID of the device is N9336C-SE1, which is on the list of devices that are affected by this vulnerability.

Cisco’s CVE record lists 45 affected NX-OS releases, beginning with 10.3(1) and extending through releases including 10.6(3) and 10.6(3s). Because exposure depends on both the switch model and NX-OS version, organizations should verify each system through Cisco’s Software Checker rather than relying only on the broad version range.

Cisco has confirmed that Nexus 9000 models not listed in the advisory are not affected. Nexus 9000 Fabric Switches operating in Application Centric Infrastructure (ACI) mode are also not vulnerable.

Other confirmed unaffected products include:

• Nexus 3000 Series switches
• Nexus 7000 Series switches
• MDS 9000 Series multilayer switches
• Cisco Firepower appliances
• Secure Firewall products
• Multiple UCS Fabric Interconnect platforms

This distinction is important because the vulnerability is specifically tied to the Silicon One integration present in the affected Nexus 9000 hardware rather than to NX-OS universally.

The potential post-compromise impact is substantial. An attacker operating as root could theoretically modify switch configuration, interfere with network services, manipulate routing or forwarding behavior, monitor traffic available to the compromised device, or attempt to establish persistence. These are realistic consequences of root-level device compromise, although Cisco has not reported such activity occurring through this vulnerability.

Exploitation can also have an immediate availability impact without establishing long-term access. Cisco warns that attempts to exploit the flaw can cause the Silicon One Hardware Abstraction Layer process, S1HAL, to crash. A crash can cause the entire device to reload, potentially interrupting connectivity for systems depending on the affected switch.

Cisco discovered the vulnerability while resolving a Technical Assistance Center support case. The company has not disclosed the exact date on which the underlying security issue was first identified. The public security advisory was issued on September 2, 2026.

As of September 4, Cisco said it was not aware of malicious exploitation, and CISA’s vulnerability enrichment data classified exploitation as none while describing the issue as automatable with total technical impact.

There was also no confirmed public CVE-2026-20212 PoC identified in Cisco’s disclosure or the two requested reports. The absence of public exploit code should not significantly reduce remediation priority, however, because the basic network exposure and vulnerable ports are already publicly documented.

Cisco has not published campaign-specific CVE-2026-20212 IOCs, which is expected because no attacks have been confirmed. Defenders should instead focus on attempts to access TCP 43210 or 43211, Live Protect events, unexpected S1HAL instability, and unauthorized changes occurring on affected devices.

CVE-2026-20212 Mitigation

Cisco has released fixed NX-OS software and strongly recommends upgrading affected Nexus switches. Rather than publishing a single fixed-version table in the advisory, Cisco directs customers to its Software Checker, which identifies whether a specific NX-OS version is affected and returns the earliest fixed release for that platform.

Administrators should therefore:

1. Run show module to identify the switch model.
2. Confirm whether its PID appears in Cisco’s vulnerable-product list.
3. Determine the installed NX-OS release.
4. Use Cisco Software Checker to identify the appropriate fixed release.
5. Upgrade affected systems as soon as operationally possible.

For organizations that cannot immediately upgrade, Cisco provides an infrastructure access control list workaround. Administrators can configure iACLs to allow only required management and control-plane traffic or explicitly deny TCP traffic destined for a locally configured switch address on ports 43210 and 43211.

Cisco states that the workaround was successfully validated in a test environment, but organizations should evaluate its effect on their individual network design before deployment. Network-level mitigations can affect expected functionality when applied without considering local architecture.

Cisco has additionally released Live Protect shield lp00031 as a temporary mitigation. The shield blocks attempts to exploit CVE-2026-20212 while administrators prepare a full software upgrade. Cisco emphasizes that Live Protect is a bridge to patching rather than a permanent remediation.

The Live Protect documentation provides a useful security signal as well. Administrators can verify that the shield is in enforcement mode with:

show nxsecure policy status

They can inspect recorded events using:

show nxsecure log lp00031

When the shield blocks activity targeting the vulnerability, NX-OS can generate a critical NXSECURE syslog indicating a hit against CVE-2026-20212.

For affected systems running NX-OS 10.6(3), Cisco documents support for shield lp00031. A separate package is available for the N9324C-SE1U and N9348Y2C6D-SE1U Smart Switches running 10.6(3s). Cisco’s shield documentation states that the mitigation transitions to N/A when upgrading to NX-OS 10.6(4) or higher, but customers should still use Software Checker to confirm the correct fixed release for their specific hardware and software combination.

CVE-2026-20212 detection should start with identifying affected hardware and monitoring access to the two exposed service ports. Network telemetry, ACL logs, NetFlow data, switch logs, and intrusion detection systems can help identify suspicious attempts to reach TCP 43210 or 43211.

To Detect CVE-2026-20212 exploitation attempts or related compromise, defenders should investigate:

• Unexpected inbound connections to TCP ports 43210 or 43211
• Live Protect lp00031 hit events
• %APPMGR-2-NXSECURE_CRIT_THREAT messages associated with the vulnerability
• Unexpected crashes or restarts of the S1HAL process
• Unplanned Nexus switch reloads
• Administrative or configuration changes without a corresponding authorized activity
• New or unusual processes running on the switch
• Unexpected outbound connections originating from the network device
• Changes to access-control, routing, forwarding, or management configuration
• Attempts to disable logging or security controls following suspicious network traffic

Cisco has also published Snort Rule 67005 in connection with the advisory, providing another detection option for organizations using compatible Cisco security tooling.

If suspicious activity is identified on an unpatched switch, defenders should treat the event as potentially serious because exploitation provides root privileges. Incident response should include configuration validation, administrative account review, log preservation, comparison against known-good device state, and investigation of systems communicating with the affected switch.

The CVE-2026-20212 mitigation priority should be particularly high for devices whose affected ports are reachable from user segments, externally accessible networks, or other untrusted infrastructure. Blocking the ports can substantially reduce immediate exposure, but upgrading to Cisco’s fixed software remains the vendor-recommended permanent solution.

The post CVE-2026-20212: Critical Cisco Nexus 9000 Flaw Enables Unauthenticated Root RCE appeared first on SOC Prime.

Google has released an emergency Chrome security update addressing a high-severity zero-day vulnerability that is already being exploited in the wild. Tracked as CVE-2026-85046 and rated 8.8 on the CVSS scale, the flaw is a type confusion issue in V8, the JavaScript and WebAssembly engine used by Google Chrome.

Successful exploitation can allow a remote attacker to execute arbitrary code inside Chrome’s sandbox after a victim visits a specially crafted HTML page. Google has confirmed that an exploit exists in the wild but has not disclosed information about the threat actors, targeted organizations, or attack campaigns while the update is still rolling out.

CVE-2026-85046 affects Chrome versions earlier than 152.0.7977.82. Google has released Chrome 152.0.7977.82/.83 for Windows and macOS and 152.0.7977.82 for Linux, with the security update being distributed progressively to users.

The vulnerability is the sixth Chrome zero-day Google has addressed in 2026 after previously exploited flaws including CVE-2026-2441, CVE-2026-3909, CVE-2026-3910, CVE-2026-5281, and CVE-2026-11645.

CVE-2026-85046 analysis

The vulnerability is categorized as CWE-843: Access of Resource Using Incompatible Type, commonly referred to as type confusion. This class of memory-safety weakness occurs when software incorrectly treats an object as a different data type than the one actually stored in memory.

In JavaScript engines such as V8, incorrect assumptions about object types can become particularly dangerous because highly optimized compiler paths depend on accurate information about how arrays and objects are represented in memory.

Security researcher Salvatore Gulizia, also known as Serotav, explained that the flaw involves V8 compiler behavior where an array containing PACKED_ELEMENTS can incorrectly receive a PACKED_SMI_ELEMENTS map. That mismatch can ultimately be transformed into arbitrary read and write access within the JavaScript heap.

The most important details for CVE-2026-85046 are that exploitation is remotely reachable, requires no existing privileges, and can be delivered through malicious web content. The published CVSS vector indicates that user interaction is required, meaning the victim must load attacker-controlled content, such as by visiting a malicious or compromised page.

A typical exploitation scenario could begin when a user follows a phishing link, encounters a malicious advertisement, or visits a legitimate website that has been compromised. Crafted JavaScript or HTML content could then trigger the V8 type confusion and corrupt the assumptions Chrome uses when accessing objects in memory.

The resulting primitive can enable arbitrary code execution inside the Chrome sandbox. This distinction is important: CVE-2026-85046 alone does not necessarily provide complete control over the underlying operating system. A threat actor seeking full host compromise would normally need to combine browser code execution with an additional sandbox escape or privilege-escalation vulnerability.

Google has deliberately restricted access to the Chromium bug report while most users receive the patch. This is standard practice for actively exploited Chrome vulnerabilities because publishing complete technical details too quickly could make it easier for additional attackers to reverse-engineer and weaponize the flaw.

The vulnerability was reported to Google by Salvatore Gulizia on August 4, 2026. Google awarded the researcher a $1,000 bug bounty, and the flaw was publicly patched as part of the September 3 Stable Channel update.

The update fixes 12 security vulnerabilities in total. Besides the exploited V8 issue, Google addressed high-severity weaknesses involving CrashReporting, Network, Compositing, another V8 race condition, WebGL, CacheStorage, DevTools, and Skia, as well as two medium-severity issues.

Google has confirmed active exploitation but has not released a public CVE-2026-85046 PoC. Access to the underlying Chromium issue also remains restricted, limiting the technical information currently available for reproducing the exploit.

There are likewise no campaign-specific CVE-2026-85046 IOCs published by Google. The company has not identified malicious domains, IP addresses, payload hashes, or specific exploitation infrastructure associated with the observed attacks.

The absence of public indicators makes vulnerability exposure and behavioral telemetry more important than static threat intelligence. Organizations should assume that any endpoint running an affected browser version can remain exposed when users browse attacker-controlled content.

Contact Sales

CVE-2026-85046 Mitigation

Google recommends upgrading Chrome immediately to:

• 152.0.7977.82/.83 or later on Windows
• 152.0.7977.82/.83 or later on macOS
• 152.0.7977.82 or later on Linux

Users can verify the installed version by opening Chrome → Help → About Google Chrome. The browser will check for updates automatically, but Chrome must be relaunched after installation for the new version and security fixes to become active.

Enterprise administrators should verify deployment rather than relying exclusively on Chrome’s gradual automatic rollout. Managed endpoints that have not restarted after receiving the update may continue running the vulnerable browser process until users relaunch Chrome.

CVE-2026-85046 detection should begin with endpoint inventory. Security teams should identify systems running Chrome releases earlier than 152.0.7977.82 and prioritize endpoints exposed to external browsing, email links, web advertising, and other untrusted web content.

To Detect CVE-2026-85046 exploitation or suspicious browser activity, defenders should look for combinations of:

• Chrome renderer crashes followed by unusual process activity
• Unexpected processes launched from the Chrome process tree
• Browser exploitation alerts generated by EDR or endpoint protection tools
• Suspicious memory-corruption behavior involving Chrome or V8
• Visits to newly registered, compromised, or known malicious websites immediately before anomalous activity
• Unexpected executable or script activity following a browser session
• Attempts to exploit a second vulnerability after Chrome renderer compromise
• New persistence or privilege-escalation activity occurring immediately after suspicious browser behavior

These signals are hunting leads rather than exploit-specific signatures because Google has not disclosed the in-the-wild exploitation technique.

Organizations should also review web proxy, DNS, EDR, and email-security telemetry around suspicious Chrome events. Since exploitation requires loading crafted web content, correlating browser crashes or unusual child-process activity with recently visited domains can help identify possible attack chains.

Chromium-based browsers such as Microsoft Edge, Brave, Opera, and Vivaldi also rely on Chromium components, including V8. Users of these products should install vendor updates containing the corresponding Chromium security fix as soon as those releases become available.

Because exploitation was already underway before public disclosure, CVE-2026-85046 mitigation should include both rapid patching and retrospective investigation of suspicious browser activity on systems that remained vulnerable before September 3.

The post CVE-2026-85046: Actively Exploited Chrome V8 Zero-Day Enables Code Execution appeared first on SOC Prime.

SonicWall has released emergency security updates for two vulnerabilities affecting its Secure Mobile Access (SMA) 1000 series appliances after confirming that both flaws have been exploited in the wild. Tracked as CVE-2026-83548 and CVE-2026-83549, the issues affect the Appliance Work Place and Appliance Management Console components and may be chained to move from unauthenticated external access to arbitrary operating-system command execution.

The more severe vulnerability, CVE-2026-83548, carries a maximum CVSS score of 10.0. It is a pre-authentication server-side request forgery (SSRF) flaw caused by an unintended alternate access path in the Appliance Work Place interface. A remote attacker can exploit it without credentials to reach sensitive functionality and perform unauthorized operations.

CVE-2026-83549 is rated 7.8 and affects the Appliance Management Console. Under specific conditions, an authenticated administrator can exploit an OS command injection weakness to execute arbitrary commands, potentially resulting in remote code execution on the appliance.

The combination is what makes these SonicWall product vulnerabilities particularly dangerous. SonicWall says it investigated a case showing active exploitation of both issues, while SecurityWeek and The Hacker News note that the activity suggests attackers may be chaining the pre-authentication weakness with the command injection flaw to execute code on vulnerable SMA 1000 devices.

CVE-2026-83548 and CVE-2026-83549 analysis

CVE-2026-83548 resides in the SMA 1000 Appliance Work Place interface and is categorized as a pre-authentication SSRF vulnerability. The weakness exists because an unintended alternate access path allows requests to reach functionality that should not be accessible to an unauthenticated remote user.

The most important details for CVE-2026-83548 are reflected in its attack requirements. The vulnerability is reachable over the network, requires low attack complexity, does not require prior privileges, and does not need user interaction. Its CVSS vector indicates potentially high confidentiality, integrity, and availability impact if the vulnerable path is successfully abused.

Unlike a conventional SSRF bug that may simply force a server to make an outbound request, SonicWall describes this issue as enabling unauthorized access to sensitive functionality and unauthorized operations. That broader impact explains the maximum 10.0 severity rating and why the flaw is especially concerning on internet-facing remote-access appliances.

CVE-2026-83549 operates later in a potential attack chain. It is an OS command injection vulnerability in the Appliance Management Console. SonicWall says a remote authenticated attacker operating as an administrator can exploit the weakness under specific conditions to execute arbitrary OS commands, resulting in remote code execution.

CVE-2026-83549 affects the same SMA 1000 firmware branches as the SSRF issue. The potentially important relationship between the two flaws is that the first weakness removes the normal authentication barrier to sensitive functionality, while the second requires administrative access before command execution becomes possible.

SonicWall has not publicly documented the exact technical steps connecting the two vulnerabilities. However, because the vendor confirmed exploitation of both issues in the same investigated case, SecurityWeek and The Hacker News assess that threat actors may be combining them to achieve unauthenticated remote code execution.

This distinction matters. CVE-2026-83549 alone should not be described as a pre-authentication RCE vulnerability. Its documented prerequisite is on its own, exploitation requires an authenticated administrator and specific system conditions. The concern is that CVE-2026-83548 may provide the unauthorized access required to reach or enable the command-injection path.

The affected hardware and virtual platforms are:

• SMA 6210
• SMA 7210
• SMA 8200v, across all supported hypervisors

SonicWall lists the vulnerable firmware ranges as 12.4.3-03453 and earlier and 12.5.0-02835 and earlier.

The flaws do not affect SSL VPN functionality on SonicWall firewalls or the separate SMA 100 series. They are specific to the SMA 1000 product family covered by SonicWall advisory SNWLID-2026-0016.

The vulnerabilities are notable partly because SMA appliances are commonly placed at the enterprise perimeter and provide remote access to internal resources. Successful compromise of such a system can potentially give attackers a valuable foothold close to authentication infrastructure, internal applications, and privileged network paths.

Contact Sales

If attackers gain arbitrary command execution on the appliance, potential consequences include persistence, credential theft, configuration manipulation, traffic interception, additional malware deployment, and lateral movement toward internal systems. The public reporting does not confirm that all of these activities occurred in the current exploitation, but they represent realistic post-compromise risks once an adversary gains OS-level command execution on a remote-access gateway.

Both vulnerabilities were discovered internally by SonicWall. The Hacker News credits William Perry and Adam Babis with identifying the issues. The CVE records and vendor advisory were published on September 1, 2026, but SonicWall has not disclosed the original internal discovery date or how long the threat actors may have been exploiting the new flaws before remediation became available.

The disclosure follows a separate series of SMA 1000 zero-days patched in July 2026, CVE-2026-15409 and CVE-2026-15410. Those earlier vulnerabilities were exploited by a threat actor tracked as UTA0533 and were associated with KNUCKLEBALL malware. SonicWall explicitly states that CVE-2026-83548 and CVE-2026-83549 are unrelated to previously reported vulnerabilities in other SonicWall products.

As of the initial September disclosure, there was no indexed public CVE-2026-83548 PoC identified by the sources reviewed. Despite the absence of public exploit code, confirmed in-the-wild exploitation means defenders should assume working private exploit capability already exists.

SonicWall has also not disclosed who is behind the new attacks, which organizations were targeted, or whether the activity is linked to espionage, cybercrime, ransomware, or the actors responsible for the earlier SMA 1000 campaign.

No complete public set of CVE-2026-83549 IOCs accompanied SonicWall’s initial notice. The vendor instead instructs affected customers to contact SonicWall Technical Support for assistance reviewing appliances for evidence of compromise.

That absence of campaign-specific indicators makes configuration and behavioral monitoring particularly important. Organizations should not wait for a malicious IP address, payload hash, or exploit signature before investigating an internet-facing appliance that remained vulnerable during the exploitation window.

CVE-2026-83548 and CVE-2026-83549 Mitigation

SonicWall recommends that every organization operating affected physical or virtual SMA 1000 appliances immediately upgrade to the latest hotfix. The fixed firmware versions are:

• 12.4.3-03526
• 12.5.0-02952

Any later release containing these security fixes should also address the vulnerabilities. Organizations should verify the installed platform-hotfix version rather than assuming a system is protected simply because it runs the 12.4.3 or 12.5.0 branch.

CVE-2026-83548 detection should begin with a full inventory of SMA 1000 appliances and verification of their exact firmware builds. Systems running 12.4.3-03453 or older, or 12.5.0-02835 or older, should be considered exposed and prioritized for investigation as well as patching.

To Detect CVE-2026-83549 exploitation or suspicious activity related to the potential chain, security teams should review appliance, management, authentication, and network telemetry for signs such as:

• Unexplained administrative sessions
• Privileged actions without corresponding legitimate administrator activity
• Unexpected commands or processes executed by appliance services
• Configuration changes originating from unfamiliar sources
• Suspicious requests to the Appliance Work Place interface
• Activity reaching management functionality without a normal authentication sequence
• New or modified administrator accounts
• Unexpected outbound connections from the SMA appliance
• Changes to authentication or remote-access configuration
• Attempts to disable logging, monitoring, or security controls
• Suspicious activity immediately preceding OS command execution

These behaviors are investigation leads rather than vulnerability-specific signatures because SonicWall has not publicly documented the complete exploit chain.

Organizations should also preserve appliance logs before upgrading where practical. Installing fixed firmware prevents future exploitation through the known flaws, but it does not identify or remove persistence established before remediation.

The CVE-2026-83549 mitigation guidance is particularly important for appliances showing any suspicious indicators. SonicWall instructs customers to contact Technical Support for help reviewing the system and, when compromise indicators are detected, take the following steps:

• Upgrade to the latest hotfix version – available via https://www.mysonicwall.com
• Contact SonicWall Technical Support for assistance reviewing the system for indicators of compromise (IoCs).
• If IOCs are detected on the system:
• Re-image (hardware) or re-deploy (virtual) appliances.
• Change all user & administrator passwords.
• Reset TOTP tokens

Credential rotation is necessary because an attacker with administrative or OS-level access may have been able to obtain authentication data or establish access that remains useful after the vulnerable firmware itself has been replaced.

Organizations should also review systems reachable through the affected remote-access gateway. A compromised SMA appliance should not be treated as an isolated perimeter event if logs indicate successful arbitrary command execution. Incident response should examine downstream authentication systems, administrative interfaces, internal servers, and credentials potentially accessible from the appliance.

Reducing external exposure provides another layer of protection. Management functions should only be reachable from authorized administrative networks or controlled access paths. Organizations should restrict unnecessary internet access, enforce network segmentation, and monitor administrative interfaces for unexpected connections.

SonicWall’s response guidance is particularly important because these vulnerabilities are already being exploited. Patching should therefore be combined with retrospective threat hunting rather than treated as a purely preventive maintenance task.

The post CVE-2026-83548 and CVE-2026-83549: SonicWall SMA 1000 Zero-Days Exploited in the Wild appeared first on SOC Prime.

A critical authentication bypass vulnerability in JFrog Artifactory moved into active exploitation only days after its public disclosure. Tracked as CVE-2026-82329 and rated 9.8 on the CVSS scale, the flaw can allow an unauthenticated attacker with network access to obtain administrator-level privileges on vulnerable Artifactory instances.

JFrog disclosed and patched the issue on August 28, 2026. By September 1, exposure management company watchTowr had already observed attackers exploiting vulnerable systems to generate administrative tokens and enumerate users, groups, credentials, and federated access relationships.

The Critical JFrog Artifactory Vulnerability is particularly dangerous because Artifactory frequently occupies a privileged position in software development and delivery pipelines. Organizations use it to store and distribute binaries, containers, packages, AI models, and other software artifacts. Administrative compromise can therefore create opportunities not only for data theft but also for software supply-chain manipulation and lateral movement into production infrastructure.

JFrog Cloud environments have already been secured by the vendor. Organizations operating self-hosted Artifactory deployments must upgrade to the fixed release corresponding to their current branch.

CVE-2026-82329 analysis

The vulnerability is categorized as CWE-287: Improper Authentication. JFrog’s advisory states that “JFrog Artifactory contains an authentication weakness” that, under the default configuration, can allow a remote attacker without credentials to gain administrative privileges.

The flaw resides in JFrog Access, the platform component responsible for issuing and validating credentials. According to watchTowr’s analysis cited by The Hacker News, vulnerable installations without an additional join key configured can receive what researchers describe as a “phantom” join key. An attacker can abuse this condition to forge access and generate administrator-level token.

This is what makes the vulnerability significantly more severe than a conventional information-disclosure bug. The attacker does not need to steal a legitimate username, password, API key, or session first. The CVSS vector confirms network-based exploitation with low complexity, no privileges required, and no user interaction. Confidentiality, integrity, and availability are all rated as having high potential impact.

The most important details for CVE-2026-82329 concern what attackers can do after the authentication boundary is bypassed. WatchTowr observed threat actors minting administrator tokens, then using those privileges to inspect the environment and determine whether it was valuable enough for deeper exploitation.

Observed post-exploitation activity included enumeration of:

• Existing Artifactory users
• User groups
• Authentication tokens and credential sets
• Federated access relationships
• Other information useful for understanding how the Artifactory environment connects to surrounding infrastructure

In a limited number of attacks, threat actors went further and created backdoor users, establishing an additional path for persistent administrative access.

The exploited critical JFrog Artifactory flaw poses a broader security concern because Artifactory is often part of CI/CD and software distribution workflows. Administrator-level access may allow an adversary to inspect repositories, alter configuration, access stored credentials, or potentially interfere with artifacts that are later consumed by build and deployment systems.

WatchTowr warned that compromise of a central software supply-chain platform could allow attackers to tamper with build pipelines, move laterally toward production infrastructure, or introduce malicious changes that could ultimately propagate downstream. The available reporting does not confirm that these more severe supply-chain scenarios have occurred in the observed attacks, but administrator compromise makes them realistic post-exploitation risks.

CVE-2026-82329 affects multiple supported Artifactory 7.x branches. JFrog lists the vulnerable and fixed versions as follows:

• 7.161.x: upgrade to 7.161.20
• 7.146.x: upgrade to 7.146.38
• 7.133.x: upgrade to 7.133.29
• 7.125.x: upgrade to 7.125.20
• 7.117.x: upgrade to 7.117.28
• 7.111.x: upgrade to 7.111.21

JFrog published the vulnerability on August 28, 2026. The exact original discovery date and circumstances have not been publicly disclosed in the vendor advisory. The speed with which exploitation followed disclosure is notable: watchTowr began observing real-world activity on September 1, only four days after the advisory and fixes became public.

WatchTowr’s global honeypot network initially saw exploitation originating from a relatively small number of IP addresses across different geographic regions. Researchers said the activity had not yet developed into broad mass scanning at the time of their report.

Some attempts appeared to stop after simply verifying that exploitation worked. Others proceeded to enumerate the compromised instance, suggesting attackers were assessing exposed environments before deciding whether to continue with deeper intrusion activity.

Public technical reproduction information has also started to emerge. A CVE-2026-82329 PoC published after disclosure demonstrates an unauthenticated path to administrator-level token generation against a vulnerable Artifactory build and shows the same attempt being rejected by a patched release. This further increases the urgency of updating exposed systems because exploitation no longer requires independently reverse-engineering the vulnerability from scratch.

At the time of reporting, the activity had not been attributed to a specific ransomware operation, state-sponsored group, or other established threat actor. There was also no evidence that exploitation had reached widespread automated scanning levels.

There is currently no comprehensive vendor-published set of CVE-2026-82329 IOCs that can reliably identify every exploitation attempt. The observed attacks instead provide behavioral indicators: unexpected administrative tokens, unauthorized users, unusual account enumeration, and access to federated authentication information should all be treated as potential signs of compromise.

Contact Sales

CVE-2026-82329 Mitigation

JFrog recommends that organizations running self-hosted Artifactory installations immediately upgrade to the fixed version applicable to their release branch. The vendor confirms that affected cloud environments have already been fortified and require no customer action for this specific issue.

Self-hosted customers should update to one of the following versions or a newer supported release containing the fix:

• 7.161.20
• 7.146.38
• 7.133.29
• 7.125.20
• 7.117.28
• 7.111.21

Because active exploitation began within days of disclosure, internet-facing instances should receive the highest patching priority. Organizations should not rely solely on the absence of obvious malicious activity, particularly because some observed attackers appeared to validate the vulnerability and stop, potentially leaving few immediately visible post-exploitation artifacts.

CVE-2026-82329 detection should begin with identifying all self-managed Artifactory instances and comparing their exact versions against JFrog’s vulnerable ranges. Security teams should then determine which systems are exposed to untrusted networks and prioritize those instances for both patching and retrospective investigation.

To Detect CVE-2026-82329 exploitation or post-compromise activity, defenders should review Artifactory and JFrog Access audit data for:

• Unexpected administrator-level tokens
• Tokens created without a corresponding legitimate administrator action
• Newly created or any other accounts
• Unusual enumeration of users and groups
• Requests that enumerate token or credential information
• Sudden administrative activity originating from unfamiliar IP addresses
• Repository or permission changes following suspicious authentication activity
• New access relationships between Artifactory and connected development infrastructure
• Unexpected changes to artifacts, build configuration, or repository settings

Security teams should pay particular attention to administrator tokens created around the time of suspicious unauthenticated requests. The real-world attacks observed by watchTowr demonstrate that token minting is a central part of the exploitation path.

Patching alone may not be sufficient for an Artifactory instance that was exposed before remediation. If an attacker successfully generated administrator credentials, those credentials or backdoor accounts can potentially remain usable after the underlying vulnerability has been fixed.

Organizations should therefore inspect historical audit logs and rotate credentials that may have been exposed. The Hacker News recommends reviewing audit activity, rotating affected credentials, and examining connected systems for unauthorized modifications or persistent access.

Incident responders should also review:

• Artifactory administrator accounts
• Access and identity tokens
• Repository permissions
• Federation relationships
• CI/CD integration credentials
• Build-system secrets
• Package and artifact integrity
• Recently changed binaries and container images
• Systems reachable using credentials stored in or accessible from Artifactory

Where compromise is confirmed, teams should consider the potential impact on the broader software delivery chain rather than treating the event as an isolated Artifactory account incident. A malicious administrator may have had opportunities to inspect or alter assets later consumed by downstream development, deployment, or production systems.

The CVE-2026-82329 mitigation process should therefore combine immediate upgrading with credential rotation, account review, artifact integrity validation, and threat hunting across connected CI/CD infrastructure.

The post CVE-2026-82329: Critical JFrog Artifactory Authentication Bypass Exploited in the Wild appeared first on SOC Prime.

HPE has released security updates addressing a maximum-severity remote code execution vulnerability affecting its network fabric management platform. Tracked as CVE-2026-76658 and rated 10.0 on the CVSS v3.1 scale, the flaw can allow an unauthenticated remote attacker to gain administrative access and execute arbitrary commands as a privileged operating-system user.

The vulnerability resides in the SSH daemon used by HPE Networking Fabric Composer, a platform designed to manage and automate data-center network fabrics. Successful exploitation can result in complete compromise of the affected management host, creating a potentially serious risk because the appliance may have privileged visibility into and control over network infrastructure.

CVE-2026-76658 is one of dozens of security issues covered by HPE bulletin HPESBNW05133. Another flaw in the same release, CVE-2026-76657, also carries a CVSS score of 10.0 and can allow unauthenticated attackers to bypass API authentication and gain administrative privileges.

At disclosure, HPE said it was not aware of public exploit code or public discussion targeting the newly patched vulnerabilities. Nevertheless, the combination of remote network access, low attack complexity, no authentication requirement, and complete confidentiality, integrity, and availability impact makes CVE-2026-76658 an urgent remediation priority.

CVE-2026-76658 analysis

The flaw specifically affects the product’s SSH daemon. According to HPE’s CVE description, an attacker can remotely interact with a vulnerable Fabric Composer host without first authenticating and obtain administrative access. Successful exploitation then permits arbitrary commands to run as a privileged user on the underlying operating system, potentially leading to complete system compromise.

The most important details for CVE-2026-76658 are reflected in its CVSS vector: AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. This means exploitation is network-accessible, has low attack complexity, requires no existing privileges and no victim interaction, and can result in high confidentiality, integrity, and availability impact. The scope is also marked as changed, indicating that successful exploitation can affect security resources beyond the vulnerable SSH component itself.

CVE-2026-76658 affects Fabric Composer releases from version 7.0.0 through 7.3.3. HPE’s security bulletin recommends upgrading systems remaining on the 7.3 branch to 7.3.4 or later, while organizations moving to the newer branch should use 7.4.0 or later.

The vulnerability’s location in an SSH service is especially important from a defensive perspective. SSH management interfaces are commonly trusted administrative paths, and compromise at this layer could provide an attacker with direct control over the management appliance rather than merely access to an individual web application function.

Unlike vulnerabilities that require valid administrator credentials or an existing foothold, this issue can potentially be triggered by an external actor who can reach the vulnerable SSH service. Administrators should therefore pay close attention to whether the management interface is reachable from user networks, external infrastructure, or other untrusted segments.

HPE has not publicly documented the precise malformed packet, authentication sequence, implementation bug, or protocol state required to exploit the issue. It would therefore be inaccurate to characterize the flaw as a specific buffer overflow, hard-coded credential, command injection, or cryptographic weakness based solely on the information currently available.

What is confirmed is the resulting security boundary failure: an unauthenticated remote actor can obtain administrative access and execute commands with privileged operating-system permissions. If exploited, an attacker could potentially alter Fabric Composer configuration, access information stored on the management host, interfere with management functions, establish persistence, or leverage the system as a foothold for additional activity against reachable infrastructure. Cyber Security News specifically notes that appliance compromise may allow attackers to change configuration, steal information, or move further into the organization’s environment.

The broader HPESBNW05133 bulletin increases the risk because it contains numerous weaknesses across the API, web management interface, installation components, and underlying operating system. Reported vulnerability classes include authentication bypass, remote code execution, cross-site scripting, arbitrary file write, SQL injection, path traversal, privilege escalation, information disclosure, command injection, and denial of service.

Some of these issues may also be useful in chained attacks. For example, CVE-2026-76657 independently allows unauthenticated remote attackers to bypass API authentication and obtain administrative access, while CVE-2026-19766 can provide privileged code execution from an adjacent network under its required conditions.

The public CVE record was published on September 1, 2026. The exact original discovery date for CVE-2026-76658 has not been disclosed. The CNA metadata records the issue as externally discovered and does not identify the contributor by name, while reporting around the broader HPE bulletin notes that multiple vulnerabilities were also uncovered through HPE’s own security research.

As of September 2, there was no known public CVE-2026-76658 PoC and HPE had not reported active exploitation. The vulnerability was also not listed in CISA’s Known Exploited Vulnerabilities catalog at that time.

The absence of public exploit code should not be interpreted as low risk. A network-reachable CVSS 10.0 vulnerability in an administrative SSH service can become substantially more dangerous once researchers or threat actors determine the precise exploitation technique, particularly when vulnerable appliances are reachable from less-trusted network segments.

There are currently no vendor-published CVE-2026-76658 IOCs associated with exploitation campaigns. Defenders therefore need to focus primarily on version exposure, unexpected SSH activity, administrative behavior, and changes made on the management appliance rather than relying on known malicious hashes, domains, or attacker IP addresses.

Contact Sales

CVE-2026-76658 Mitigation

Organizations should upgrade affected Fabric Composer installations immediately. HPE recommends the following fixed versions:

• Fabric Composer 7.3.4 or later for organizations remaining on the 7.3 branch
• Fabric Composer 7.4.0 or later for deployments using the 7.4 branch

Older releases that have reached End of Maintenance should be considered potentially vulnerable unless HPE explicitly states otherwise. End-of-support versions have not necessarily been evaluated and should not be assumed secure simply because they are absent from the supported-version table.

CVE-2026-76658 detection should begin with identifying every Fabric Composer appliance, confirming its exact running version, and determining where its SSH management interface is reachable from. Any installation running version 7.3.3 or earlier should be prioritized for remediation.

Organizations should also verify whether SSH and web management interfaces are isolated from general-purpose and untrusted networks. HPE recommends placing management interfaces on a dedicated Layer 2 segment or VLAN and enforcing Layer 3 firewall controls to limit which systems can reach them.

To Detect CVE-2026-76658 exploitation attempts or suspicious post-compromise activity, security teams should review appliance, authentication, network, and management telemetry for:

• Unexpected SSH connections from unfamiliar systems or network segments
• Administrative sessions without a corresponding authorized maintenance activity
• New or modified administrator accounts
• Commands executed outside expected administrative workflows
• Unexpected changes to Fabric Composer configuration
• New outbound network connections originating from the management appliance
• Attempts to disable or modify logging and accounting controls
• Unexplained access to managed network infrastructure
• Configuration changes immediately following suspicious SSH activity
• Persistence mechanisms or unexpected operating-system processes on the appliance

These signals are behavioral hunting leads rather than vulnerability-specific signatures because HPE has not published the exact network request or protocol sequence required to trigger the flaw.

Organizations should retain and review historical logs from before patch deployment wherever possible. Updating closes the known vulnerability but cannot determine whether an exposed host was compromised before the fix was installed.

Administrators should pay particular attention to unexplained privileged activity on systems whose SSH services were reachable from untrusted networks. Because successful exploitation can provide administrative control and privileged command execution, suspicious activity should trigger investigation of the entire Fabric Composer host rather than only the SSH service.

If compromise is suspected, security teams should examine administrator accounts, authentication records, configuration history, network-management changes, system processes, persistence mechanisms, and credentials accessible from the appliance. Managed switches and other infrastructure controlled through the system should also be reviewed for unauthorized configuration changes.

The broader CVE-2026-76658 mitigation strategy should combine rapid patching with strict segmentation of management interfaces, firewall-based access restrictions, centralized logging, administrative accounting, and regular review of privileged access.

HPE specifically recommends restricting command-line and web management interfaces to dedicated management networks and using logging and accounting controls to track access and user activity. These measures do not replace patching, but they can substantially reduce exposure to future vulnerabilities affecting administrative interfaces.

Given the maximum CVSS score and lack of authentication requirements, vulnerable systems should not remain reachable from untrusted networks while organizations wait for their normal maintenance cycle.

The post CVE-2026-76658: Critical HPE Fabric Composer Flaw Enables Unauthenticated Remote Code Execution appeared first on SOC Prime.

PaperCut is responding to active attacks targeting its NG and MF print management platforms through a pair of zero-day vulnerabilities that can be chained to achieve unauthenticated remote code execution. One of the flaws, tracked as CVE-2026-81578, is a high-severity authentication bypass that enables a remote attacker to modify sensitive PaperCut configuration without first logging in.

Rated 8.8 on the CVSS v4.0 scale, the vulnerability exists in the web management interface and results from administrative actions being processed before access validation has fully completed. On its own, the flaw enables unauthorized configuration changes. Combined with the critical CVE-2026-82078 unsafe dynamic class-loading bug, however, the attack chain can result in arbitrary Java execution under the security context of the PaperCut Application Server.

The Exploited PaperCut Vulnerabilities have already been observed against customer environments. Huntress detected the first known attack activity on August 26, 2026 and reproduced a complete pre-authentication RCE chain against a standard PaperCut NG installation. CISA subsequently added both CVE-2026-81578 and CVE-2026-82078 to its Known Exploited Vulnerabilities catalog, confirming that the threat has moved beyond proof-of-concept exploitation.

PaperCut now treats all versions of PaperCut NG and PaperCut MF as potentially impacted and has released Emergency Patch Release 3 for versions 24, 25, and 26. The latest emergency update supersedes the previous patches and adds additional hardening after researchers and defenders identified further attack paths against incompletely patched systems.

CVE-2026-81578 analysis

The vulnerability is classified as a missing-authentication or improper access control issue affecting PaperCut’s administrative web interface. Under specific conditions, a specially crafted unauthenticated request can reach backend administrative functionality before PaperCut completes the expected access-control checks.

The important details for CVE-2026-81578 involve the difference between the page presented to the requester and the backend action ultimately executed. Huntress found that a crafted request can reference one page to be rendered in the response while targeting a component or action belonging to another page. PaperCut’s vulnerable authorization logic can validate the rendered page rather than correctly enforcing the authorization requirements of the underlying component.

This allows an external attacker with no valid PaperCut account to interact with administrative functionality and alter trusted server configuration.

CVE-2026-81578 affects PaperCut NG and PaperCut MF. PaperCut’s current emergency advisory conservatively applies to all versions of both products while its incident response investigation remains active. PaperCut Hive and PaperCut Pocket are not impacted, while Mobility Print and Print Deploy server components use separate architectures and are also outside the scope of this vulnerability.

The authentication bypass becomes significantly more dangerous when combined with CVE-2026-82078. That second flaw exists in PaperCut’s database connection utilities and involves unsafe dynamic class loading. The software can instantiate database driver classes using configurable driver names without restricting them to an approved allowlist.

Normally, exploiting CVE-2026-82078 requires high privileges because the attacker needs the ability to manipulate the relevant configuration parameters. CVE-2026-81578 supplies that missing step: an unauthenticated attacker can first modify trusted server settings and then abuse the class-loading behavior to execute arbitrary Java bytecode already available on the application’s classpath.

In practice, that transforms two vulnerabilities with different prerequisite conditions into a pre-authentication RCE chain.

Huntress recreated the chain against PaperCut NG version 25.0.11.75758. In its test, a remote unauthenticated request caused charmap.exe to execute as SYSTEM beneath the PaperCut pc-app.exe Application Server process, demonstrating that successful exploitation can cross from an exposed web interface into operating-system command execution with highly privileged rights.

A working CVE-2026-81578 PoC is now publicly available for the combined CVE-2026-81578/CVE-2026-82078 attack chain, and public exploit references have also appeared in vulnerability databases and security tooling. That substantially reduces the barrier for scanning and exploiting unpatched internet-facing systems.

Real-world attacks were underway even before full public technical details emerged. Huntress observed exploitation in two customer environments, with the first incident occurring on August 26. One attack lasted less than two minutes and executed Base64-encoded reconnaissance commands that decoded to:

whoami & ver

A second incident extended the reconnaissance sequence to:

whoami & ver & tasklist

These commands allowed the attackers to determine the identity under which PaperCut was running, the Windows version, and active processes.

The attackers also delivered malicious Java .class files through the vulnerable server. Huntress recovered one payload as:

lib/Udydn.class

Researchers also observed an unusual in-memory Apache Derby database path ending in:

memory:C:\Program Files\PaperCut MF\server\data\internal\pwn

The second database boot event occurred immediately before code execution, making it a high-confidence forensic artifact for the observed attack chain.

PaperCut’s subsequent investigation shows that attacker behavior has since escalated beyond basic reconnaissance. The vendor describes a second wave against public-facing systems that were not fully patched, with more sophisticated post-compromise activity than what was seen during the first days of the campaign.

Later observed command sequences included domain and session reconnaissance with nltest, quser, and directory enumeration, followed by downloads of legitimate remote-access software. PaperCut documented attackers fetching a SimpleHelp agent and AnyDesk, with SimpleHelp installed as a persistent Windows service named Remote Access Service running as LocalSystem.

The activity shows why the authentication bypass should not be evaluated in isolation. Once chained to code execution, an internet-facing PaperCut Application Server can become an initial foothold for privileged remote access, discovery, persistence, and potentially further lateral movement.

The exact original discovery date has not been publicly disclosed. PaperCut first published its urgent advisory on August 27, 2026 after confirming active customer incidents, assigned CVE identifiers as the investigation developed, and released the initial emergency patch on August 28.

CISA added the vulnerability to its KEV catalog on August 31, 2026, with a remediation due date of September 14, 2026 for affected federal organizations subject to the directive. Known ransomware use is currently listed as unknown.

PaperCut and Huntress have now published useful CVE-2026-81578 IOCs, although defenders should remember that attackers can change payload names, infrastructure, and post-exploitation tools.

CVE-2026-81578 Mitigation

PaperCut’s primary recommendation is to remove PaperCut NG/MF Application Servers from direct internet exposure immediately. If an Application Server is publicly accessible, organizations should restrict its web interfaces to trusted IP addresses using firewall rules, network access controls, a VPN, or another controlled administrative access path. This should be done even when no suspicious activity has been observed.

For supported deployments, administrators should install Emergency Patch Release 3, published September 1, 2026. Release 3 supersedes Releases 1 and 2, so customers do not need to install the earlier emergency packages first. PaperCut recommends that internet-facing systems upgrade again even if Release 1 or Release 2 has already been installed.

The current emergency patches cover PaperCut NG/MF versions:

• 26
• 25
• 24

Organizations running version 23 or older should upgrade to a current supported version rather than wait for a separate emergency patch. PaperCut explicitly recommends upgrading pre-v24 installations to the latest available release.

Administrators should also patch Site Servers and secondary/print servers, not only the primary Application Server. PaperCut states that Mobility Print, Print Deploy servers, User Client software, Print Deploy clients, and the Mobility Print installer are not affected by this incident.

CVE-2026-81578 detection should start by identifying every PaperCut NG and MF Application Server and determining whether it was externally accessible at any time beginning at least August 26, when Huntress first observed exploitation.

To Detect CVE-2026-81578 exploitation or post-compromise activity, defenders should examine PaperCut logs, endpoint telemetry, network records, and filesystem activity for the following indicators:

• Suspicious child processes originating from pc-app.exe or pc-app
• Missing, deleted, or unexpectedly truncated server.log files
• ERROR No suitable driver found for jdbc:no:x
• ERROR DatabaseUtils – Database error looking up cardID: VALUES CAST
• DB URL: jdbc:derby:memory:pwn;create=true
• Database error looking up cardID: VALUES CAST(X’cafebabe
• DB URL: jdbc:no:x DB Driver: <5-char random name>
• Unexpected five-character .class files under <install>\server\lib\
• Corresponding .cmd or .out files under <install>\server\data\content\
• cmd.exe spawned by the PaperCut service
• Execution of whoami, ver, tasklist, nltest, or quser from the PaperCut process tree
• Unexpected SimpleHelp or AnyDesk deployment
• A Windows service named Remote Access Service
• SimpleService.exe running from the JWrapper-Remote Access directory

PaperCut cautions that attackers may delete temporary files as the attack progresses, so the absence of these artifacts does not prove that a system was never compromised.

Organizations should also preserve evidence before upgrading or rebooting an exposed system. Huntress recommends capturing the entire PaperCut server/logs directory, configuration state, process trees, reverse-proxy and firewall logs, DNS and network-flow records, and evidence of recently created services, scheduled tasks, autoruns, or files.

The CVE-2026-81578 mitigation process must go beyond patching when there is evidence of compromise. PaperCut recommends securing existing backups, completely wiping and rebuilding the Application Server, and restoring from a clean backup created before suspicious activity occurred.

Security teams should also review administrative credentials, service accounts, tokens, Active Directory access, and systems reachable from the compromised server. Because the PaperCut Application Server can run with SYSTEM or similarly privileged rights, successful exploitation can provide attackers with substantial post-compromise capability.

PaperCut’s rapid sequence of emergency patches also illustrates why defenders should confirm that they are running the latest mitigation rather than assuming an earlier hotfix is sufficient. Researchers discovered additional bypass paths after the first emergency release, Release 2 added further hardening, and Release 3 subsequently closed additional attack vectors observed in the wild.

Contact Sales

 

The post CVE-2026-81578: Exploited PaperCut Authentication Bypass Chains to Pre-Auth RCE appeared first on SOC Prime.

Unit 42 details a Chinese speaking threat actor combining autonomous AI scanning across seven vulnerabilities with manual exploitation. Read more.

The post Chinese-Speaking Threat Actor Harnesses AI Models for Autonomous Cyberattacks appeared first on Unit 42.

F5 has released out-of-band security updates to address multiple NGINX Vulnerabilities, including CVE-2026-42530, a critical issue in the ngx_http_v3_module that can be exploited by a remote, unauthenticated attacker. The flaw is a use-after-free condition in NGINX’s HTTP/3 implementation that can cause worker-process restarts and denial of service, and in environments where ASLR is disabled or can be bypassed, may also open a path to arbitrary code execution.

The issue is especially important because it affects internet-facing NGINX deployments using HTTP/3 QUIC, which increasingly sits at the edge of modern web infrastructure. Public reporting also highlights a second critical bug, CVE-2026-42055, in the ngx_http_proxy_v2_module and ngx_http_grpc_module, reinforcing the broader urgency around patching current NGINX releases.

CVE-2026-42530 analysis

For CVE-2026-42530 analysis, the core issue is a use-after-free bug in the ngx_http_v3_module. According to public reporting, a remote attacker can trigger the flaw by reopening a QPACK encoder stream through a specially crafted HTTP/3 session when NGINX Open Source is configured to use the HTTP/3 QUIC module. If successful, the attack can force the NGINX worker process to restart, creating a denial-of-service condition.

The CVE-2026-42530 becomes more severe in weakened or less-hardened environments. F5 says arbitrary code execution is possible if ASLR is disabled or if an attacker can bypass it, making the flaw more than just a stability issue in some deployments.

The CVE-2026-42530 is a narrower vulnerability than a generic “all NGINX servers are vulnerable” headline suggests. The affected Open Source versions are 1.31.0 and 1.31.1, and exposure depends on HTTP/3 support being enabled. In contrast, the related CVE-2026-42055 flaw impacts the HTTP/2 proxy and gRPC path under a separate set of conditions, including use of proxy_http_version 2 or grpc_pass.

At the time of writing, the cited sources do not point to a public CVE-2026-42530 poc or concrete CVE-2026-42530 iocs. The currently available details for CVE-2026-42530 are focused on the vulnerable module, affected versions, and the conditions that increase the likelihood of code execution beyond simple worker crashes.

CVE-2026-42530 Mitigation

The most effective CVE-2026-42530 mitigation is to upgrade to a fixed release immediately. For NGINX Open Source, that means moving to 1.31.2 or later. Organizations using F5-supported distributions such as NGINX Plus and other related products should apply the vendor-issued security updates as soon as possible.

For CVE-2026-42530 detection, defenders should first inventory all NGINX systems and determine whether HTTP/3 QUIC is enabled. Security teams should prioritize internet-facing systems running NGINX Open Source 1.31.0 or 1.31.1, especially where HTTP/3 is exposed to untrusted clients.

To protect the environment while patching is underway, teams should also review whether HTTP/3 is necessary on every exposed service and limit unnecessary protocol exposure where possible. Because public reporting does not provide stable exploit indicators, the most practical way to detect risk is to identify vulnerable versions and configurations rather than rely on signature-based detection alone.

CHECK AVAILABLE DETECTIONS

Disclaimer: Detection content may not be available for every CVE. Check the SOC Prime Platform for current coverage. If you don’t find relevant detections now, please check back later.

The post CVE-2026-42530: Critical NGINX HTTP/3 Flaw Can Trigger DoS and Possible RCE appeared first on SOC Prime.

Cisco has released security updates for an SD-WAN vManage flaw exploited in zero-day attacks. The issue, tracked as CVE-2026-20262, affects Cisco Catalyst SD-WAN Manager and can allow an authenticated remote attacker to create or overwrite files on the underlying operating system, opening a path to root privilege escalation. Public reporting says the flaw was exploited in the wild before patches were broadly applied.

The bug is especially important because it targets a central management component in enterprise SD-WAN environments. BleepingComputer notes that Cisco Catalyst SD-WAN Manager, formerly known as SD-WAN vManage, can manage thousands of SD-WAN devices from one dashboard, so compromise of the management plane can have outsized downstream impact. The affected deployment models include on-prem, Cloud-Pro, Cisco Managed Cloud, and FedRAMP environments.

For defenders, the most important details for CVE-2026-20262 are the access requirement and exploit path: the flaw exists because of insufficient validation of user-supplied input during a file upload process in the web UI. A successful attack requires valid credentials with at least write access, but once that threshold is met, the attacker can use crafted HTTP requests to write files that may later be leveraged to gain root privileges.

CVE-2026-20262 analysis

For CVE-2026-20262 analysis, the key issue is that this is not a classic unauthenticated RCE. Instead, it is an arbitrary file-write bug in the web UI, or more precisely a vulnerability in the Catalyst SD-WAN Manager that lets an authenticated remote attacker create or overwrite files on the filesystem through a crafted request to an affected API endpoint. The privilege-escalation step comes after the file write, when the modified file is used to elevate to root.

Operationally, CVE-2026-20262 affects all listed Catalyst SD-WAN Manager deployment types regardless of device configuration. Cisco’s fixed-version matrix, as quoted by both articles, maps vulnerable and remediated releases as follows: 20.9.9.1 and earlier fixed in 20.9.9.2, 20.12.7.1 and earlier fixed in 20.12.7.2, 20.15.4.4 and earlier fixed in 20.15.4.5, 20.15.5.2 and earlier fixed in 20.15.5.3, 20.18.3 fixed in 20.18.3.1, and 26.1.1.1 and earlier fixed in 26.1.1.2.

At the time of disclosure, the cited sources did not describe a public CVE-2026-20262 PoC, but Cisco confirmed limited real-world exploitation in June 2026. The Hacker News says Cisco discovered the flaw during internal security testing, while BleepingComputer reports that Cisco PSIRT became aware of in-the-wild abuse earlier this month. That combination suggests defenders should treat the issue as already operationalized even without full public exploit details.

Cisco also shared CVE-2026-20262 IOCs that point to malicious file-upload activity and follow-on execution. Public reporting says administrators should inspect /var/log/nms/vmanage-server.log, vmanage-appserver, and serviceproxy-access logs for suspicious uploads of index.jsp and .war files, and for evidence that a deployed WAR was later accessed through the service proxy.

CVE-2026-20262 Mitigation

The immediate CVE-2026-20262 mitigation step is to upgrade to Cisco’s fixed releases as soon as possible. Both sources emphasize that Cisco strongly advised customers to patch their systems after confirming active exploitation, and the fix is available across the affected release trains.

From a defensive operations standpoint, CVE-2026-20262 detection should focus on historical and current log review rather than waiting for broad signature coverage. BleepingComputer says Cisco specifically told admins to check SD-WAN Manager logs for attempts to upload index.jsp and .war files, which makes filesystem and application log review central to triage.

To detect CVE-2026-20262, security teams should inventory all Catalyst SD-WAN Manager instances, map them against Cisco’s fixed versions, and review logs for suspicious uploads, deployment events, and access to unexpected JSP or WAR resources. This is especially important because the flaw requires authenticated access, which means exploitation may blend in with otherwise legitimate administrative workflows unless the file-write behavior is examined closely.

CHECK AVAILABLE DETECTIONS

Disclaimer: Detection content may not be available for every CVE. Check the SOC Prime Platform for current coverage. If you don’t find relevant detections now, please check back later.

The post CVE-2026-20262: Cisco SD-WAN Manager Zero-Day Can Lead to Root Privilege Escalation appeared first on SOC Prime.

Google has released emergency Chrome updates to address a Chrome zero-day vulnerability, a high-severity out-of-bounds read/write issue in the V8 JavaScript engine. Google says an exploit exists in the wild, and the patched Stable builds are rolling out as 149.0.7827.102.103 for Windows and Mac and 149.0.7827.102 for Linux.

Public reporting says the flaw can be triggered through a specially crafted HTML page and may allow a remote attacker to execute arbitrary code inside the browser’s sandbox. SecurityWeek adds that the bug is the fifth Chrome zero-day exploited in 2026, following CVE-2026-2441, CVE-2026-3909, CVE-2026-3910, and CVE-2026-5281.

The most important details for CVE-2026-11645 are still limited because Google has restricted bug details while updates propagate. The company says the vulnerability was reported in late April 2026 by an anonymous researcher, and SecurityWeek reports that the researcher received a $55,000 reward.

CVE-2026-11645 analysis

For CVE-2026-11645 analysis, the confirmed public description remains narrow: Google lists the issue as “out of bounds memory access in V8,” while BleepingComputer and SecurityWeek describe it as an out-of-bounds read/write flaw. In practical terms, that means malicious web content can push the engine beyond intended memory boundaries, which may expose sensitive data, crash the browser, or create a path to code execution within the sandbox.

From an exposure standpoint, CVE-2026-11645 affects Chrome desktop users who have not yet moved to the patched 149 release. BleepingComputer notes that successful exploitation can lead to heap corruption and unauthorized access beyond the intended memory buffer, and also says the flaw could help attackers bypass protections such as ASLR, potentially making a second vulnerability easier to weaponize.

At the time of writing, there is no public CVE-2026-11645 PoC in the cited sources, and Google has not disclosed technical exploit details or victimology. SecurityWeek notes that no information is available about the attacks, although it says the zero-day was likely paired with a sandbox escape flaw in real-world operations.

CVE-2026-11645 Mitigation

The immediate CVE-2026-11645 mitigation step is to update Chrome to the patched Stable versions Google released on June 8, 2026. Users who do not update manually will generally receive the fix automatically on the next browser relaunch, but Google says rollout can take days or weeks to fully reach all users.

For defenders, detection of CVE-2026-11645 is limited because Google has intentionally withheld deeper technical information, and there are no published IOCs related to exploitation of CVE-2026-11645 in the cited reporting. In practice, teams should detect CVE-2026-11645 exposure by identifying unmanaged or outdated Chrome installations, prioritizing high-risk user groups, and confirming that enterprise fleets have reached the fixed 149 builds.

CHECK AVAILABLE DETECTIONS

Disclaimer: Detection content may not be available for every CVE. Check the SOC Prime Platform for current coverage. If you don’t find relevant detections now, please check back later.

The post CVE-2026-11645: Chrome Zero-Day Vulnerability Exploited in the Wild appeared first on SOC Prime.

Organizations continue to face elevated risk from edge-device flaws that can hand attackers an initial foothold without valid credentials. CVE-2026-50751 is a critical authentication bypass issue in Check Point VPN Remote Access and Mobile Access that allows a remote, unauthenticated attacker to establish a VPN session without a valid user password. According to public reporting, the flaw stems from a logic-flow weakness in certificate validation and is being exploited in a limited number of real-world attacks.

The exposure is narrower than a generic “all Check Point gateways are vulnerable” headline suggests. Public reporting says the issue only applies when Remote Access VPN or Mobile Access is enabled, IKEv1 is enabled for remote access, legacy clients are accepted, and the gateway does not require a machine certificate. In that configuration, the flaw can open a path to unauthorized VPN access on affected Security Gateways and Spark firewalls.

CVE-2026-50751 analysis

For CVE-2026-50751 analysis, the most important takeaway is that the bug is an authentication bypass rather than a direct remote code execution issue. Help Net Security and The Hacker News both report that the weakness allows an attacker to connect through the VPN without a valid password, after which additional post-authentication activity is required to access internal resources or move toward privilege escalation. That makes the flaw especially dangerous on internet-facing gateways where remote access is broadly enabled for users and contractors.

Public reporting shows that CVE-2026-50751 affects Check Point deployments using deprecated IKEv1 for remote access, including certain Security Gateway releases and Spark firewall versions. The same reports say Check Point first noticed suspicious activity on June 4, 2026, while the earliest known exploitation dates back to May 7, 2026, with attacks increasing in early June. The observed campaigns were limited to a few dozen organizations globally, and one confirmed case involved a Qilin ransomware affiliate.

The post-compromise activity described in the reporting helps clarify the practical risk. Help Net Security says investigators saw suspected data exfiltration activity involving Rclone, possible Tox protocol usage, and attacker-operated VPS infrastructure hosted by providers including Kaupo Cloud HK, Shock Hosting, and Vultr Holdings. The Hacker News adds that once access was established, attackers attempted to download malicious ELF files from actor-controlled infrastructure. Those published indicators are the strongest public details for CVE-2026-50751 currently available.

At the time of writing, the cited reports do not point to a public CVE-2026-50751 PoC, but they do confirm live exploitation and targeted operational use. They also note that Check Point believes the same actor infrastructure may be probing or exploiting other VPN-related flaws across multiple vendors, which raises the urgency for organizations still running vulnerable remote-access configurations.

CVE-2026-50751 Mitigation

The most effective CVE-2026-50751 mitigation is to upgrade affected gateways and firewalls to fixed versions and immediately review environments for signs of compromise. The Hacker News lists affected Check Point Security Gateway and Spark branches, while Help Net Security says customers should begin forensic log audits and configuration reviews starting from the earliest observed exploitation period in May 2026.

If immediate patching is delayed, Check Point’s alternative mitigations are operationally important. Help Net Security says customers should disable use of deprecated IKEv1, remove support for legacy Remote Access clients, and require a machine certificate to establish connections. These measures directly reduce the conditions needed for exploitation and are especially relevant for exposed Check Point VPN Remote Access deployments that still support older client workflows.

For defenders focused on CVE-2026-50751 detection, the most practical path is to review vendor-published indicators and audit historical logs from the earliest known exploitation date. Help Net Security says Check Point provided CVE-2026-50751 IOCs and urged incident response teams to prioritize forensic review, while the broader operational guidance is to detect CVE-2026-50751 by correlating suspicious VPN connections, legacy IKEv1 use, unauthorized remote-access sessions, unusual VPS-originating access, and post-authentication activity tied to exfiltration tooling.

CHECK AVAILABLE DETECTIONS

Disclaimer: Detection content may not be available for every CVE. Check the SOC Prime Platform for current coverage. If you don’t find relevant detections now, please check back later.

The post CVE-2026-50751: Check Point VPN Authentication Bypass Exploited in Targeted Attacks appeared first on SOC Prime.

Cisco has disclosed a seventh SD-WAN zero-day exploited in 2026, tracked as CVE-2026-20245. The flaw affects the command-line interface of Cisco Catalyst SD-WAN Manager and can allow an authenticated remote attacker with netadmin privileges to execute arbitrary commands as root by uploading a crafted file. Cisco says exploitation has already been observed in limited cases, including incidents where configuration changes were pushed to edge devices.

The risk is amplified by the access requirements. Cisco says the attacker must already have netadmin privileges, which can come from stolen credentials or from chaining previously disclosed SD-WAN flaws such as CVE-2026-20182 or CVE-2026-20127. According to Cisco’s disclosure as summarized by Help Net Security and SecurityWeek, the issue affects all Cisco Catalyst SD-WAN deployment types, including on-prem, Cloud-Pro, Cisco Managed Cloud, and FedRAMP environments.

CVE-2026-20245 analysis

For CVE-2026-20245 analysis, the key weakness is insufficient validation of user-supplied input in the SD-WAN Manager CLI. Cisco’s public description says an authenticated attacker can upload a crafted file and trigger command injection, ultimately elevating privileges to root on the affected system. SecurityWeek adds that Cisco PSIRT learned about exploitation in June 2026, which suggests the disclosure was accelerated because the bug was already being abused in the wild.

The most important details for CVE-2026-20245 are that this is not a remote unauthenticated bug by itself, and that the exploit path appears closely tied to prior SD-WAN compromise activity. Cisco is not aware of successful exploitation by any method other than obtaining the required privileged access first, which is why defenders should treat the issue as part of a broader SD-WAN intrusion chain rather than as a standalone initial-access vector.

At the time of disclosure, the cited sources did not point to a public CVE-2026-20245 PoC, but Cisco did confirm active exploitation and said Mandiant reported the flaw. In practical terms, the attacker’s CVE-2026-20245 payload is a crafted file uploaded through the CLI workflow to trigger command injection and root-level execution, not a conventional malware dropper delivered from outside the appliance.

From an operational perspective, CVE-2026-20245 affects some of the most sensitive systems in an SD-WAN deployment because SD-WAN Manager sits at the management plane. Cisco said observed exploitation resulted in configuration changes pushed to edge devices, which means successful abuse can extend beyond the management node itself and alter the behavior of downstream network infrastructure.

CVE-2026-20245 Mitigation

There was no patch and no workaround available at disclosure, so CVE-2026-20245 mitigation is centered on hardening, evidence preservation, and compromise review. Cisco’s guidance, as quoted by Help Net Security, is to collect admin-tech data from each control component before any upgrade activity, then upgrade at the earliest opportunity and verify the configuration of edge devices. That advice matters because software updates alone may not fully resolve the situation if the system has already been compromised.

Cisco has also published CVE-2026-20245 IOCs in the form of specific log guidance. Help Net Security says customers should review those logs and, if compromise is confirmed, work directly with Cisco TAC for targeted remediation steps. SecurityWeek likewise notes that Cisco has made indicators available while it prepares a future Catalyst SD-WAN Manager release containing the fix.

For defenders trying to detect CVE-2026-20245, the most practical approach is to review SD-WAN Manager appliances for signs of unauthorized root-level activity, suspicious file uploads, and unexpected configuration pushes to edge devices. Because Cisco explicitly tied the prerequisite access to compromised credentials or earlier SD-WAN bugs, organizations should also validate that previously disclosed authentication and privilege-escalation flaws are fully remediated across the estate.

More broadly, CVE-2026-20245 detection should be treated as incident response rather than routine patch management. If logs indicate abuse, Cisco warns that simply installing the future software fix will not by itself secure the environment, and customers should engage TAC for recovery guidance tailored to the confirmed compromise.

CHECK AVAILABLE DETECTIONS

Disclaimer: Detection content may not be available for every CVE. Check the SOC Prime Platform for current coverage. If you don’t find relevant detections now, please check back later.

The post CVE-2026-20245: Cisco SD-WAN Manager Zero-Day Enables Root Command Execution appeared first on SOC Prime.

A newly disclosed denial-of-service vulnerability, tracked as CVE-2026-49975, shows how long-known HTTP/2 weaknesses can still be chained into a highly effective modern attack. SecurityWeek reports that researchers at Calif demonstrated an HTTP/2 Bomb exploit capable of knocking major web servers offline within seconds by combining a compression bomb with a Slowloris-style hold that prevents the server from releasing memory.

According to the report, the attack can potentially impact more than 880,000 websites that support HTTP/2 and run default configurations of NGINX, Apache HTTP(Web) Server, Microsoft IIS, Envoy, or Cloudflare Pingora. Calif also said the attack can be launched from a home computer on a 100 Mbps connection and still render affected servers unavailable in seconds.

CVE-2026-49975 analysis

SecurityWeek explains that the attack is not built on a single new flaw, but on a chain of known denial-of-service techniques. The first stage relies on HPACK Bomb, tracked as CVE-2016-6581, which abuses HTTP/2 header compression so that very small messages expand into extremely large memory-consuming structures on the destination server. The article notes that this technique was demonstrated against Apache HTTPD last year with a 4,000x amplification rate, and Apache addressed that issue in version 2.4.64 as CVE-2025-53020.

The second stage abuses CVE-2016-8740 and CVE-2016-1546, two HTTP/2 Slowloris-style issues tied to continuation frames and manipulated flow-control windows. As described by SecurityWeek, attackers can advertise a zero-byte flow-control window, preventing the server from sending a response, and then reset the send timeout so memory allocations remain pinned instead of being freed.

What makes this variant notable is that, according to Calif’s explanation quoted by SecurityWeek, the amplification does not come from a large decoded header value. Instead, it comes from the per-entry bookkeeping the server allocates around nearly empty headers, meaning traditional decoded-size limits may not stop the attack because there is “almost nothing to decode.” The report also says Calif found a bypass for servers that cap the header-field count and released proof-of-concept code to demonstrate the attack.

CVE-2026-49975 Mitigation

SecurityWeek reports that NGINX resolved the bug in April, while Apache rolled out fixes in late May and assigned CVE-2026-49975. At the time of reporting, Microsoft IIS, Envoy, and Cloudflare Pingora had not yet been patched.

From a practical defense standpoint, the clearest short-term priority is to identify internet-facing systems using default HTTP/2 configurations and verify whether they are running patched software. Since the article does not publish specific IOCs or deep detection telemetry, the most realistic approach is to focus on exposed HTTP/2 services, rapid memory spikes, and sudden service instability consistent with memory exhaustion. That last point is a defensive inference based on the attack behavior described in the SecurityWeek report.

CHECK AVAILABLE DETECTIONS

Disclaimer: Detection content may not be available for every CVE. Check the SOC Prime Platform for current coverage. If you don’t find relevant detections now, please check back later.

The post CVE-2026-49975: HTTP/2 Bomb Attack Can Knock Web Servers Offline in Seconds appeared first on SOC Prime.

CVE-2026-48095 in 7-Zip has raised fresh concerns around malicious archive handling and user-driven exploitation. According to GitHub Security Lab, the flaw is a heap buffer write overflow in 7-Zip’s NTFS archive handler that affects version 26.00 and can potentially lead to arbitrary code execution or application crashes. The issue was fixed in 7-Zip 26.01, released on April 27, 2026.

The bug is especially dangerous because the malformed file does not need to use a dedicated NTFS file extension to reach the vulnerable handler. Public reporting says 7-Zip’s signature-based fallback logic can route a crafted file with extensions such as .7z, .zip, or .rar into the NTFS parser after other handlers fail, broadening the practical attack surface for phishing and social-engineering delivery.

For defenders, the most important details for CVE-2026-48095 are the affected version, the archive-parsing trigger, and the existence of public exploit material. GitHub Security Lab says researcher Jaroslav Lobačevski privately reported the issue on April 24, 2026, while later public write-ups confirmed that a working Python generator was released alongside the advisory.

CVE-2026-48095 analysis

At the technical level, the flaw stems from an under-allocation bug in the NTFS compressed stream buffer, inside CInStream::GetCuSize(). GitHub Security Lab explains that a crafted NTFS image can force the shift expression used for buffer sizing to hit an exponent of 32, which triggers undefined behavior in C++ and leaves _inBuf allocated as just 1 byte. The next read operation then writes attacker-controlled data into that tiny buffer, creating a classic heap overflow condition.

That overflow becomes exploitable because the adjacent heap layout allows the attacker to corrupt the stream object’s vtable pointer. Public analysis says the first read can overwrite the vtable after only a few hundred bytes, while the second read dispatches execution through the corrupted pointer, making code execution feasible in favorable conditions. Security Online and Cyber Press both describe this as a path to arbitrary code execution, while also noting that lower-memory systems may see denial-of-service outcomes instead.

The public CVE-2026-48095 PoC further raises the risk profile. Security Online says the researcher released gen_ntfs_sparse.py, a Python script that generates a sparse NTFS image designed to trigger the flaw. In practice, the CVE-2026-48095 payload is a specially crafted archive image rather than a dropped executable, which fits common social-engineering scenarios where a victim is lured into opening what appears to be a harmless compressed file.

From an operational perspective, CVE-2026-48095 affects systems where users open untrusted archive files with vulnerable 7-Zip builds. The coordinated advisory specifically tested 26.00, while later reporting notes that the affected sizing logic predates that release, suggesting the bug may have existed longer than the tested version alone.

CVE-2026-48095 Mitigation

The primary response is to upgrade immediately to 7-Zip 26.01 or later. GitHub Security Lab’s disclosure timeline shows that the fix shipped on April 27, 2026, and 7-Zip’s official history confirms that version 26.01 was released on that date with bug fixes.

For practical CVE-2026-48095 detection, organizations should identify endpoints running 7-Zip 26.00, review environments where users frequently unpack externally sourced archives, and prioritize systems used for email triage, downloads, malware analysis, or administrative handling of compressed files. Because the exploitation path is file-driven, the most useful first step is asset and version validation rather than network hunting.

There are no vendor-published CVE-2026-48095 IOCs in the cited materials, so teams trying to detect CVE-2026-48095 should focus on suspicious archive-opening activity, crashes involving 7-Zip around NTFS-like content, and user workflows where disguised archive extensions could reach the vulnerable handler. In the absence of stronger telemetry, patching and user caution remain the most reliable defenses.

CHECK AVAILABLE DETECTIONS

Disclaimer: Detection content may not be available for every CVE. Check the SOC Prime Platform for current coverage. If you don’t find relevant detections now, please check back later.

The post CVE-2026-48095: 7-Zip Heap Buffer Overflow Can Lead to Code Execution appeared first on SOC Prime.

Phishing remains one of the most effective tools in the cybercriminal arsenal, especially when threat actors abuse trusted identities, compromised legitimate accounts, and familiar online services to increase victim interaction. Europol notes that phishing techniques remain a main distribution vector for data-stealing malware, while CERT-UA’s latest advisory shows that the same social engineering logic continues to drive targeted campaigns against Ukrainian public-sector organizations.

In its May 21, 2026 advisory, CERT-UA warned that UAC-0057 had updated its malware toolkit and was using OYSTERFRESH, OYSTERSHUCK, and OYSTERBLUES in a phishing campaign targeting Ukrainian state organizations. The lure theme centered on obtaining certificates through the Prometheus educational platform, while the broader tradecraft overlaps with the long-running Ghostwriter / FrostyNeighbor / UNC1151 activity cluster that security researchers continue to associate with Belarus-aligned espionage operations against Ukrainian government entities.

Recent reporting shows that Ghostwriter’s 2026 activity against Ukraine is not isolated to a single infection chain. ESET documented fresh March 2026 campaigns targeting Ukrainian government organizations with geofenced PDF lures that ultimately delivered Cobalt Strike, underscoring how the actor continues to refresh both its delivery mechanisms and its malware stack. CERT-UA’s latest UAC-0057 advisory fits that same pattern of ongoing adaptation, this time with a newly documented OYSTER-branded toolset distributed through phishing emails sent from compromised real-world accounts.

Sign up for the SOC Prime Platform to proactively defend your organization against UAC-0057 attacks. Just press Explore Detections below and access a relevant detection rule stack, enriched with AI-native CTI, mapped to the MITRE ATT&CK® framework, and compatible with a wide range of SIEM, EDR, and Data Lake technologies.

Security teams can search the Threat Detection Marketplace library using the “UAC-0057” tag to identify relevant detections and track related content updates. Cyber defenders can also rely on Uncoder AI to turn fresh threat reports into performance-optimized queries, document and improve detection logic, and generate Attack Flows based on the latest CERT-UA reporting.

Explore Detections

Analyzing UAC-0057 Attacks Using OYSTERFRESH, OYSTERSHUCK, and OYSTERBLUES

According to reporting that summarizes CERT-UA’s advisory, the campaign has been active since spring 2026 and relies on large-scale phishing emails sent to Ukrainian state organizations from compromised accounts belonging to real employees. The lure theme is framed around obtaining certificates via the Prometheus educational platform, which helps the emails appear plausible to recipients and increases the odds of interaction.

The infection chain begins with a PDF document that contains an active link leading to a ZIP archive. That archive contains a JavaScript file classified as OYSTERFRESH. When launched, the script displays benign decoy text to the victim while quietly starting the malicious workflow in the background. From there, OYSTERFRESH performs two main tasks: it stores an encoded and obfuscated OYSTERBLUES payload in the Windows Registry and downloads OYSTERSHUCK, which acts as the decoder component for the next stage.

For deobfuscation, OYSTERSHUCK reportedly applies a sequence of string reversal, ROT13, and URL decoding before restoring the OYSTERBLUES payload. Once decoded, OYSTERBLUES fingerprints the compromised machine by collecting the device name, current username, operating system version, last boot time, and the list of running processes. The harvested data is sent to a command-and-control server via HTTP POST, and the server responds with arbitrary JavaScript that is executed through eval, effectively giving the operators remote control over the host.

CERT-UA-linked reporting further indicates that the next stage commonly involves the delivery of Cobalt Strike components. This aligns with the broader UAC-0057 / Ghostwriter tradecraft documented by ESET, which shows the group continuing to use phishing-delivered JavaScript downloaders and staged payload validation before deploying higher-value implants. In other words, the newly documented OYSTER toolset appears to extend an already familiar post-compromise pattern rather than replace it.

Infrastructure choices also support the attribution. Reporting on the advisory says the actor’s command-and-control layer remains masked behind Cloudflare, while many of the associated domains are registered in the .icu zone. Together with the campaign’s tooling style and targeting, these characteristics are consistent with activity tracked by CERT-UA as UAC-0057, also known publicly as Ghostwriter, UNC1151, and FrostyNeighbor.

MITRE ATT&CK Context

Leveraging MITRE ATT&CK helps contextualize the latest UAC-0057 phishing activity targeting Ukrainian state organizations. Based on the TTPs described in CERT-UA-linked reporting, the most relevant ATT&CK techniques likely include Spearphishing Link (T1566.002), User Execution (T1204), Command and Scripting Interpreter: JavaScript (T1059.007), Registry-based storage or abuse for payload staging, System Information Discovery (T1082), Process Discovery (T1057), Ingress Tool Transfer (T1105), and Command and Control over Web Protocols (T1071.001). The likely use of Cobalt Strike in follow-on stages also points to broader post-exploitation, persistence, and lateral movement opportunities once initial foothold is established.

The post UAC-0057 Attack Detection: OYSTERFRESH, OYSTERSHUCK, and OYSTERBLUES Fuel Phishing Campaigns Against Ukrainian State Organizations appeared first on SOC Prime.

Drupal has released security updates for a “highly critical” security vulnerability in Drupal Core that can be exploited by anonymous attackers against sites using PostgreSQL databases. Tracked as the CVE-2026-9082 vulnerability, the issue resides in Drupal’s database abstraction API, which is supposed to sanitize queries before they reach the backend database. Drupal rates the flaw 20/25 on its own severity scale, while The Hacker News notes that CVE.org lists it at 6.5/10.

For defenders starting CVE-2026-9082 analysis, the key risk is that specially crafted requests can lead to arbitrary SQL injection on PostgreSQL-backed sites, which can in turn cause information disclosure and, in some cases, privilege escalation or remote code execution. Drupal also states that the flaw can be exploited by anonymous users, making exposed public-facing sites the highest priority for remediation.

The current details for CVE-2026-9082 also matter because the scope is narrower than a generic “all Drupal sites” headline suggests. Drupal’s advisory says the SQL injection issue only affects sites using PostgreSQL, but the same security releases also bundle important upstream fixes for Symfony and Twig, which is why even non-PostgreSQL deployments are still advised to update.

CVE-2026-9082 analysis

At the technical level CVE-2026-9082 is a failure in the database abstraction API that normally validates and sanitizes queries to prevent SQL injection. Drupal says an attacker can send specially crafted requests that bypass the expected protections and deliver arbitrary SQL to the PostgreSQL backend. In practical terms, the CVE-2026-9082 payload is a malicious request crafted to abuse query handling rather than a dropped binary or script on disk.

That design flaw is why CVE-2026-9082 affects confidentiality and integrity first, but can also escalate further depending on site configuration. The cited reporting says successful exploitation may expose sensitive data, elevate privileges, and in some environments even enable remote code execution. Cyber Press adds that the attack requires no authentication, which raises the risk for internet-facing sites running vulnerable Drupal Core branches with PostgreSQL.

From an operational perspective, CVE-2026-9082 detection is more likely to rely on version and database inventory than on a stable signature set. The public advisory and the two reports do not publish a public CVE-2026-9082 poc or concrete CVE-2026-9082 iocs, so defenders should focus on identifying vulnerable Drupal branches, confirming whether PostgreSQL is in use, and reviewing suspicious request activity around database-driven endpoints.

CVE-2026-9082 Mitigation

The core CVE-2026-9082 mitigation is to install the latest Drupal release for the affected branch. Drupal’s advisory lists the fixed versions as 11.3.10, 11.2.12, 11.1.10, 10.6.9, 10.5.10, and 10.4.10. For unsupported but still widely deployed branches, Drupal also published best-effort manual patches for Drupal 9.5 and Drupal 8.9, while warning that those end-of-life releases may still contain other previously disclosed security issues.

To Detect CVE-2026-9082 exposure in practice, organizations should first inventory every Drupal installation, map each site to its exact version, and verify whether the backend database is PostgreSQL. That step is critical because the SQL injection path is PostgreSQL-specific, but the bundled framework updates still make patching important for all supported branches.

Where immediate patching is delayed, teams should prioritize public-facing sites that accept anonymous traffic and review database-intensive functionality for abnormal request patterns. Because the cited materials do not include exploit telemetry or public detection rules, the most reliable short-term strategy is aggressive patching, branch validation, and review of any roles or contributed modules that allow Twig template updates.

CHECK AVAILABLE DETECTIONS

Disclaimer: Detection content may not be available for every CVE. Check the SOC Prime Platform for current coverage. If you don’t find relevant detections now, please check back later.

The post CVE-2026-9082: Highly Critical Drupal Core SQL Injection Flaw Threatens PostgreSQL Sites appeared first on SOC Prime.

BitLocker is designed to protect data at rest even when a device is lost, stolen, or powered off, which is why a bypass against that trust model draws immediate attention. The CVE-2026-45585 vulnerability, publicly referred to as YellowKey, is a Windows security feature bypass flaw that Microsoft says can let an attacker with physical access sidestep BitLocker protections and access encrypted data on affected systems. The issue is tracked with a CVSS score of 6.8 and impacts Windows 11 versions 24H2, 25H2, and 26H1 for x64-based systems, as well as Windows Server 2025, including Server Core.

For defenders starting CVE-2026-45585 analysis, the most important point is that the weakness is not in BitLocker’s encryption itself. Help Net Security, citing NCSC Netherlands, notes that the flaw sits in the recovery environment surrounding BitLocker rather than in the cryptography protecting the drive. Public reporting also says a researcher known as Nightmare Eclipse disclosed the zero-day and released a proof-of-concept, which both Help Net Security and The Hacker News say can be readily leveraged.

CVE-2026-45585 analysis

CVE-2026-45585 is exploited through the Windows Recovery Environment rather than through a remote attack path. According to The Hacker News, the attack involves placing specially crafted FsTx files on a USB drive or EFI partition, connecting the media to a target Windows system with BitLocker enabled, rebooting into WinRE, and triggering an unrestricted shell by holding down the CTRL key. If successful, the attacker gains access to the BitLocker-protected volume during the pre-boot recovery sequence.

In practical terms, the published CVE-2026-45585 is not a traditional malware dropper but a malicious recovery-sequence setup that abuses trusted pre-boot behavior. That is also why the public details for CVE-2026-45585 matter so much operationally: any affected machine with a reachable USB port or EFI path and a chance to be rebooted could become a target if an attacker can physically handle the device. The public CVE-2026-45585 PoC has already lowered the barrier to replication.

From a monitoring standpoint, CVE-2026-45585 detection is more challenging than for network-borne vulnerabilities because the exploit is local and pre-boot. There are no vendor-published CVE-2026-45585 IOCs in the cited reports, so the most realistic way to Detect CVE-2026-45585 exposure is through asset review: identify affected Windows 11 and Windows Server 2025 systems, determine whether they rely on TPM-only BitLocker protection, and verify whether Microsoft’s temporary mitigation has been applied to the WinRE image.

From an exposure perspective, CVE-2026-45585 affects organizations that depend on BitLocker to protect unattended laptops, mobile workstations, or portable servers from offline access after theft or temporary physical access. Since the flaw bypasses a security feature rather than breaking encryption itself, the main risk is loss of confidentiality when an attacker can reach the recovery workflow before the legitimate user regains control of the device.

CVE-2026-45585 Mitigation

Microsoft’s current CVE-2026-45585 mitigation guidance offers two main paths. The first is to modify the mounted WinRE image by removing autofstx.exe from the Session Manager BootExecute REG_MULTI_SZ value, then save the offline registry changes, unmount and commit the updated image, and reestablish BitLocker trust for WinRE. The Hacker News says Microsoft later supplemented the advisory with a script that automates this workflow safely by mounting WinRE, editing the offline SYSTEM hive, removing the entry if present, and resealing WinRE so BitLocker trust remains intact.

The second mitigation path is to move devices away from TPM-only protection and require TPM+PIN at startup. Microsoft says this can be done on already encrypted systems through PowerShell, the command line, or Control Panel. For systems that are not yet encrypted, administrators are advised to enable Require additional authentication at startup through Group Policy or Intune and configure startup PIN with TPM. Help Net Security notes that researchers believe the first mitigation is effective because it prevents the FsTx Auto Recovery Utility from launching automatically when WinRE starts, although one researcher also claimed a separate bypass for TPM+PIN is being withheld for now.

CHECK AVAILABLE DETECTIONS

Disclaimer: Detection content may not be available for every CVE. Check the SOC Prime Platform for current coverage. If you don’t find relevant detections now, please check back later.

The post CVE-2026-45585: YellowKey BitLocker Bypass Exposes Encrypted Data on Windows Devices appeared first on SOC Prime.

A vulnerability affecting Cisco Catalyst SD-WAN Controller has drawn urgent attention after Cisco, Rapid7, and CISA confirmed active exploitation. CVE-2026-20182 is a critical authentication bypass flaw in Cisco Catalyst SD-WAN Controller and Cisco Catalyst SD-WAN Manager that carries a CVSS 10.0 score and can let an unauthenticated remote attacker gain administrative privileges on an affected system. Cisco says the flaw stems from peering authentication in the control connection handshake not working properly, and that successful exploitation can expose NETCONF and allow manipulation of configuration across the SD-WAN fabric.

The issue is especially serious because it represents a Critical authentication bypass in Cisco infrastructure that sits at the center of enterprise networking. Cisco says the affected products include Cisco Catalyst SD-WAN Controller and Cisco Catalyst SD-WAN Manager across on-prem, Cloud-Pro, Cisco Managed Cloud, and FedRAMP deployments, regardless of device configuration. The Hacker News also reports that CISA added the flaw to its Known Exploited Vulnerabilities catalog and required U.S. federal civilian agencies to remediate it by May 17, 2026.

CVE-2026-20182 analysis

At a technical level, Rapid7’s research shows the flaw exists in the vdaemon control-plane handshake. After a DTLS handshake, the target sends a challenge, and the client responds with a CHALLENGE_ACK. Rapid7 found that when the connecting peer claims to be a vHub device, device-type-specific certificate verification does not occur, yet the code path still marks the peer as authenticated. That is the core vulnerability in CVE-2026-20182 and the reason an attacker can move from an unauthenticated state to a trusted control-plane peer.

In practical terms, the publicly described CVE-2026-20182 payload is not a malware file but a crafted handshake sequence: DTLS with any certificate, receipt of the challenge, a CHALLENGE_ACK that declares device type 2 (vHub), and then a Hello message that pushes the peer into the UP state. Rapid7’s write-up also shows that once this state is reached, the attacker can use post-authenticated message types to abuse controller functionality.

That post-authentication access creates the real risk. Rapid7 describes a particularly impactful primitive in which an attacker can use a message handler to append an SSH public key to /home/vmanage-admin/.ssh/authorized_keys, creating persistent administrative access. This is also why CVE-2026-20182 affects far more than the login boundary itself: compromise of the controller or manager can translate into broader control over SD-WAN orchestration and policy.

The public research is already mature. Rapid7 published a Metasploit module, which means a public CVE-2026-20182 poc is available. At the same time, Cisco says it became aware of limited exploitation in May 2026, while The Hacker News reports Cisco Talos linked the activity with high confidence to UAT-8616, which allegedly attempted to add SSH keys, modify NETCONF configurations, and escalate to root privileges after exploitation.

For defenders, CVE-2026-20182 detection is more likely to come from controller logs and configuration review than from network signatures alone. Cisco’s advisory says customers should examine /var/log/auth.log for entries showing Accepted publickey for vmanage-admin from unknown or unauthorized IP addresses, validate those IPs against known system IP assignments, and manually review unusual control-connection peering events, especially unexpected vmanage peer types. These vendor-published checks are the closest public CVE-2026-20182 iocs currently available.

Explore Detections

CVE-2026-20182 Mitigation

The most important details for CVE-2026-20182 are straightforward on the remediation side: Cisco says there are no workarounds and customers should upgrade to a fixed release as soon as possible. The first fixed versions include 20.9.9.1 for release 20.9, 20.12.7.1 for 20.10 and 20.11, 20.12.5.4 / 20.12.6.2 / 20.12.7.1 for 20.12, 20.15.4.4 / 20.15.5.2 for 20.15, 20.18.2.2 for 20.18, and 26.1.1.1 for 26.1, while Cisco Managed Cloud release 20.15.506 was remediated without customer action.

Before upgrading, Cisco advises customers to run the request admin-tech command on each SD-WAN control component so possible evidence is preserved for investigation. That step matters because a rushed upgrade can overwrite useful forensic data if a system has already been compromised.

To Detect CVE-2026-20182 exposure in practice, security teams should inventory all Catalyst SD-WAN Controller and Manager nodes, map them to Cisco’s fixed releases, review peering events for unusual timestamps, roles, public IPs, and system IPs, and compare authentication events against known maintenance windows and authorized infrastructure. Cisco explicitly recommends opening a TAC case if compromise is suspected and supplying the collected admin-tech bundle for review.

The post CVE-2026-20182: Critical Authentication Bypass in Cisco SD-WAN Can Grant Admin Access appeared first on SOC Prime.

Microsoft has disclosed a vulnerability impacting on-premise versions of Exchange Server that is already seeing active exploitation in the wild. Tracked as CVE-2026-42897, the issue carries a CVSS score of 8.1 and affects Exchange Server 2016, Exchange Server 2019, and Exchange Server Subscription Edition, while Exchange Online is not impacted. Microsoft describes it as a spoofing issue rooted in cross-site scripting that can be triggered when a user opens a specially crafted email in Outlook Web Access under certain interaction conditions.

From a defender’s perspective, the CVE-2026-42897 vulnerability matters because the exploit path does not begin with a server takeover. Instead, the attacker sends a crafted email that can lead to arbitrary JavaScript execution in the victim’s browser session when viewed through OWA, creating a route to spoofing and session abuse in the web client context. At the time of disclosure, Microsoft said exploitation had been detected, but public reporting did not identify the threat actor, targets, or overall campaign scale.

CVE-2026-42897 analysis

The vulnerability in CVE-2026-42897 is tied to improper neutralization of input during web page generation in Microsoft Exchange Server. According to Microsoft’s public explanation, an attacker can exploit the flaw by sending a specially crafted email to a user, which then executes attacker-controlled JavaScript in the browser when the message is opened in OWA and the required interaction conditions are met. In practical terms, the CVE-2026-42897 payload is the malicious email content itself rather than a dropped binary or server-side implant.

For security teams performing CVE-2026-42897 analysis, one key limitation is the current lack of deep public exploit detail. There is no public CVE-2026-42897 poc in the cited sources, and Microsoft has not published packet-level or forensic CVE-2026-42897 iocs. That means CVE-2026-42897 detection is more likely to rely on identifying exposed on-prem OWA deployments, monitoring suspicious email-driven browser activity, and verifying that Microsoft’s emergency mitigation has been applied across all eligible Exchange servers.

Explore Detections

CVE-2026-42897 Mitigation

Microsoft’s immediate CVE-2026-42897 mitigation guidance is to rely on the Exchange Emergency Mitigation Service, which applies protection automatically through a URL Rewrite configuration and is enabled by default on supported on-prem Exchange deployments. Microsoft says administrators should ensure the Windows service is enabled if it has been turned off. The company also states that this mitigation is a temporary measure while a permanent fix is being prepared.

If the Exchange Emergency Mitigation Service cannot be used, such as in air-gapped environments, Microsoft instructs administrators to deploy the latest Exchange On-premises Mitigation Tool (EOMT) and apply the CVE-specific mitigation either per server or across all Exchange servers through Exchange Management Shell. In practice, to Detect CVE-2026-42897 exposure, organizations should inventory all internet-facing on-prem Exchange systems, confirm whether the emergency mitigation was applied successfully, and prioritize OWA-enabled servers that remain externally reachable without the mitigation in place.

The post CVE-2026-42897: Exchange Server OWA Spoofing Flaw Exploited via Crafted Email appeared first on SOC Prime.

Web infrastructure bugs remain especially dangerous when they sit in widely deployed request-handling logic for years without detection. Among the latest vulnerabilities impacting NGINX Plus and NGINX Open, the CVE-2026-42945 vulnerability stands out as an 18-year-old heap buffer overflow in ngx_http_rewrite_module that can be reached by an unauthenticated attacker through crafted HTTP requests and may lead to denial of service or, in some cases, remote code execution. Public reporting cites a CVSS v4 score of 9.2 and refers to the issue as NGINX Rift.

From a defender’s perspective, the most important details for CVE-2026-42945 are the affected configuration pattern and patch path. Public CVE-2026-42945 analysis shows the flaw is exposed when a rewrite directive uses an unnamed PCRE capture such as $1 or $2, includes a replacement string with a question mark, and is followed by another rewrite, if, or set directive in the same scope.

CVE-2026-42945 analysis

At the technical level, the vulnerability in CVE-2026-42945 is caused by inconsistent escaping logic in the rewrite engine. Depthfirst explains that NGINX computes the destination buffer length under one set of assumptions and then copies data under another, so bytes derived from the attacker-controlled URI can run past the allocated heap buffer in the worker process.

In practical terms, the public CVE-2026-42945 payload is not a dropped binary or script, but a specially crafted HTTP request that reaches a vulnerable rewrite rule and triggers deterministic heap corruption. F5 says this can restart the worker process, while public reporting adds that code execution may also be possible, particularly on systems where ASLR is disabled.

The disclosure is notable because a technical write-up and root-cause explanation were released alongside the advisory, and depthfirst explicitly says its full analysis includes a CVE-2026-42945 poc and patch walkthrough. At the same time, the vendor and researcher materials state they were not aware of in-the-wild exploitation at disclosure.

Exposure is broad because CVE-2026-42945 affects NGINX Open Source versions 0.6.27 through 1.30.0 and NGINX Plus R32 through R36. The nginx security advisories page also lists additional affected F5 and NGINX products built around the same codebase, while fixed open source releases are 1.30.1 and 1.31.0.

Explore Detections

CVE-2026-42945 Mitigation

The priority for CVE-2026-42945 mitigation is to upgrade to a fixed release. For NGINX Open Source, that means moving to 1.30.1 or 1.31.0. For NGINX Plus, the fixes were introduced in R32 P6 and R36 P4. Depthfirst also recommends restarting NGINX after the upgrade so worker processes reload the patched binary.

To Detect CVE-2026-42945 exposure, defenders should review NGINX configurations for rewrite directives that combine unnamed captures with a replacement string containing ?, followed by rewrite, if, or set in the same scope. This is the most practical starting point for CVE-2026-42945 detection, because the flaw depends on a specific and common configuration pattern rather than simply the presence of NGINX alone.

If immediate patching is not possible, F5 and depthfirst both advise replacing unnamed captures like $1 and $2 with named captures in every affected rewrite directive. There are no vendor-published CVE-2026-42945 iocs in the cited materials, so defenders should focus on version inventory, configuration review, unexpected worker restarts, and suspicious HTTP request patterns hitting vulnerable rewrite logic.

The post CVE-2026-42945: 18-Year-Old NGINX Rewrite Flaw May Enable Unauthenticated RCE appeared first on SOC Prime.