Threat Intelligence Briefing

Tuesday, August 25, 2026 | Jonathan Brown

Zimbra exploitation expands, but the 274 figure requires precision

CVE-2026-73570 is an actively exploited command-injection flaw in Zimbra Collaboration Suite before version 10.1.20. The vulnerable path requires the optional zimbra-snmp package, SNMP notifications enabled, and the swatchdog monitor running. A specially crafted SMTP request can then execute operating-system commands as the zimbra user without authentication. CISA added the flaw to its Known Exploited Vulnerabilities catalog on August 21; its August 24 federal remediation date has passed.

Shadowserver reported that its August 22 scan found 274 IP addresses carrying artifacts it classifies as probable CVE-2026-73570 compromise, including 41 in the United States. That is strong incident-response telemetry, but it is not the same as 274 organizations receiving individual forensic confirmation. Shadowserver also counted at least 8,200 unpatched instances while cautioning that not all were exploitable because the required configuration is not the default.

Upgrade to Zimbra 10.1.20 or later and treat an exposed, correctly configured vulnerable server as a potential incident, not merely a patch ticket. CERT Polska recommends searching /var/log/zimbra.log for Service status change entries containing an unexpected payload and checking for files created by the zimbra user during the previous 30 days under /opt/zimbra/jetty/webapps/, /opt/zimbra/jetty_base/webapps/, and /tmp/.

Watch for: Unexpected Service status change payloads; new web-accessible files owned by zimbra; suspicious SMTP requests; shell activity or persistence created under the Zimbra service account.

Sources: CERT Polska advisory; Zimbra 10.1.20 release; NVD record; Shadowserver telemetry; CISA notice

CISA puts a CVSS 10 Oracle proxy flaw on a three-day clock

CVE-2026-21962 is an improper-access-control flaw in Oracle HTTP Server and the Oracle WebLogic Server Proxy Plug-in for Apache HTTP Server and Microsoft IIS. It is not a vulnerability in WebLogic Server core. Oracle lists supported affected versions 12.2.1.4.0, 14.1.1.0.0, and 14.1.2.0.0; the IIS plug-in is affected only at 12.2.1.4.0.

Oracle rates the issue CVSS 10.0. An unauthenticated remote attacker can reach it over HTTP and, on successful exploitation, read, create, delete, or modify critical or all accessible data. Oracle's vector assigns high confidentiality and integrity impact but no availability impact, so defenders should not silently translate this advisory into a generic remote-code-execution claim.

CISA added the flaw to its Known Exploited Vulnerabilities catalog on August 24 and set August 27 as the remediation date for covered federal agencies. That establishes known exploitation, but the public Oracle and CISA material does not identify an actor, attack volume, exploit chain, or indicators. Apply Oracle's January 2026 Critical Patch Update, inventory every Apache and IIS front end using the plug-in, and review HTTP, content, configuration, and downstream-application records for unauthorized access or data changes.

Watch for: Unauthenticated request anomalies at Oracle HTTP Server or its Apache/IIS proxy plug-in; unexplained content or configuration changes; abnormal reads, creates, deletes, or modifications in proxied applications.

Sources: Oracle January 2026 risk matrix; CISA August 24 notice; CISA KEV entry

Keycloak password-reset bypass enables unauthenticated account takeover

CVE-2026-18963 is a critical flaw in Keycloak's reset-credentials flow. Improper state validation allows an unauthenticated remote attacker to bypass the emailed action-token step and directly set new credentials for any user. Red Hat scores the issue 9.1, with no privileges or user interaction required and high confidentiality and integrity impact.

Upstream Keycloak fixed the issue in version 26.7.2. Red Hat shipped corrected Red Hat build of Keycloak releases 26.4.15 and 26.6.6 for its supported lines. If an immediate upgrade is impossible, Red Hat's temporary mitigation is to turn off Forgot password in every realm. Neither the Red Hat CVE page nor the upstream release notice cites observed in-the-wild exploitation, so this is a critical exposure finding rather than evidence that a deployment has been breached.

Prioritize internet-facing identity providers and realms where password recovery is enabled. Review password-reset and credential-creation events, especially for privileged users, and correlate them with the expected recovery workflow and source. If suspicious activity appears, revoke active sessions and tokens, reset affected credentials through a trusted channel, and examine applications federated to the account.

Watch for: Password changes without a matching expected recovery flow; new credentials on privileged accounts; recovery bursts across multiple users or realms; subsequent logins from unfamiliar sources.

Sources: Red Hat CVE record; Keycloak 26.7.2 release; Red Hat 26.4.15 advisory; Red Hat 26.6.6 advisory

GitLab GraphQL flaw draws in-the-wild exploit attempts within days

CVE-2026-19478 is a CVSS 9.4 code-injection flaw in self-managed GitLab Community and Enterprise Editions. Under certain conditions, an unauthenticated user can use a GraphQL directive to modify or delete public projects and user data. Affected ranges are all versions from 18.2 before 18.11.11, 19.0 before 19.0.8, 19.1 before 19.1.6, and 19.2 before 19.2.4. GitLab.com and GitLab Dedicated were already patched.

WatchTowr told The Hacker News that it reproduced the issue within minutes and observed exploitation against its honeypot network. That confirms hostile attempts in the wild, not a disclosed successful customer compromise. The same GitLab releases also fix CVE-2026-19650, a CVSS 7.1 cross-site request-forgery issue in the GraphQL multiplex query handler; GitLab did not report exploitation of that second flaw.

Upgrade to 18.11.11, 19.0.8, 19.1.6, 19.2.4, or a later supported release. Search web logs for unauthenticated GraphQL requests containing @gl_introduced, then review GitLab audit events and repository state for unexpected deletions or changes to public projects and user data. If patching must be delayed, application owners should validate a temporary restriction on unauthenticated /api/graphql access rather than assume a generic web-application firewall rule is sufficient.

Watch for: Unauthenticated /api/graphql requests containing @gl_introduced; unexplained project deletion or modification; repository state diverging from known-good refs or backups; unexpected user-data changes.

Sources: GitLab critical patch release; watchTowr honeypot reporting via The Hacker News

miniOrange SAML bypasses expose seven WordPress edition lines

CVE-2026-61979 and CVE-2026-15981 are two independently exploitable, unauthenticated authentication bypasses in the miniOrange SAML 2.0 Single Sign On WordPress plugin. The first permits signature-algorithm confusion; the second treats an OpenSSL error return as successful verification. Either flaw can allow a forged SAML assertion to create a session as an existing WordPress user, including an administrator. They do not need to be chained.

On August 16, DigitalOcean detected an administrator session from outside its trusted network. Patchstack reports that the attacker had already obtained an administrator cookie through the bypass, but DigitalOcean's network restriction blocked administrator operations. This is attempted exploitation with partial technical success, not a confirmed takeover of the site. Patchstack also observed opportunistic scanning and noted a public proof of concept for free editions, but it did not establish a broad compromise count.

The minimum releases that close both flaws are Free single-site 5.4.5; Premium single-site 13.0.4; Standard single-site 17.0.6; Premium, Enterprise, or All-Inclusive multisite 20.2.8; Enterprise or All-Inclusive single-site 26.0.3; VIP single-site 32.0.8; and VIP multisite 35.0.7. Paid editions may not present a normal WordPress update prompt, and cross-line upgrades can require a manual plugin upload. After updating, hunt for administrator sessions outside expected networks, new users, theme or plugin changes, and server-side files created after suspicious access.

Watch for: Authenticated administrator sessions from unexpected sources; SAML logins that do not match identity-provider records; newly created users; unfamiliar plugins, themes, scheduled tasks, or PHP files.

Sources: Patchstack and DigitalOcean technical analysis

A Calix residential gateway exposes UPnP control on the WAN

CVE-2026-75501 affects the Calix GS7 XGS GS5239XG residential gateway running EXOS/6.6.47, the specific model and firmware tested by the researcher. Its MiniUPnPd 2.3.7 WANIPConnection SOAP service is exposed by default on the public WAN interface at TCP port 5000 and accepts requests without authentication.

A remote attacker can query, add, delete, and enumerate NAT port mappings, allowing new forwarding rules to bypass the gateway's NAT and firewall protections and expose internal devices. CERT/CC could not reach Calix during coordination, lists the vendor status as unknown, and had no vendor patch or statement at publication. No exploitation was reported in the note, and the finding should not be generalized to every Calix model or firmware release.

Disable UPnP where the administration interface permits it. If the setting is locked by the provider, contact the ISP; alternatively, block inbound TCP 5000 at a secondary firewall, on the gateway, or upstream. ISPs should identify the affected customer-premises equipment and configuration, then inspect for unexpected port mappings and newly exposed cameras, storage devices, or other internal services.

Watch for: Internet reachability on TCP 5000; unsolicited WANIPConnection SOAP requests; unexplained NAT mappings; internal devices becoming reachable from the public internet.

Sources: CERT/CC Vulnerability Note VU#756733

Two Spring advisories warrant focused engineering review, not blanket panic

CVE-2026-59285 is a high-severity unsafe-deserialization issue in Spring for GraphQL 2.0.0 through 2.0.4. Remote code execution is possible only when all four conditions are present: Spring for GraphQL, Jackson 2.x, an exposed paginated Connection field, and exploitable classes on the application classpath. The fixes are open-source release 2.0.5 and enterprise release 2.0.4.1.

CVE-2026-59318 is a medium-severity Spring AI tool-calling flaw. Under certain conditions, the dispatcher can invoke a tool that was not advertised in the current request's tool list, allowing prompt injection to cross an intended boundary and potentially escalate privilege. Affected versions are 2.0.0, 1.1.0 through 1.1.8, and 1.0.0 through 1.0.9. Fixes are open-source 2.0.1 and enterprise releases 2.0.0.1, 1.1.9, and 1.0.10. Neither Spring advisory reports observed exploitation.

For GraphQL, confirm the complete four-part exposure condition and patch rather than treating every Spring service as remotely exploitable. For Spring AI, compare globally registered tools with each request's intended tool set, remove unused privileged tools, and enforce authorization inside the tool implementation. A model-visible tool list is not a substitute for a server-side authorization check.

Watch for: Malformed paginated GraphQL queries followed by deserialization failures or unusual process behavior; AI requests that dispatch tools absent from the request-scoped list; privileged tool calls arising from untrusted prompt content.

Sources: Spring advisory for CVE-2026-59285; Spring advisory for CVE-2026-59318

DoFun Android head-unit updater delivers proxy-botnet malware

Kaspersky reports the first documented malware infection chain built specifically for Android-based automotive head units. Observed in June, the multi-stage downloader was installed through the legitimate TWCore system application, package com.tw.core, which handles analytics and software updates in DoFun head-unit firmware. Kaspersky telemetry showed the malicious application being installed by that package.

The observed payloads supported advertising fraud and a reverse-proxy botnet. Kaspersky attributes the operation to MoYu Group with high confidence based on naming and infrastructure overlap with BADBOX activity. That remains a vendor-research attribution, not independent proof of operator identity. DoFun told Kaspersky it had fixed the security issues, but the report provides no affected-device count or complete model list and describes no manipulation of vehicle safety systems.

Device makers, distributors, and managed fleets should verify firmware provenance and update-channel authorization, inventory DoFun/TWCore deployments, and use the report's hashes, domains, and detection names. Investigate the com.tw.jar1 package or JarService, unexpected applications installed by com.tw.core, periodic command-and-control traffic, and the zhima reverse-proxy module.

Watch for: New applications installed by com.tw.core; com.tw.jar1 or JarService; roughly 90-minute command-and-control polling; connections to the report's proxy and malware infrastructure.

Sources: Kaspersky Securelist technical report

Long-lived leaked AWS keys remain valid at alarming rates

Truffle Security says it re-verified 10,616 publicly leaked AWS access-key pairs on August 10 and found that 9,308, or 88 percent, still authenticated. It classified 817 live keys as business-linked and found 768 with full control: 526 root keys and 242 IAM-user keys carrying the managed AdministratorAccess policy. Authentication does not by itself prove unrestricted capability or prior malicious use, and the report does not claim that every live key was abused.

The study began with 431,875 public findings deduplicated to 64,024 unique keys across 50,654 accounts. The 10,616-key recheck used read-only metadata calls; researchers say they did not read policy documents, cloud resources, or customer data and did not modify anything. In the subset of 2,903 keys that permitted ListAccessKeys, the median age was 1,831 days and 86 percent had no newer sibling key. The work accompanied a Truffle Security product launch, and no independent replication was identified before publication, so the figures should be attributed to the researchers rather than presented as an AWS census.

Search current and historical source repositories, CI logs, container layers, package registries, and public datasets. Removing a secret from a file does not revoke it: disable and delete the AWS credential, eliminate root access keys, rotate affected IAM credentials, and review CloudTrail from the earliest plausible exposure through revocation. Hunt for new principals, access keys, roles, trust-policy changes, and unusual API activity before declaring containment.

Watch for: API calls from new networks or user agents; creation of users, keys, roles, or federation paths; altered trust or identity policies; access to unfamiliar regions or services after the leak date.

Sources: Truffle Security research; AWS access-key guidance

npm mirrors are being used as trusted-looking phishing hosts

OX Security identified 24 npm packages containing the same fake Cloudflare verification page. Installing the packages does not execute the page or compromise the developer machine. The confirmed abuse is architectural: public mirrors can render an HTML file from a package on a trusted HTTPS domain, turning services such as unpkg, Yarn-linked mirrors, npmmirror, and Tencent mirrors into front-end hosting for phishing content.

Earlier samples contacted a typosquatted Microsoft domain. Later samples retrieved encrypted remote configuration through api.keyval.org, a legitimate key-value service that is not malicious by itself. At the time of OX's check, the remote logic redirected users to the legitimate ChatGPT site. The chain could be reconfigured for ClickFix or conventional phishing, but the report does not establish that the current configuration was delivering a ClickFix payload. OX said the packages generally accumulated 50 to 300 weekly downloads before removal, while several were still listed as live on August 25.

Do not block an entire mirror solely on this finding. Add full mirror URLs and package paths to phishing analysis, inspect direct .html requests under mirrored package directories, and detonate the rendered content to resolve its remote configuration. Treat copy-and-paste command prompts as the execution boundary and preserve the package name, version, full URL, redirect chain, and remote configuration for investigation.

Watch for: Fake Cloudflare verification pages rendered from package paths; direct .html requests to npm mirrors; browser requests to remote configuration services immediately afterward; instructions asking users to paste commands into a shell or Run dialog.

Sources: OX Security research

Jonathan Brown is a cybersecurity researcher and investigative journalist at bordercybergroup.com.

If you would like to support our work — useful, well-researched, ad-free cybersecurity intelligence — subscribe, comment, or buy us a coffee! Thanks.