Active Exploitation, Ransomware, and Espionage on One Attack Surface

This week placed edge infrastructure and enterprise platforms squarely in the crosshairs, as zero-day exploitation, opportunistic vulnerability abuse, and state-sponsored espionage converged across a single reporting window. The Cybersecurity and Infrastructure Security Agency (CISA) expanded its Known Exploited Vulnerabilities catalog with four new entries, spanning analytics, operating system, network security, and load balancing products. The additions included a Metabase SQL injection vulnerability, a Microsoft Windows Ancillary Function Driver for WinSock flaw actively exploited as a zero-day, a Cisco Secure Firewall denial-of-service vulnerability, and a Progress Kemp LoadMaster command injection flaw.

Beyond the catalog additions, active exploitation surfaced across several other high-value enterprise targets. Threat actors weaponized an authentication bypass vulnerability in Microsoft SharePoint following the rapid release of proof-of-concept code, exploited a directory-traversal flaw in Broadcom VMware vCenter Server to deploy persistence through malicious cron jobs and reverse SSH tooling, and probed an incorrect authorization vulnerability in Adobe Commerce and Magento e-commerce platforms capable of hijacking customer accounts without authentication.

The week also delivered pointed reminders that nation-state and ransomware operators remain relentless and increasingly sophisticated. A joint advisory from CISA, the FBI, and international partners warned of Gunra ransomware exploiting internet-facing Fortinet FortiOS and FortiProxy appliances to breach critical infrastructure sectors through a double extortion model. In parallel, the North Korea-affiliated Lazarus Group exploited a Windows zero-day to gain SYSTEM-level access as part of its long-running Operation Dream Job campaign, luring defense and aerospace targets through fake recruiter outreach before deploying a chain of loaders, rootkits, and backdoors.

Key highlights of the week:

• CISA expanded its KEV catalog with four actively exploited flaws
• Active exploitation surfaced across three additional enterprise platforms
• The Lazarus Group exploited a Windows zero-day for espionage
• A joint CISA, FBI, and international advisory warned of Gunra ransomware

Several high-impact vulnerabilities are currently trending across the cybersecurity community, demanding immediate attention and patch prioritization. Monitoring these emerging and widely discussed threats provides valuable insights, enabling organizations to make informed security decisions and strengthen their overall defense posture.

CVE-2026-8037 - Command Injection vulnerability in Progress LoadMaster

A Command Injection vulnerability in Progress Kemp LoadMaster allowed an unauthenticated attacker to execute arbitrary commands on the appliance by exploiting unsanitized input in multiple command endpoints, with the flaw originating from improper handling of user-supplied input within the escape_quotes() function, where the vulnerable code allocated a heap buffer and failed to null-terminate escaped strings, permitting out-of-bounds reads into adjacent heap memory that an attacker manipulates to inject command content into a shell command executed via system(), reachable through the /accessv2 endpoint when the API is enabled. LoadMaster is a load balancer and application delivery controller that distributes incoming network traffic across multiple backend servers to keep applications available, responsive, and scalable. According to eSentire, the Threat Response Unit identified exploitation attempts beginning on June 29, 2026, the same day functional proof-of-concept exploit code was released, following initial disclosure on June 4, 2026. Public proof-of-concept exploit code is available and demonstrates the technique end to end, abusing single-quote escaping expansion and a JSON-based heap-spraying primitive to smuggle command content into the final shell command and achieve unauthenticated remote code execution. Progress addressed the vulnerability in LoadMaster versions 7.2.63.2 and 7.2.54.18, and the flaw was recently added to the CISA KEV catalog.

CVE-2026-20349 - Heap Inspection vulnerability in Cisco Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD)

A Heap Inspection vulnerability in Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense allowed an unauthenticated, remote attacker to cause an affected device to reload unexpectedly and enter a denial-of-service condition by sending a specially crafted HTTP request to the Remote Access SSL VPN Service, which handles the processing of HTTP requests as part of authenticating and serving remote VPN sessions and is the surface exposed to unauthenticated clients. According to Cisco, the flaw resides in the processing of HTTP requests by the Remote Access SSL VPN service across its enterprise firewall platforms that provide network security, access control, and threat protection. Cisco became aware of active exploitation in August 2026 but has not shared additional information about the attacks, including who is exploiting the flaw or which organizations are being targeted. No workarounds exist for the vulnerability, and Cisco strongly recommends that customers upgrade to a fixed software release to fully remediate the issue. Cisco released hot fixes addressing ASA releases 9.16, 9.18, 9.20, 9.22, 9.23, and 9.24 along with FTD releases 7.0, 7.2, 7.4, 7.6, 7.7, and 10.0, and the flaw was recently added to the CISA KEV catalog.

CVE-2026-55040 - Authentication Bypass vulnerability in Microsoft SharePoint

An Authentication Bypass vulnerability in Microsoft SharePoint, residing in the JWT token validation pipeline, allowed attackers without privileges to bypass authentication through impersonation and perform operations as a SharePoint site user or administrator, disclosing files and modifying data, though the flaw could not impact system availability. Microsoft patched the vulnerability as part of the July 2026 Patch Tuesday updates, warning customers running SharePoint Enterprise Server 2016 and SharePoint Server 2019 to patch their systems and labeled it an attractive target for attackers while stopping short of flagging it as successfully exploited in the wild. Threat intelligence company Defused reported that this vulnerability was already being used in attacks against its SharePoint honeypots. Internet threat watchdog Shadowserver tracked over 8,500 Microsoft SharePoint servers exposed online, though the count of honeypots or already-patched systems among them remained unknown. Public proof-of-concept exploit code is available, underscoring the urgency of applying the July 2026 fixes.

CVE-2026-59310 - Directory-Traversal vulnerability in VMware vCenter server

A Directory-Traversal vulnerability in Broadcom VMware vCenter Server allowed a malicious actor with network access to exploit path traversal and execute arbitrary code on affected systems. According to QUIRSO, threat actors began actively exploiting the recently patched critical flaw following an incident response engagement, with the attack chain exhibiting path traversal activity consistent with the vulnerability, followed by deployment of a malicious cron job to establish persistence on the host using reverse_ssh, an open-source tool used to set up SSH connections to threat actor-controlled infrastructure. Compromised systems first established contact with the attacker's domains on August 3, 2026, five days after Broadcom publicly disclosed the flaw, spanning as many as 361 unique victim IP addresses across 47 countries, most located in Germany, the United States, Turkey, Iran, and France. The strong correlation between disclosure and exploitation timing suggested the disclosure served as the starting point for the campaign, and while attribution remains unclear, the activity is believed to be the work of a suspected advanced persistent threat actor. Broadcom released patches for the flaw in late July 2026.

CVE-2026-68820 - Use-After-Free Vulnerability in Microsoft Windows Ancillary Function Driver for WinSock

A use-after-free vulnerability in the Microsoft Windows Ancillary Function Driver for WinSock allowed an authorized attacker with existing code execution on a target machine to elevate privileges locally to SYSTEM by triggering a race condition within the driver, which is a core kernel-mode driver installed by default on all Windows systems that handles low-level network socket operations for the Winsock API. According to Check Point Research, the flaw was exploited as a zero-day within a renewed Lazarus Operation Dream Job campaign built around fake recruiter outreach against the defense, aerospace, and aviation sectors, using two parallel infection chains. The primary chain relied on DLL sideloading through a trojanized signed PDF viewer that executed the MISTPEN downloader in memory, which then loaded an in-memory privilege escalation module to exploit the driver, deployed the ForestTiger backdoor for long-term access, and ran the FudModule rootkit under SYSTEM privileges to hide activity and disable EDR visibility. Microsoft addressed the vulnerability as part of the August 2026 Patch Tuesday security updates and has not publicly attributed the exploitation. The flaw was recently added to the CISA KEV catalog.

CVE-2026-71362 - Incorrect Authorization vulnerability in Adobe Commerce and Magento e-commerce platforms

An Incorrect Authorization vulnerability in Adobe Commerce and Magento e-commerce platforms potentially allowed attackers to hijack customer accounts and gain elevated access to sensitive resources without authentication. Adobe addressed the flaw as one of seven issues resolved in a recent security update, and while the vendor stated it was not aware of exploits in the wild for any of the fixed flaws, eCommerce security company Sansec reported that its Shield web application firewall was already blocking exploitation attempts, noting that exploitation requires no existing account, administrator privileges, or user interaction. After analyzing the patch, Sansec pinned the problem to Magento improperly handling customer identity in an account session, confirming that the vulnerability lets an attacker switch a customer session to another customer account, thereby gaining access to the victim's account and private customer data. Website administrators must first ensure they are running the latest patch release available for their supported release branch before applying the corresponding isolated patch.

CVE-2026-72898 - SQL Injection vulnerability in Metabase

An SQL injection vulnerability in Metabase, allowed an unauthenticated remote attacker to inject arbitrary SQL into the application database and gain administrator access to the instance, from which the attacker could alter configuration, steal stored credentials for connected databases, read accessible data, and export it. The flaw resided at the /api/session/reset_password endpoint and affected Metabase versions 1.58 and later, tracing to a refactor of the auth_identity module that permitted an undocumented user-id key to survive request processing and reach a HoneySQL query as an unparameterized raw SQL directive. Metabase disclosed the vulnerability on August 6, 2026 as a zero-day exploited against Metabase Cloud, with impacted organizations including Framework, Tally, n8n, Kilo Code, and ChecklyHQ. Public proof-of-concept exploits emerged by August 10, 2026, and around 2,500 exposed instances appeared in Shodan inventory, roughly a quarter of them fully internet accessible. Metabase addressed the vulnerability across multiple release branches in patched builds x.58.24, x.59.21, x.60.17, x.61.11, x.62.9, and x.63.5, and the flaw was recently added to the CISA KEV catalog.

Cytellite telemetry captured active exploit attempts and mass scanning campaigns against exposed services globally. The data highlights which vulnerabilities are under attack and provides source IPs and payloads to authorized teams for detailed threat analysis and validation.

Active malware campaigns exploited specific vulnerabilities to deliver payloads and carry out post-exploitation actions. Each targeted vulnerability is proactively monitored, manually analysed, and mapped to MITRE ATT&CK tactics and techniques. Insights are derived from the LOVI vulnerability intelligence platform, which aggregates and curates data from multiple sources, OSINT groups, blogs, and data leak sites.

Joint advisory warns of Gunra Ransomware exploiting Fortinet appliances across critical sectors

According to CISA, the FBI, and partners from South Korea and the United States, Gunra ransomware attacks target critical infrastructure sectors and organizations worldwide, including healthcare and public health, financial services, government services and facilities, and professional and nonprofit services. Attacks deploying Gunra leverage security flaws in internet-facing Fortinet FortiOS and FortiProxy appliances, tracked as CVE-2024-55591 and CVE-2025-24472, to obtain initial access before deploying the ransomware as part of a double extortion model that combines data exfiltration and data encryption for maximum impact. Victims who refuse to pay within five to seven days have their data published on a data leak site. Gunra has listed a total of 51 victims since emerging in the threat landscape in April 2025, with most located in Australia, East Asia, and Europe, including South Korea, Brazil, Spain, Thailand, and Hong Kong, and only three victims reported across Canada and the United States so far. Gunra represents another variant in the ongoing trend of ransomware attacks causing disruption and harm to organizations internationally.

Lazarus exploits Windows Zero-Day to gain SYSTEM access in Operation Dream Job campaign

According to Check Point Research, a privilege escalation vulnerability in the Microsoft Windows Ancillary Function Driver for WinSock, tracked as CVE-2026-68820, allowed an attacker with existing code execution on a target machine to escalate privileges locally to SYSTEM, and the North Korea-affiliated Lazarus Group exploited it as a zero-day to target defense and aerospace companies across France, Germany, Brazil and India as part of the long-running Operation Dream Job campaign. Victims were lured through fake recruiter messages and tricked into opening a malicious PDF or installing a trojanized PDF viewer across two parallel infection chains. The first relied on DLL side-loading, where a malicious DLL displayed a decoy job description while stealthily executing the MISTPEN downloader in memory, which communicated with attacker infrastructure through the Microsoft Graph API and OneDrive, loaded reconnaissance and privilege escalation modules to trigger the AFD.sys exploit, and deployed the ForestTiger backdoor (also known as ScoringMathTea) for remote access. Successful exploitation granted SYSTEM privileges and enabled execution of the FudModule rootkit, updated to version 3.1 with the ability to tamper with the Windows Smart App Control feature, to hide the attacker's presence and disable security visibility. The second chain used a trojanized SecurityPDF viewer distributed from websites impersonating Enveil, which inspected opened documents for a hidden marker before decrypting and loading the Troy backdoor into memory, a previously undocumented DLL implant supporting seventeen operator commands. Command-and-control ran largely through compromised WordPress and SharePoint sites and Roundcube webmail servers, which the attackers infected with a previously undocumented PHP web shell named RelayShell. Microsoft addressed the vulnerability as part of the August 2026 Patch Tuesday security updates, and the flaw was recently added to the CISA KEV catalog.

Open-Source Software (OSS) vulnerabilities are security weaknesses discovered in publicly available codebases that can be exploited across widely used libraries, frameworks, and tools, often impacting thousands of downstream applications.

PRE-NVD vulnerabilities refer to security flaws that are discovered, discussed, or even exploited in the wild before their official inclusion in the National Vulnerability Database (NVD). These early-stage vulnerabilities often emerge through threat actor chatter, exploit proof-of-concepts, and technical disclosures shared across social media platforms and underground forums, signaling potential exploitation risks before public awareness.

The past week reinforced that adversaries continue to converge on internet-facing infrastructure and widely deployed enterprise platforms, chaining zero-days, authentication bypasses, and injection flaws into footholds that grant administrative control and long-term access. The parallel activity of a nation-state actor like Lazarus and opportunistic ransomware operators like Gunra illustrated that both targeted espionage and broad exploitation now unfold within the same narrow window, leaving defenders little room to react. Organizations that prioritize timely patching, reduce unnecessary internet exposure, and maintain continuous monitoring remained best positioned to limit their risk against these compounding threats. Sustained attention to authoritative sources such as the CISA KEV catalog offered a practical foundation for prioritizing remediation against the vulnerabilities most likely to be weaponized. Loginsoft Vulnerability Intelligence (LOVI) continues to track these developments as they emerge, delivering structured, timely, and actionable intelligence that helps security teams stay ahead of the threats that matter most.

FAQs:

1) What is the Lazarus Group?

The Lazarus Group is a state-sponsored threat actor attributed to North Korea, active since at least 2009 and known for both cyber espionage and financially motivated attacks. It is responsible for high-profile operations including the 2014 Sony Pictures hack, the 2016 Bangladesh Bank heist, the 2017 WannaCry ransomware outbreak, and extensive cryptocurrency thefts used to evade international sanctions. The group operates under many aliases and sub-groups, including APT38 and Hidden Cobra, and continues active campaigns such as Operation Dream Job targeting defense and aerospace sectors.

2) What is Metabase and what does it do?

Metabase is an open-source business intelligence and data analytics platform that lets users query, visualize, and share insights from connected databases. It provides dashboards, charts, and self-service reporting without requiring users to write SQL, making data analysis accessible to non-technical teams. Metabase runs as a self-hosted application or as Metabase Cloud, and connects to backend databases including PostgreSQL, MySQL, MariaDB, and H2.

3) Does inclusion in the CISA KEV catalog mean exploitation is widespread?

Not necessarily widespread - but confirmed. KEV inclusion indicates verified in-the-wild exploitation. While the scale may vary, the operational reality is that threat actors possess working exploits, making patch prioritization urgent regardless of observed targeting volume.

4) How does LOVI help organizations manage vulnerabilities effectively?

Loginsoft Vulnerability Intelligence empowers you to efficiently prioritize and respond to potential vulnerabilities by focusing on those actively exploited in the wild. LOVI correlates vulnerability data with real-world threat activity to reduce noise and improve decision-making. This approach enables faster remediation and stronger security posture.

5) What is Cytellite?

Cytellite is a Loginsoft security intelligence platform that provides real-time visibility into emerging threats through a global sensor network. It delivers actionable IP intelligence to help organizations detect, analyze, and respond to attacks quickly. By correlating threat data with live activity, Cytellite strengthens resilience across dynamic threat landscapes.