Eight KEV Additions and a Third APT: Enterprise Infrastructure Tested on Every Front

Attackers spent this week probing the seams of enterprise infrastructure, and they found plenty, turning newly disclosed weaknesses in kernels, VPN gateways, and web platforms into active campaigns before many teams could react.  

CISA added eight vulnerabilities to its Known Exploited Vulnerabilities catalog, including three flaws in the Linux kernel with no public details on how they were being exploited in the wild, two affecting Check Point products, and one each in F5 BIG-IP APM, Arista VeloCloud Orchestrator, and Zyxel GS1900 series switches. Beyond the catalog, active exploitation was detected across Roundcube Webmail, WordPress Core, and the Orkes Conductor workflow platform, with attackers moving on some flaws within hours of public disclosure.

On the espionage front, Volexity extended its earlier research into UTA0560 and JungleBamboo by uncovering a third Chinese APT actor tracked as UTA0565 chaining the same Chrome and Windows zero-day vulnerabilities. This actor distinguished its campaigns through typosquatted fake websites impersonating media organizations and NGOs, ultimately deploying the previously undocumented CLEANGULP backdoor against its targets.

Key highlights of the week:

• Eight vulnerabilities added to CISA KEV catalog.
• Roundcube Webmail, WordPress Core, and Orkes Conductor saw active exploitation beyond the KEV additions.
• UTA0565 emerged as a third Chinese APT chaining the same Chrome and Windows zero-days to deploy CLEANGULP backdoor.

Several high-impact vulnerabilities are currently trending across the cybersecurity community, demanding immediate attention and patch prioritization. Monitoring these emerging and widely discussed threats provides valuable insights, enabling organizations to make informed security decisions and strengthen their overall defense posture.

CVE-2026-7273 - Stack-Based Buffer Overflow vulnerability in Zyxel GS1900 Series Switches

A Stack-Based Buffer Overflow vulnerability in Zyxel GS1900 Series Switches resided in the CGI program responsible for handling HTTP requests on the GS1900-48HPv2 web management interface, allowing a LAN-based unauthenticated attacker to execute operating system commands via a crafted HTTP request. The CGI binary processed attacker-controlled HTTP input without enforcing proper bounds checking on a stack-allocated buffer, allowing adjacent stack memory including saved return addresses and control data to be overwritten when input exceeded the expected size, and because the component was reachable before authentication, an attacker on the local or adjacent network segment could trigger the overflow without credentials or user interaction, achieving command execution in the context of the CGI process that typically ran with elevated privileges and granting control over switching configuration, traffic mirroring, and potentially the entire underlying operating system. GreyNoise discovered the first publicly documented case of in-the-wild exploitation as of September 17, 2026, attributing the novel exploit targeting Zyxel GS1900 Smart Managed Switches globally to a suspected Chinese-speaking malicious cyber actor (MCA) operating in the UTC+8 timezone based on operational timelines and extensive Chinese-language comments within custom tools and scripts, with the MCA assessed as the same or related to Red Heron previously reported by Acronis based on shared command-and-control domains, a common malware family, exploitation of Gitea in July, and overlapping tactics, techniques, and procedures. Zyxel already patched the vulnerability on June 16, advising customers to upgrade firmware for optimal protection, but had not yet updated its advisory to reflect the confirmed active exploitation, and the flaw was added to the CISA KEV catalog recently.

CVE-2026-48842 - SQL Injection vulnerability in Roundcube Webmail

A Pre-Authentication SQL Injection vulnerability in the Roundcube Webmail virtuser_query plugin stemmed from a preg_replace() backslash escape bypass, allowing unauthenticated attackers to inject arbitrary SQL statements across Roundcube Webmail 1.6.x prior to 1.6.16 and 1.7.x prior to 1.7.1 in deployments using the plugin. The virtuser_query plugin resolved email addresses to mailbox usernames by substituting user-supplied values into a configured SQL query template and attempted to neutralize injection using preg_replace() with backslash escaping, but attackers bypassed the sanitization by crafting input containing backslash sequences that defeated the regex-based escape, allowing raw SQL fragments to reach the database driver, and because the affected code path executed during login or account lookup, no valid credentials were required to trigger it. Although Roundcube addressed the issue in releases 1.6.16 and 1.7.1 published on May 24, 2026, the Canadian Centre for Cyber Security has now detected active exploitation of the vulnerability in the wild, urging administrators to apply the updates immediately to secure their email infrastructure.

CVE-2026-53266 - Out-of-Bounds Write vulnerability in Linux Kernel

An Out-of-Bounds Write vulnerability in the Linux kernel ebtables SNAT target allowed an ARP sender hardware address rewrite to write directly into a nonlinear socket-buffer fragment backed by a splice-imported file page, enabling a local attacker to trigger unintended system behavior, denial of service, or local privilege escalation. According to the NVD, the ebtables SNAT target intentionally kept the Ethernet source address rewrite behind skb_ensure_writable since the Ethernet header was addressed through skb_mac_header while skb->data pointed at the Ethernet payload, but the optional ARP sender hardware address rewrite differed by writing through skb_store_bits at an offset relative to skb->data, where skb_header_pointer only safely read the ARP header without making the later sender hardware address range writable. When that range remained held in a nonlinear skb fragment backed by a splice-imported file page, skb_store_bits mapped the fragment page and copied the new MAC address directly into it, corrupting memory belonging to unrelated kernel objects or user-space mappings. The Linux kernel resolved the flaw by ensuring the ARP sender hardware address range was writable before reading the ARP header and calling skb_store_bits, patching it upstream on June 25 and backporting the fix across supported stable and distribution branches, with the vulnerability included in the CISA KEV catalog recently.

CVE-2026-58138 - Unauthenticated Remote Code Execution in Orkes Conductor workflow platform

An Unauthenticated Remote Code Execution vulnerability in Orkes Conductor versions 3.21.21 before 3.30.2 allowed remote attackers to execute arbitrary operating system commands by submitting inline workflow definitions containing malicious JavaScript or Python expressions to the workflow API endpoint prior to authentication. Because vulnerable evaluators could be configured with unrestricted host access, attackers escaped the intended scripting environment and executed arbitrary operating system commands with the privileges of the Conductor process, targeting susceptible Conductor servers through crafted workflow definitions submitted to the Conductor workflow API. Fortinet observed active exploitation of CVE-2026-58138 in the wild, blocking 1,290 attack attempts within a 24-hour span as of September 9, 2026, representing a 132% increase in daily activity, with nearly 7,000 attempts blocked between September 2 and 9, 2026, and the majority of activity originating from Germany, Hong Kong, Indonesia, the U.A.E., and India. Orkes addressed the vulnerability in Conductor 3.30.2 and later, advising organizations unable to patch immediately to restrict external access to Conductor workflow API endpoints, place Conductor instances behind appropriate network access controls, and monitor for suspicious workflow submissions and unexpected command execution.

CVE-2026-85102 - Improper Certificate Validation vulnerability in Check Point Multiple Products

An Improper Certificate Validation vulnerability in Check Point Security Gateway and Spark Firewall allowed an unauthenticated remote attacker to execute arbitrary code on the Gateway, stemming from improper validation of certificate data during VPN negotiation across Check Point Security Gateway versions R81.20, R82, and R82.10 and Spark Firewall versions R81.10.x and R82.00.x, alongside multiple end-of-support releases. Successful exploitation granted complete administrative control over affected gateways during session establishment, enabling unauthorized actors to penetrate internal network zones and access confidential corporate data, presenting severe risks given the role of network security appliances as the primary defensive barrier against perimeter incursions. The Dutch National Cyber Security Centre (NCSC) warned of active exploitation, assessing both the likelihood of exploitation and potential impact as high and anticipating imminent exploitation attempts, though no public proof-of-concept exploit was reported at the time of the advisory. Check Point addressed the vulnerability by releasing fixed builds in support article sk1000171 alongside guidance on mitigation, threat hunting, and indicators of compromise, advising administrators to disable implied VPN rules and restrict UDP ports 500 and 4500 to specific peer IP addresses for manual mitigation on Site-to-Site VPNs, with the flaw subsequently added to the CISA KEV catalog following confirmation of active exploitation.

CVE-2026-87902 - Unauthenticated Path Traversal vulnerability in WordPress Core

An Unauthenticated Path Traversal vulnerability in WordPress Core rendered the platform vulnerable to Local File Inclusion via the locate_template() function across various versions up to and including 7.1.1, where the function resolved a caller-supplied template name against the theme directories without verifying the result stayed within them, allowing a template name containing '..' to resolve to a readable PHP file outside the active theme and be included. The core-reachable vector was get_page_template(), which built page-{$pagename}.php from the URL-derived, url-decoded 'pagename' query variable, enabling unauthenticated attackers to make page-template resolution include a chosen readable local .php file outside the theme directories, leading to remote code execution under certain conditions. Exploitation required the active parent or child theme to contain a top-level directory whose name began with 'page-' such as 'page-templates' in Twenty Twelve, Twenty Fourteen, Neve, Hestia, and Sydney, alongside a readable .php target accessible to the web-server account such as pearcmd.php with register_argc_argv enabled as found in the official PHP Docker image and default cPanel setups on PHP below 8.5, which yielded remote code execution. With a public proof-of-concept available, the vulnerability came under active exploitation within hours of public disclosure, with Wordfence blocking 548,369 attacks targeting the flaw within a 24-hour period. WordPress addressed the vulnerability in version 7.1.2, backporting fixes across all supported branches down to 4.7.37, and urged administrators to update immediately given the absence of any separate workaround.

CVE-2026-93616 - Path Traversal vulnerability in Check Point Multiple Products

A Path Traversal vulnerability in Check Point Security Management Server, Multi-Domain Security Management Server, Log Server, Multi-Domain Log Server, and SmartEvent allowed an unauthenticated attacker to upload and execute arbitrary scripts, stemming from the management server web service's failure to properly limit which files and folders a request could reach across versions R81.20, R82, R82.10, and R82.20, alongside multiple end-of-support releases. Successful exploitation enabled an attacker with access to the server's web service to execute scripts without authentication, granting a direct path to arbitrary script execution on affected management infrastructure. The advisory did not name the targets of the July attacks or identify the attackers, nor did it disclose what actions the attackers took after exploiting the flaw. Check Point addressed the vulnerability by releasing fixed builds in support article sk1000171 alongside detailed patch information and guidance on mitigation, threat hunting, and indicators of compromise, and the flaw was included in the CISA KEV catalog after active exploitation was confirmed in the wild.

CVE-2026-93952 - Improper Input Validation vulnerability in Arista VeloCloud Orchestrator

An Improper Input Validation vulnerability in Arista VeloCloud Orchestrator (VCO) allowed a remote attacker to access privileged internal functionality and impact the VCO host, compromising the confidentiality, integrity, and availability of the orchestrator and its managed data across versions 5.2.3.15 and below in the 5.2.x train, 6.1.3.7 and below in the 6.1.x train, 6.4.2.7 and below in the 6.4.x train, and 7.0.0.2 and below in the 7.0.x train. A compromised VCO could grant attackers access to the Edge devices under its management, with exploitation requiring network access to the VCO web interface and the public part of an Edge's authentication certificate, and the flaw did not depend on settings, exposing VCO by default with no configuration able to prevent it. Arista stated the vulnerability was discovered externally and known to be actively exploited without disclosing when the attacks began or how widespread they were, noting that no single indicator proved compromise but advising review of VCO web access logs for unusual URL-like paths, encoded characters, references to internal services, or high request rates, alongside specific indicators including the files /usr/local/sbin/.vcnode.js, /usr/local/sbin/vc-sysmond (MD5 dc78e206eaeadec59fc5801fe4556bd0), and /etc/systemd/system/vc-sysmon.service, the nginx log header x-vc-opt, and the IP addresses 142.93.149[.]77 and 104.248.126[.]159. Arista addressed the vulnerability in VeloCloud Orchestrator versions 5.2.3.16 and later within the 5.2.3 train and 6.4.2.8 and later within the 6.4.2 train, with fixes for other release trains pending, and recommended post-upgrade incident response including credential rotation, administrator activity review, and restoring the orchestrator from trusted sources, with the vulnerability appearing in the CISA KEV catalog.

CVE-2026-94127 - Heap-Based Buffer Overflow vulnerability in F5 BIG-IP APM

A Heap-Based Buffer Overflow vulnerability in F5 BIG-IP Access Policy Manager (APM) allowed an unauthenticated attacker to perform remote code execution when an access policy and an OAuth profile were configured on the same virtual server, affecting versions 21.1.0, 17.5.0 through 17.5.1, and 17.1.0 through 17.1.3. The vulnerable configuration combined an APM access policy and an OAuth authorization server profile on the virtual server hosting the BIG-IP address receiving OAuth traffic, where specific malicious traffic sent directly to that virtual server could trigger the overflow and lead to remote code execution, rendering management interface restrictions ineffective and leaving BIG-IP systems in Appliance mode affected. F5 identified detection signals including repeated failed UserInfo requests in the APM log indicating an invalid access token, particularly ten or more requests from a single IP within a short window, an unexplained rise in the total_failed OAuth counter, suspicious commands in the audit log around those failures, and TMM entering a loop that caused the SOD daemon to send a SIGABRT. F5 released hotfix packages for the 21.x and 17.x release trains to address the vulnerability, with an emergency iRule mitigation available where immediate patching is not feasible, and CISA added the flaw to its KEV catalog after confirming active exploitation in the wild.

CVE-2025-39682 - Improper Check for Unusual or Exceptional Conditions Vulnerability in Linux Kernel

An Improper Check for Unusual or Exceptional Conditions vulnerability in the Linux kernel TLS receive path allowed a zero-length record retrieved from the rx_list to bypass the intended recvmsg() record-type handling, potentially causing subsequent TLS records to be processed using incorrect zero-copy and queuing assumptions and enabling local authenticated users to trigger memory disclosure or denial of service. According to the NVD, each recvmsg() call was required to process either only contiguous DATA records or a single non-DATA record, breaking out of the main processing loop when the next record differed in type from what had already been processed, with decrypted records queued to the rx_list for the subsequent call to retrieve. Queuing to the rx_list after zero-copy decryption was not possible because decryption wrote directly to the user-space buffer without an available skb to queue, and since only data records were permitted zero-copy with the loop breaking after each non-data record, a type change following zero-copy should never have occurred, with the missed corner case arising when the initial record retrieved from the rx_list carried zero length and left the receive logic in an invalid state. The Linux kernel resolved the vulnerability by fixing the handling of zero-length records on the rx_list, with fixes included in stable kernel releases 6.1.149, 6.6.103, 6.12.44, 6.16.4, and 6.17, and the flaw was added to the CISA KEV catalog.

CVE-2025-39964 - Race Condition vulnerability in Linux Kernel

A Race Condition vulnerability in the Linux kernel allowed concurrent writes to the same AF_ALG socket, causing data to be unpredictably interleaved and creating inconsistencies in the socket's internal state, enabling a local attacker to crash the system or corrupt cryptographic operation results and resulting in denial of service or data integrity issues. According to the NVD, the flaw stemmed from the AF_ALG datapath permitting two simultaneous writes to the same socket, causing request payloads to interleave in an unpredictable fashion and leaving the internal per-socket state inconsistent. The Linux kernel resolved the vulnerability by introducing a new ctx->write field that enforced exclusive write ownership, ensuring only one writer could issue sendmsg() at a time and preventing state corruption, with the fix landing in mainline commit 1b34cbbf4f011a (6.17-rc7) and backported across supported distribution branches through vendor-specific patches from Red Hat, Ubuntu, Debian, Oracle Linux, Amazon Linux, and SUSE, and no reliable mitigation available beyond applying the kernel update. Following confirmation of active exploitation, the vulnerability was catalogued by CISA in its KEV list.

Cytellite telemetry captured active exploit attempts and mass scanning campaigns against exposed services globally. The data highlights which vulnerabilities are under attack and provides source IPs and payloads to authorized teams for detailed threat analysis and validation.

Active malware campaigns exploited specific vulnerabilities to deliver payloads and carry out post-exploitation actions. Each targeted vulnerability is proactively monitored, manually analysed, and mapped to MITRE ATT&CK tactics and techniques. Insights are derived from the LOVI vulnerability intelligence platform, which aggregates and curates data from multiple sources, OSINT groups, blogs, and data leak sites.

UTA0565's typosquatted websites deploy shared zero-day exploit chain and CLEANGULP backdoor

According to Volexity, in a continuation of its previously published research documenting UTA0560 and JungleBamboo chaining Chrome and Windows zero-day exploits, a third Chinese APT actor tracked as UTA0565 exploited the same chained vulnerabilities (CVE-2026-85046, CVE-2026-87491, and CVE-2026-85880) on September 3-4, 2026, distinguishing its campaigns by using multiple fake websites that typosquatted legitimate media organizations, an NGO, halal restaurant search sites, and corporate training organizations to deceive victims. UTA0565 delivered phishing emails masquerading as entities including the Center for American Progress and content supporting an imprisoned Hong Kong activist, redirecting victims to spoofed domains that loaded a hidden iframe containing the exploit chain, which downloaded chrome_cleanup.exe in-process, removed its Mark of the Web, and launched it via COM. The final payload belonged to a previously undocumented malware family tracked as CLEANGULP, written in C and heavily obfuscated through control flow flattening and indirect calls, which installed itself to %LOCALAPPDATA% as MicrosoftIME.exe, established persistence through a scheduled task, and supported commands including shell execution, process listing, file upload and download, and beacon object file execution while communicating with a typosquatted C2 domain over AES-256-GCM encrypted HTTP traffic. Volexity assessed the widespread adoption of the same exploit kit across multiple Chinese threat actors as indicative of a coordinated effort within the Chinese computer network exploitation community, where the core kit was likely shared, customized, and weaponized by separate groups.

Open-Source Software (OSS) vulnerabilities are security weaknesses discovered in publicly available codebases that can be exploited across widely used libraries, frameworks, and tools, often impacting thousands of downstream applications.

PRE-NVD vulnerabilities refer to security flaws that are discovered, discussed, or even exploited in the wild before their official inclusion in the National Vulnerability Database (NVD). These early-stage vulnerabilities often emerge through threat actor chatter, exploit proof-of-concepts, and technical disclosures shared across social media platforms and underground forums, signaling potential exploitation risks before public awareness.

The week's activity underscored a landscape where kernel-level flaws, perimeter appliance compromises, and rapidly weaponized web vulnerabilities converged to keep defenders under sustained pressure, with several exploits arriving within hours of public disclosure. As nation-state actors like UTA0565 refined their tradecraft and opportunistic attackers swept newly patched flaws in WordPress Core and Orkes Conductor, the shrinking gap between disclosure and exploitation left little room for delayed remediation. Organizations that rely on reactive patching alone remain perpetually exposed, and the difference between a contained event and a full-scale intrusion increasingly depends on timely, contextualized intelligence. Loginsoft Vulnerability Intelligence (LOVI) bridges that gap by delivering structured vulnerability intelligence, threat actor campaign profiling, and real-time exploitation tracking that empowers security teams to prioritize actively weaponized flaws and act before adversaries reach scale.

FAQs

1)  How did UTA0565 differ from the previously documented Chinese APT actors exploiting the same Chrome and Windows zero-days?

Unlike UTA0560 and JungleBamboo, UTA0565 distinguished its campaigns by using multiple typosquatted fake websites impersonating legitimate media organizations, an NGO, halal restaurant search sites, and corporate training organizations, and deployed the previously undocumented CLEANGULP backdoor rather than GRIMWEDGE or LONGTALE, while sharing the same underlying exploit kit.

2) What connects the Zyxel GS1900 switch exploitation to broader threat activity this week?

GreyNoise attributed the in-the-wild exploitation of the Zyxel GS1900 stack-based buffer overflow to a suspected Chinese-speaking malicious cyber actor assessed as the same or related to Red Heron, based on shared command-and-control domains, a common malware family, and overlapping tactics, linking the switch attacks to the same actor previously documented exploiting Gitea vulnerabilities.

3) Does inclusion in the CISA KEV catalog mean exploitation is widespread?

Not necessarily widespread - but confirmed. KEV inclusion indicates verified in-the-wild exploitation. While the scale may vary, the operational reality is that threat actors possess working exploits, making patch prioritization urgent regardless of observed targeting volume.

4) How does LOVI help organizations manage vulnerabilities effectively?

Loginsoft Vulnerability Intelligence empowers you to efficiently prioritize and respond to potential vulnerabilities by focusing on those actively exploited in the wild. LOVI correlates vulnerability data with real-world threat activity to reduce noise and improve decision-making. This approach enables faster remediation and stronger security posture.

5) What is Cytellite?

Cytellite is a Loginsoft security intelligence platform that provides real-time visibility into emerging threats through a global sensor network. It delivers actionable IP intelligence to help organizations detect, analyze, and respond to attacks quickly. By correlating threat data with live activity, Cytellite strengthens resilience across dynamic threat landscapes.