Faster Than the Fix: Six KEV Additions, Cross-Platform Exploitation, and the Rise of AI-Driven Attacks

This week made one thing clear: the window between disclosure and exploitation has all but closed, and attackers moved faster than patch cycles across enterprise, open-source, and AI infrastructure alike. From federal catalog additions to a Mirai-bred botnet and an AI-orchestrated intrusion campaign, the activity spanned the full spectrum of the modern threat landscape.

CISA expanded its Known Exploited Vulnerabilities catalog with six additions this week, underscoring confirmed abuse across widely deployed platforms. The entries spanned an MLflow flaw, an Apple vulnerability, two from Microsoft, one in Broadcom VMware, and one in Ray Project, cutting across AI tooling, operating systems, virtualization, and distributed compute.

Beyond the KEV additions, active exploitation surfaced across a further set of platforms. Attackers targeted Citrix NetScaler ADC and NetScaler Gateway, the User Profile Builder plugin for WordPress, SAP Commerce Cloud, New API, and Zimbra Collaboration Suite, with several campaigns striking within days, and in some cases hours, of public disclosure or patch release.

On the malware and threat-actor front, two developments stood out. Evooo1Bot, a Mirai-derived Linux botnet, weaponized Internet-facing edge devices into stealthy proxy relays and DDoS nodes, while a Chinese-speaking actor tracked as knaithe (KnYuan) paired autonomous AI-driven attacks with hands-on manual exploitation, signaling the growing operational maturity of AI-assisted offensive campaigns.

Key highlights of the week:

• CISA added six vulnerabilities to its KEV catalog
• Active exploitation hit Citrix NetScaler, the User Profile Builder WordPress plugin, SAP Commerce Cloud, New API, and Zimbra.
• Evooo1Bot turned edge devices into proxy relays, while actor knaithe (KnYuan) paired autonomous AI attacks with manual exploitation.

Several high-impact vulnerabilities are currently trending across the cybersecurity community, demanding immediate attention and patch prioritization. Monitoring these emerging and widely discussed threats provides valuable insights, enabling organizations to make informed security decisions and strengthen their overall defense posture.

CVE-2026-8452 - Memory Overflow vulnerability in Citrix NetScaler ADC and NetScaler Gateway

A Memory Overflow vulnerability resided in Citrix NetScaler ADC and NetScaler Gateway, the enterprise appliances that handled load balancing, SSL VPN, and remote access at the network perimeter for large organizations, and could lead to denial of service. According to WatchTowr Labs, the flaw constituted a pre-authentication heap overflow in the nsppe packet-processing engine, exploitable when the appliance operated as a SAML Service Provider or Identity Provider, with WatchTowr attributing it tentatively since Citrix does not correlate individual CVEs to specific bugs. The root cause lay in SAML signature validation, where NetScaler copied attacker-controlled data from a signed SAML message into a fixed-size buffer without verifying that the data fit, so an oversized input overflowed the buffer, corrupted adjacent engine state, and crashed nsppe, the engine that ran as root. WatchTowr escalated the crash to full pre-authentication remote code execution, ultimately dropping a webshell and obtaining root-level command execution on the appliance, aided by the absence of standard memory protections in the affected binary. Citrix addressed the flaw in a security update on June 30, 2026 via bulletin CTX696604, with fixed builds NetScaler ADC and Gateway 14.1-72.61 and 13.1-63.18 and later; a public proof of concept subsequently emerged and active exploitation followed.

CVE-2026-15826 - Authentication Bypass via Type Confusion vulnerability in The User Profile Builder Plugin for WordPress

An Unauthenticated Authentication Bypass via Type Confusion vulnerability resided in the User Profile Builder plugin for WordPress, developed by Cozmoslabs and running on more than 40,000 active installations, in all versions up to and including 3.16.4, and could lead to full account takeover. According to Wordfence, the root cause resided in the wppb_log_in_user() function, which called absint() on the return value of wp_insert_user() before performing an is_wp_error() check, so submission of a registration request carrying a username of 61 to 70 characters caused WordPress core to reject the account creation and return a WP_Error object that the premature absint() call coerced to the integer 1, leading the plugin to treat the failed registration as user ID 1. As a result, the plugin bound and returned a transient-backed autologin nonce tied to user ID 1, the account that typically corresponded to the site Administrator, so a specially crafted registration form returned an Administrator autologin token to an unauthenticated attacker and granted authentication as the Administrator, resulting in full administrative takeover. Exploitation depended on a specific configuration, remaining possible only on sites with the "Automatically Log In after Registration" setting enabled, after which a successful takeover permitted an attacker to view and export user data, alter site settings, install plugins or themes, and perform further administrator actions. Cozmoslabs addressed the flaw in version 3.16.5; a public proof of concept subsequently emerged, active exploitation followed with Wordfence blocking 98 attacks targeting the vulnerability in a 24-hour period, and immediate updating to 3.16.5 or later remained advised.

CVE-2026-33824 - Double Free vulnerability in Microsoft Internet Key Exchange (IKE) Service Extensions

A Double Free vulnerability resided in the Microsoft Windows Internet Key Exchange (IKE) Extension, the IPsec-stack component that negotiated IPsec Security Associations and managed the cryptographic key exchanges underpinning VPN connectivity over UDP ports 500 and 4500 (NAT-T), and permitted an unauthenticated attacker to execute arbitrary code over a network. The condition surfaced during parsing of malformed IKE messages, where the memory-management routines mistracked the state of allocated buffers and, on encountering specific error conditions, freed a buffer that an earlier cleanup routine had already released, corrupting the underlying heap metadata. Exploitation proceeded entirely over the network without authentication or user interaction, a property that sharply raised the risk in enterprise environments exposing IKE services to untrusted traffic. Delivery of specially crafted UDP packets to port 500 or 4500 triggered the double free during message parsing, and a typical sequence sent malformed IKE_SA_INIT or IKE_AUTH messages, drove the corruption through carefully timed packet sequences, and leveraged the resulting heap corruption to achieve code execution with SYSTEM-level privileges, positioning the attacker for complete compromise of the host. Microsoft addressed the flaw in the April 2026 Patch Tuesday update; a public proof of concept subsequently emerged, and CISA added the vulnerability to its KEV catalog.

CVE-2026-55040 - Weak Authentication vulnerability in Microsoft SharePoint

A Weak Authentication vulnerability resided in the JWT token validation pipeline of Microsoft SharePoint, allowing unprivileged attackers to bypass authentication through impersonation and act as a SharePoint site user or administrator, disclosing files and modifying data, though the flaw carried no impact on system availability. Microsoft addressed the vulnerability as part of the July 2026 Patch Tuesday updates and urged customers running SharePoint Enterprise Server 2016 and SharePoint Server 2019 to patch, characterizing the flaw as an attractive target for attackers while stopping short of confirming exploitation in the wild. Defused reported that the vulnerability was already being leveraged in attacks against its SharePoint honeypots, indicating attacker interest ahead of any formal exploitation confirmation. Shadowserver tracked more than 8,500 Internet-exposed SharePoint servers, though the proportion of honeypots or already-patched systems within that count remained unknown. Public proof-of-concept exploit code emerged, and CISA subsequently added the vulnerability to its KEV catalog, reinforcing the urgency of applying the July 2026 fixes.

CVE-2026-58231 - Improper Authorization and Input Validation vulnerability in SAP Commerce Cloud

An Improper Authorization and Input Validation vulnerability resided in SAP Commerce Cloud, formerly SAP Hybris, the enterprise e-commerce platform from SAP for building and running online storefronts at scale, and allowed an unauthenticated attacker to abuse a default authentication client and submit specially crafted input to certain functions that lacked sufficient validation. Successful exploitation enabled arbitrary code execution and compromised internal components, resulting in high impact on the confidentiality, integrity, and availability of the application. Onapsis confirmed the same outcome and directed customers to patch to the fixed Commerce Cloud release levels referenced in the SAP note and to rebuild and redeploy the updated version, alongside a temporary workaround that reduced exposure by configuring an IP Filter Set to restrict access to the vulnerable endpoint. Defused Cyber observed exploitation attempts against honeypot systems merely three days after the release of the patch, noting that the vulnerability carried no public proof of concept and had not been known to be exploited prior to that discovery, while KEVIntel independently confirmed exploitation efforts, detecting two attempts on August 14 from a single U.S.-based IP address. SAP released patches on August 11, 2026, and no details emerged on the identity of the actors behind the exploitation efforts.

CVE-2026-59310 - Path Traversal vulnerability in Broadcom VMware vCenter

A Directory Traversal vulnerability resided in Broadcom VMware vCenter Server, allowing a malicious actor with network access to exploit path traversal and execute arbitrary code on affected systems. According to QUIRSO, threat actors began actively exploiting the recently patched critical flaw following an incident response engagement, with the attack chain exhibiting path traversal activity consistent with the vulnerability, followed by deployment of a malicious cron job that established persistence using reverse_ssh, an open-source tool that set up SSH connections to threat-actor-controlled infrastructure. Compromised systems first contacted the attacker's domains on August 3, 2026, five days after Broadcom disclosed the flaw, spanning as many as 361 unique victim IP addresses across 47 countries, concentrated in Germany, the United States, Turkey, Iran, and France. The close correlation between disclosure and exploitation timing indicated that the disclosure served as the starting point for the campaign, and while attribution remained unclear, the activity was assessed as the work of a suspected advanced persistent threat actor. Broadcom released patches in late July 2026, and CISA subsequently added the vulnerability to its KEV catalog.

CVE-2026-64849 - Server-Side Request Forgery vulnerability in MLflow

An Unauthenticated Server-Side Request Forgery (SSRF) vulnerability resided in the webhook delivery mechanism of MLflow, the open-source platform maintained by the MLflow project for managing the machine-learning and AI development lifecycle, in all versions prior to 3.15.0. The unauthenticated POST /api/2.0/mlflow/webhooks/{id}/test endpoint validated only the original, attacker-supplied webhook URL through _validate_webhook_url(), while the delivery logic followed HTTP redirects and re-resolved the hostname without pinning the validated address, creating a time-of-check to time-of-use gap between the validated and connected destinations. Exploitation required no authentication, privileges, or user interaction, a condition worsened by default Tracking Server deployments running without authentication, and proceeded by registering a webhook to a controlled HTTPS endpoint that passed validation and then returned a 302 redirect to an internal destination such as localhost or the cloud metadata service at 169.254.169(.)254. The /test endpoint reflected the upstream response status and body to the caller, producing a full-read SSRF capable of exfiltrating internal service data or cloud instance credentials, with a DNS rebinding variant reaching the same gap. The MLflow project addressed the flaw in version 3.15.0; according to watchTowr, active exploitation followed within hours of disclosure as attackers targeted cloud-hosted MLflow systems to extract credentials and secrets, a public proof of concept emerged, and CISA subsequently added the vulnerability to its KEV catalog.

CVE-2026-65400 - Improper Authentication vulnerability in Apple macOS

An Improper Authentication vulnerability resided in the Screen Sharing component of Apple macOS, allowing an attacker already on the network to authenticate to the built-in remote desktop service without valid credentials across macOS Tahoe prior to 26.6.1, macOS Sequoia prior to 15.7.9, and macOS Sonoma prior to 14.8.9. According to Huntress, the flaw resided in the screensharingd system daemon, which served Screen Sharing over the RFB (Remote Framebuffer) protocol, where a flawed implementation of the Secure Remote Password (SRP) protocol on the native Apple authentication path caused the frame-length validator to return a stale success status, so the connection was treated as authenticated and proceeded as an unauthenticated cleartext session even when legacy VNC authentication was disabled and no local accounts were enabled for access. The bypass abused the privileged SSFileCopySender helper process, which inherited the Apple-signed entitlement kTCCServiceSystemPolicyAllFiles, granting Full Disk Access, bypassing TCC protections, and permitting arbitrary file read and write as root, while standard hardening such as removing allowed accounts, disabling legacy VNC password authentication, and rotating the VNC password produced no effect. Escalation to pre-authenticated remote code execution followed through creation of a LaunchDaemon that triggered an on-disk reverse shell on reboot or modification of a shell startup file such as .zshenv executed on Terminal launch. Apple addressed the flaw on August 6, 2026, across macOS Tahoe 26.6.1, macOS Sequoia 15.7.9, and macOS Sonoma 14.8.9; NCSC-NL subsequently confirmed active exploitation in the wild that obtained root access and deployed a Monero cryptocurrency miner on Internet-exposed hosts running Screen Sharing on TCP port 5900, a public proof of concept emerged, and CISA added the vulnerability to its KEV catalog.

CVE-2026-71479 - Integer Overflow vulnerability in the New API

An Integer Overflow vulnerability resided in New API, the open-source AI API gateway from QuantumNous that unified access to many large-language-model providers behind a single OpenAI-compatible interface and handled billing and quota for the traffic routed through it, in all versions up to and including 1.0.0-rc.17, and let a user with a small balance credit themselves an enormous one. According to QuantumNous, the root cause lay in multiple billing paths that multiplied user-controlled quantity parameters into the quota calculation without an upper bound or overflow-safe conversion, so a crafted extreme value such as an image count of n = 18446744073686646784 (a wrapped-negative value legitimately accepted by a *uint field) caused conversions like int(float64(quota) * n) to wrap past the int64/int32 range into a large negative quota that, at settlement, became equivalent to crediting the account balance. A single low-privilege request therefore generated balance out of nothing, and sustained abuse could drain an operator's prepaid upstream funds and render billing and service unavailable, with logs on exploited instances recording large negative charges such as a single entry of ¥-91,618. Exploitation carried a precondition rather than a zero-balance bypass, requiring an account whose balance at least covered the normal pre-consume amount because the pre-consume gate in NewBillingSession rejected insufficient balance with HTTP 403, though severity escalated on deployments granting free starting balance through check-in rewards, invite rebates, or new-user quota gifts, where self-registration enabled default mass registration and a single crafted request to approximate unauthenticated exploitation. QuantumNous, confirmed exploitation in the wild after a community operator reported active abuse on July 6, 2026, and shipped the emergency fix in version 1.0.0-rc.18 with a public proof of concept present.

CVE-2026-73570 - Remote Code Execution vulnerability in Zimbra Collaboration Suite

An Unauthenticated Remote Code Execution vulnerability resides in Zimbra Collaboration Suite, the email and collaboration platform used by governments, universities, and enterprises worldwide, in all versions before 10.1.20. The flaw stemmed from improper sanitization of untrusted input during SNMP notification processing, so an unauthenticated attacker who sent a specially crafted SMTP request injected attacker-controlled data into operating-system commands executed as the zimbra user, granting arbitrary command execution and a path to plant web shells and read mail. Exploitation carried a specific precondition, affecting only instances with the optional zimbra-snmp package installed and SNMP traps enabled through the snmp_notify parameter, alongside the swatchdog service that ran by default. According to CERT Polska, the flaw came under active exploitation in the wild, and the advisory recommended hunting for unusual service-status-change entries in /var/log/zimbra.log and reviewing files created by the zimbra user within the last 30 days under the Jetty webapps and /tmp directories. Zimbra addressed the flaw in version 10.1.20, and immediate upgrading remained strongly advised.

CVE-2025-62593 - Code Injection vulnerability in Ray-Project Ray

A Code Injection vulnerability resided in Ray, the open-source distributed compute framework maintained by the Ray project for scaling Python and AI workloads across many machines, in all versions prior to 2.52.0, and enabled unauthenticated remote code execution that converted a casual web visit into a full host compromise. Ray exposed job-execution endpoints, including /api/jobs and /api/job_agent/jobs/, without authentication by default, while the dashboard attempted to block browser-originated traffic through a weak guard that tested only whether the User-Agent header began with "Mozilla". The assumption behind that guard proved wrong, as the fetch specification permitted a script to modify the User-Agent header in Firefox and Safari, while Chrome avoided the issue only through a separate out-of-spec behavior. Pairing the guard bypass with a DNS rebinding attack reached the local Ray service and let a malicious website or malicious advertisement send commands to Ray, so a developer running Ray who opened a malicious page allowed arbitrary shell code to execute on the local machine. The Ray project addressed the flaw in version 2.52.0; a public proof of concept subsequently emerged, and CISA added the vulnerability to its KEV catalog.

Cytellite telemetry captured active exploit attempts and mass scanning campaigns against exposed services globally. The data highlights which vulnerabilities are under attack and provides source IPs and payloads to authorized teams for detailed threat analysis and validation.

Active malware campaigns exploited specific vulnerabilities to deliver payloads and carry out post-exploitation actions. Each targeted vulnerability is proactively monitored, manually analysed, and mapped to MITRE ATT&CK tactics and techniques. Insights are derived from the LOVI vulnerability intelligence platform, which aggregates and curates data from multiple sources, OSINT groups, blogs, and data leak sites. ‍

Evooo1Bot: Mirai-Derived Botnet Weaponizing Edge Devices into Stealthy Proxy Relays

According to Fortinet, Evooo1Bot constituted a modular Linux botnet built on leaked Mirai source code, first observed in July 2026 and named for the hardcoded string "evooo1" present in its samples. The botnet spread by exploiting known command-injection and remote code execution flaws in Internet-facing edge devices from vendors including Alcatel, NETGEAR, Tenda, Mitsubishi Electric, Telesquare, and D-Link, and extended reach through an SSH scanner that guessed credentials against enterprise service accounts. Compromise turned each router, firewall, or IP camera into a persistent SOCKS5 proxy relay and a DDoS node, while additional modules delivered credential sniffing, encrypted command-and-control over port 443, and aggressive anti-analysis that abandoned execution inside sandboxes, debuggers, and honeypots. Affected parties spanned any organization operating exposed edge infrastructure rather than a named sector, with the proxy relay capability positioning operators to conceal traffic origin and pivot into private networks. Fortinet telemetry placed observed activity across North America, South America, Europe, and Asia, with China, Japan, and India named specifically.

knaithe (KnYuan): Chinese-Speaking Actor Pairs Autonomous AI Attacks with Manual Exploitation

According to Palo Alto Networks, a Chinese-speaking threat actor operating under the aliases knaithe and KnYuan, based in Zhuhai, China, ran an AI-enabled campaign that combined autonomous AI-driven attacks with manual exploitation across seven vulnerabilities. The actor used DeepSeek through the open-source Hermes Agent framework, orchestrated over Telegram, as an autonomous offensive operator that enumerated targets with FOFA, sourced public exploit code from GitHub, and launched attacks without human intervention, while lightly testing Western tools such as Claude Code and Codex whose provider-side safety controls limited their usefulness for autonomous attacks. When initial exploitation of Langflow failed against restrictive target configurations, the agent independently researched higher-value CVEs and pivoted to n8n, though both autonomous attempts failed due to authentication and configuration requirements, and the confirmed impact came instead from the actor's parallel manual campaign. Manual operations exfiltrated data from three Citrix NetScaler targets, achieved command execution on eleven Marimo notebook instances, and attempted reverse shells against Apache Tomcat and IKE VPN endpoints, with the actor persistently targeting a Malaysian government entity over multiple days using refined parameters and proxy anonymization. Targeting spanned over 460 hosts across three countries and multiple sectors, with the autonomous campaigns aimed indiscriminately at Chinese domestic infrastructure and the operation ultimately exposed when the AI agent inadvertently started a file server in the actor's home directory.

Open-Source Software (OSS) vulnerabilities are security weaknesses discovered in publicly available codebases that can be exploited across widely used libraries, frameworks, and tools, often impacting thousands of downstream applications.

PRE-NVD vulnerabilities refer to security flaws that are discovered, discussed, or even exploited in the wild before their official inclusion in the National Vulnerability Database (NVD). These early-stage vulnerabilities often emerge through threat actor chatter, exploit proof-of-concepts, and technical disclosures shared across social media platforms and underground forums, signaling potential exploitation risks before public awareness.

This week reinforced a hard reality: disclosure now functions as the starting gun for attackers, not a safe head start for defenders. With confirmed exploitation spanning access controllers, e-commerce platforms, WordPress plugins, and AI infrastructure, no software tier remained outside the immediate threat window. The parallel rise of a Mirai-derived botnet and an AI-orchestrated intrusion campaign signaled that both commodity automation and advanced tradecraft are scaling in tandem. Organizations that treat patch release, KEV additions, and exploitation telemetry as triggers for immediate action, rather than waiting on enrichment timelines, will remain the most resilient. Loginsoft Vulnerability Intelligence (LOVI) continues to track these developments daily across CNA disclosures, CISA KEV, and exploitation telemetry, giving security teams the timely, contextualized intelligence needed to act before adversaries do.

FAQs:

1) What makes Evooo1Bot different from a typical Mirai botnet?

While Evooo1Bot is built on leaked Mirai source code, it extends well beyond a standard clone. Alongside the inherited DDoS engine, it turns each compromised router, firewall, or IP camera into a persistent SOCKS5 proxy relay, letting operators conceal traffic origin and pivot into private networks. It adds credential sniffing, an SSH scanner targeting enterprise service accounts, encrypted command-and-control over port 443, and aggressive anti-analysis that abandons execution inside sandboxes, debuggers, and honeypots. Its exploitation of long-unpatched, often end-of-life edge devices, several with no vendor fix available, makes it particularly difficult to remediate through patching alone.

2) Does the knaithe (KnYuan) campaign mean AI can now carry out cyberattacks fully autonomously?

Not entirely, but the gap is narrowing. The actor used DeepSeek through the Hermes Agent framework to autonomously enumerate targets, source exploit code, and launch attacks without human intervention, and the AI successfully reasoned through target selection and pivoted between vulnerabilities on its own. However, the autonomous attempts largely failed against well-configured targets, and the campaign's confirmed impact came from the actor's parallel manual exploitation. The significance lies in the trajectory rather than the outcome: autonomous attack cycles are now operationally viable, the skill barrier is low and falling, and better-defended targets were the main thing standing between attempts and compromise.

3) Does inclusion in the CISA KEV catalog mean exploitation is widespread?

Not necessarily widespread - but confirmed. KEV inclusion indicates verified in-the-wild exploitation. While the scale may vary, the operational reality is that threat actors possess working exploits, making patch prioritization urgent regardless of observed targeting volume.

4) How does LOVI help organizations manage vulnerabilities effectively?

Loginsoft Vulnerability Intelligence empowers you to efficiently prioritize and respond to potential vulnerabilities by focusing on those actively exploited in the wild. LOVI correlates vulnerability data with real-world threat activity to reduce noise and improve decision-making. This approach enables faster remediation and stronger security posture.

5) What is Cytellite?

Cytellite is a Loginsoft security intelligence platform that provides real-time visibility into emerging threats through a global sensor network. It delivers actionable IP intelligence to help organizations detect, analyze, and respond to attacks quickly. By correlating threat data with live activity, Cytellite strengthens resilience across dynamic threat landscapes.