From Zero-Days to Decades-Old Flaws: A Week of Active Exploitation Across the Threat Landscape

Another week, another reminder that the clock is always ticking for defenders. As attackers continue to move faster than patches can be deployed, this week's additions to CISA's Known Exploited Vulnerabilities catalog highlight just how relentless and unpredictable the threat landscape truly is.  

CISA added nine vulnerabilities to its KEV catalog this week, reflecting continued active exploitation across a range of vendors. Two flaws affecting SonicWall SMA1000 appliances were added after being confirmed as actively exploited zero-days, while two Microsoft vulnerabilities were also added following confirmed zero-day exploitation, both of which Microsoft addressed in its July Patch Tuesday update. An Oracle vulnerability was likewise added to the catalog, having already been patched by Oracle as part of its May 2026 update. Additionally, vulnerabilities affecting Balbooa Forms and KNX Association were added to the KEV catalog, underscoring ongoing exploitation risk in widely used components. Notably, CISA also added a 2008 Cisco vulnerability, highlighting that even legacy, long-known flaws continue to be actively exploited in the wild and remain a priority for remediation.

Building on observations from the previous week, Storm-2603, a sophisticated, financially motivated threat actor continued actively exploiting a critical SharePoint Server remote code execution vulnerability to compromise enterprise environments, maintaining rapid weaponization capabilities alongside persistence sustained through legitimate remote access tools and secondary implant deployment. Similarly, the suspected China-aligned cluster UNK_MassTraction continued its coordinated campaign against physics and engineering departments at U.S. and Canadian universities, still leveraging cross-tenant access vulnerabilities and unauthenticated code execution flaws in Roundcube mailservers to maintain network footholds and pivot into sensitive research and academic infrastructure. In parallel, Cisco Talos Intelligence continued tracking UAT-7810, a China-nexus APT actor still developing and deploying its custom five-malware arsenal aimed at compromising unpatched networking devices and expanding Operational Relay Box infrastructure - continuing to enable associated threat actors to launch downstream attacks against high-value targets, reinforcing the ongoing convergence of supply-chain compromise tactics with critical infrastructure targeting observed in prior weeks.

Key points:

• Microsoft, SonicWall, Cisco, iCagenda, Oracle E-Business Suite, Balbooa Forms and KNX Association vulnerabilities added to the CISA KEV catalog.
• Storm-2603 actively exploited critical SharePoint Server RCE vulnerability to compromise enterprise environments.
• UNK_MassTraction conducted coordinated campaign targeting US and Canadian university physics departments by exploiting Roundcube mailserver vulnerabilities.
• UAT-7810 deployed custom five-malware arsenal targeting unpatched networking devices to establish Operational Relay Box infrastructure.

Several high-impact vulnerabilities are currently trending across the cybersecurity community, demanding immediate attention and patch prioritization. Monitoring these emerging and widely discussed threats provides valuable insights, enabling organizations to make informed security decisions and strengthen their overall defense posture.

CVE-2026-15409 - Server-Side Request Forgery vulnerability in SonicWall SMA1000 Appliances

A Server-Side Request Forgery (SSRF) vulnerability in SonicWall SMA1000 enables a remote unauthenticated attacker to force affected appliances to make requests to unintended locations, potentially facilitating further compromise. The vulnerability affects SMA1000 models 6210, 7210, and 8200v running vulnerable 12.4.x and 12.5.x releases, and has been addressed in 12.4.3-03453 (platform-hotfix) and later, and 12.5.0-02835 (platform-hotfix) and later. SonicWall confirmed that the vulnerability is being actively exploited as a zero-day, based on investigations into multiple real-world incidents, and released indicators of compromise (IOCs) to help administrators identify affected systems, including suspicious requests to /api/login, /api/logout, and /wsproxy, unexpected route entries, and evidence of hotfix rollback activity. Organizations are advised to immediately upgrade to the latest hotfix, investigate systems for published IOCs, re-image or redeploy compromised appliances, rotate administrator and user credentials, and reset MFA tokens where compromise is suspected. The vulnerability has also been added to the CISA KEV Catalog, emphasizing the need for immediate remediation.

CVE-2026-15410 - Code Injection vulnerability in SonicWall SMA1000 Appliances

A Code Injection vulnerability in SonicWall SMA1000 enables a remote authenticated administrator to execute arbitrary operating system commands under specific conditions, potentially resulting in complete appliance compromise. The vulnerability affects SMA1000 models 6210, 7210, and 8200v running versions 12.4.3-03245, 12.4.3-03387, 12.4.3-03434 (platform-hotfix), 12.5.0-02283, 12.5.0-02624, and 12.5.0-02800 (platform-hotfix), and has been addressed in versions 12.4.3-03453 and later, and 12.5.0-02835 and later. According to SonicWall, the vulnerability has been actively exploited as a zero-day, with multiple confirmed incidents observed in the wild. Administrators are advised to review indicators of compromise, including suspicious /api/login, /api/logout, and /wsproxy requests, unexpected route entries in conf.json, and rollback-related entries in ctrl-service.log, and to re-image or redeploy compromised appliances, rotate all user and administrator credentials, and reset TOTP tokens where compromise is detected. The specific exploitation technique and threat actor remain undisclosed. The recent inclusion of this vulnerability in the CISA KEV catalog highlights its active exploitation and the elevated risk it poses to unpatched deployments.

CVE-2026-46817 - Improper Privilege Management vulnerability in Oracle E-Business Suite

An Improper Privilege Management vulnerability in Oracle E-Business Suite allows an unauthenticated attacker with network access over HTTP to compromise the Oracle Payments component, potentially resulting in complete takeover of the payment-processing infrastructure. Oracle E-Business Suite is a comprehensive enterprise resource planning (ERP) platform that integrates critical business functions, while Oracle Payments manages payment processing across financial applications, banks, and payment networks. The vulnerability affects Oracle E-Business Suite versions 12.2.3 through 12.2.15 and was addressed by Oracle in its May 2026 Critical Patch Update. According to Defused Cyber, the vulnerability was actively exploited shortly after disclosure, with attacks observed against Oracle E-Business honeypots despite the absence of any publicly available proof-of-concept, indicating the use of custom exploit tooling by sophisticated threat actors. Shadowserver also identified more than 450 internet-exposed Oracle E-Business Suite instances, highlighting a significant attack surface across enterprise environments. The vulnerability has since been added to the CISA KEV Catalog, reflecting confirmed in-the-wild exploitation and reinforcing the need for organizations to prioritize remediation of affected Oracle deployments.

CVE-2026-48939 - Unrestricted Upload of File with Dangerous Type vulnerability in iCagenda

An Unrestricted Upload of File with Dangerous Type vulnerability in iCagenda allows unauthenticated attackers to upload arbitrary files through the component's frontend event submission feature, leading to remote code execution (RCE) on vulnerable Joomla installations. The flaw affects iCagenda versions 3.2.1 through 3.9.14 and all 4.x releases up to and including 4.0.7. According to MySites.guru, the vulnerability stems from the absence of server-side validation for uploaded file types and extensions, allowing attacker-controlled PHP files to be written directly to a web-accessible directory and executed remotely. Researchers also identified a secondary authorization bypass that enables unauthenticated users to submit events by interacting directly with the backend processing endpoint, bypassing "registered users only" restrictions. Active exploitation was confirmed on 15 June 2026, when automated attack tools were observed uploading and executing malicious PHP web shells on vulnerable systems, indicating exploitation before a security update was available and classifying the flaw as a zero-day. Public proof-of-concept (PoC) exploits are available, and the vulnerability has been added to the CISA KEV Catalog, reinforcing the need for immediate patching and compromise assessment.

CVE-2026-56155 - Insufficient Granularity of Access Control vulnerability in Microsoft Active Directory Federation Services

An Insufficient Granularity of Access Control vulnerability in Microsoft Active Directory Federation Services (AD FS) allows an authenticated attacker to elevate privileges locally by exploiting inadequate access control enforcement. Microsoft Active Directory Federation Services (AD FS) is an enterprise identity solution that enables single sign-on (SSO) and federated authentication by issuing and validating security tokens across organizational boundaries. According to Microsoft, CVE-2026-56155 is actively exploited as a zero-day, with confirmed in-the-wild exploitation occurring prior to the release of a security update. The vulnerability was identified by Microsoft's Detection and Response Team (DART) during incident response activities, although Microsoft has not disclosed the specific exploitation technique or the level of privileges obtained by attackers. Microsoft has released a security update to remediate the issue and recommends immediate patching of affected AD FS deployments. The vulnerability has also been added to the CISA KEV Catalog, underscoring the urgency of applying the security update and monitoring affected systems for signs of compromise.

CVE-2026-56164 - Missing Authentication for Critical Function vulnerability in Microsoft SharePoint Server

A Missing Authentication for Critical Function vulnerability in Microsoft SharePoint Server allows an unauthenticated attacker to elevate privileges over the network without requiring valid credentials or user interaction. The vulnerability affects SharePoint Server Subscription Edition, SharePoint Server 2019, and SharePoint Enterprise Server 2016. Microsoft SharePoint Server is an on-premises collaboration and content management platform widely used for document management, intranet portals, and enterprise workflows. According to Microsoft, CVE-2026-56164 is actively exploited as a zero-day, with the vulnerability identified by Mandiant Incident Response and Google's FLARE team during investigations into real-world attacks. CISA confirmed that threat actors chain CVE-2026-32201, CVE-2026-45659, and CVE-2026-56164 to compromise on-premises SharePoint deployments, steal IIS machine keys, execute deserialization-based attacks, establish persistence, and deploy malware. Microsoft has released security updates for all supported SharePoint versions and recommends immediate deployment, particularly as SharePoint Server 2016 and 2019 have reached end of extended support with no Extended Security Updates (ESU) program available. The vulnerability has been added to the CISA KEV Catalog, highlighting the urgency of patching and conducting compromise assessments on affected SharePoint environments.

CVE-2026-56291 - Unrestricted Upload of File with Dangerous Type vulnerability in Balbooa Forms

An Unrestricted Upload of File with Dangerous Type vulnerability in Balbooa Forms allows unauthenticated remote attackers to upload arbitrary executable files, resulting in remote code execution (RCE) on vulnerable Joomla installations. Affecting Balbooa Forms version 2.4.0 and earlier, the vulnerability resides in the extension's frontend attachment upload functionality, which fails to enforce authentication, CSRF token validation, or file type restrictions before processing uploaded files. According to MySites.guru, attackers can abuse the vulnerable index.php?option=com_baforms&task=form.uploadAttachmentFile endpoint to upload malicious PHP files into web-accessible directories, where they are subsequently executed by directly accessing the uploaded file. Technical analysis revealed that the application derived the file extension directly from user-supplied input, sanitized only the filename using Joomla's File::makeSafe() function, and wrote the file to the images/baforms/uploads/form-<id>/ directory without implementing an extension allow-list or preventing PHP execution. The vulnerability was identified after a hosting provider reported suspicious activity on a compromised Joomla website, with subsequent log analysis and proof-of-concept testing confirming the complete attack chain. Balbooa addressed the issue by releasing version 2.4.1 on 9 July 2026, eliminating the insecure upload behavior and providing a secure upgrade path for affected users. Public proof-of-concept (PoC) exploits are available, and the vulnerability has been added to the CISA KEV Catalog following confirmed active exploitation in the wild, emphasizing the need for immediate patching and compromise assessment of affected systems.

CVE-2023-4346 - Overly Restrictive Account Lockout Mechanism vulnerability in KNX Association KNX Protocol Connection Authorization Option 1  

An Overly Restrictive Account Lockout Mechanism vulnerability in the KNX Protocol Connection Authorization Option 1 allows an attacker to permanently lock vulnerable KNX devices by purging existing configurations and setting a Building Control Unit (BCU) key that cannot be reset without the original password. KNX is a widely adopted building automation protocol used to manage lighting, HVAC, security, and other smart building systems across residential, commercial, and industrial environments. Devices implementing KNX Connection Authorization Option 1 are affected, enabling attackers with network access - or physical access where applicable - to take control of vulnerable devices and render them inaccessible, potentially disrupting building automation operations. Although the vulnerability was actively exploited in 2023, it has recently been added to the CISA KEV catalog, reflecting its continued security relevance and emphasizing the need for organizations using affected KNX deployments to implement available mitigations and strengthen access controls.

CVE-2008-4128 - Cross-Site Request Forgery vulnerability in Cisco IOS

A Cross-Site Request Forgery (CSRF) vulnerability in Cisco IOS 12.4 Mainline allows remote attackers to execute arbitrary commands by tricking authenticated administrators into sending crafted requests to the device's web management interface. Successful exploitation enables attackers to invoke privileged commands, including show privilege and alias exec, through specific HTTP URIs, potentially resulting in unauthorized command execution and compromise of device configuration. Cisco IOS Mainline is the primary release train of Cisco's Internetwork Operating System for routers and switches, widely deployed across enterprise and service provider environments before reaching end-of-life. Although Cisco IOS 12.4 Mainline has been retired and is no longer supported, the vulnerability remains a significant risk for organizations continuing to operate legacy deployments. Cisco recommends upgrading affected devices to a supported IOS release or mitigating exposure by disabling unnecessary web management interfaces and restricting administrative access. The vulnerability has been recently added to the CISA KEV Catalog following confirmed active exploitation, highlighting the continued targeting of unsupported legacy infrastructure by threat actors.

Cytellite telemetry captured active exploit attempts and mass scanning campaigns against exposed services globally. The data highlights which vulnerabilities are under attack and provides source IPs and payloads to authorized teams for detailed threat analysis and validation.

Active malware campaigns exploited specific vulnerabilities to deliver payloads and carry out post-exploitation actions. Each targeted vulnerability is proactively monitored, manually analysed, and mapped to MITRE ATT&CK tactics and techniques. Insights are derived from the LOVI vulnerability intelligence platform, which aggregates and curates data from multiple sources, OSINT groups, blogs, and data leak sites.

Critical SharePoint RCE Vulnerability Exploited by Storm-2603

According to Rescana, CVE-2026-45659 is a critical remote code execution vulnerability affecting Microsoft SharePoint server rooted in improper deserialization of untrusted data that enabled authenticated attackers with Site Member permissions to execute arbitrary code by sending crafted requests containing malicious serialized payloads, resulting in the vulnerability added to the CISA KEV catalog following confirmed active exploitation in early July 2026. The exploitation was attributed to sophisticated financially motivated and ransomware groups including the Storm-2603 group, characterized by rapid weaponization of newly disclosed vulnerabilities, use of legitimate remote administration tools such as Velociraptor, Cloudflare Tunnels, Zoho Assist, and SSH via Visual Studio Code for persistence and lateral movement. Post-exploitation activities observed in the wild included privilege escalation through creation of new local or domain administrator accounts, exploitation of vulnerable drivers like NSecKrnl.sys to disable security solutions, and deployment of custom backdoors using DLL side-loading and defense evasion techniques. Victims spanned government, healthcare, finance, education, and critical infrastructure sectors globally, with no specific geographic or industry targeting, indicating opportunistic exploitation of any unpatched SharePoint Server instance regardless of organization size or sector. Microsoft released security updates for SharePoint Enterprise Server 2016, SharePoint Server 2019, and SharePoint Server Subscription Edition to resolve the vulnerability, requiring immediate patching across affected installations combined with comprehensive audits of SharePoint permissions, monitoring for indicators of compromise including suspicious remote access tools and administrator account creation, and implementation of least privilege access controls.

UNK_MassTraction Campaign Targeting University Physics Departments of US and Canadian universities

Since May 2026, Proofpoint Threat Research tracked UNK_MassTraction, a suspected China-aligned threat cluster, exploiting multiple n-day vulnerabilities in Roundcube mailservers belonging to physics and engineering departments of US and Canadian universities, leveraging CVE-2024-42009 (cross-site scripting vulnerability) to execute malicious JavaScript inside victim browsers and steal credential information including usernames, passwords, two-factor authentication material, and cookies stored in browser sessions. The campaign deployed IceCube, a fully-featured Roundcube stealer payload that escaped iFrame instantiation through DOM traversal to gain access to the complete document object model and authentication sessions, then utilized CVE-2025-49113 (PHP deserialization vulnerability) to install SquareShell webshell at plugins/newmail_notifier/mail_preview.php for remote code execution capabilities on the compromised mailserver. If webshell deployment failed, the infection chain deployed a fallback shell script that executed an architecture-dependent ELF loader (SNOWLIGHT) to establish VShell backdoor for interactive shell access and port-forwarding features enabling network pivoting. UNK_MassTraction demonstrated mature operational tradecraft by deliberately crafting the infection chain to avoid detection through cleanup of local storage, removal of forensic evidence from Roundcube servers, deferred trigger monitoring of user actions, and abuse of Roundcube mailservers as edge devices to pivot into target networks rather than targeting mailserver contents directly. The attribution assessment indicated UNK_MassTraction was likely China-aligned based on access to covert VPS infrastructure networks shared by multiple China-aligned threat actors, usage of VShell malware, presence of Chinese language artifacts in phishing emails, and targeting patterns consistent with espionage-motivated operations against US and Canadian universities with national security or theoretical physics research ties.

Talos Intelligence Uncovers UAT-7810's Targeting Networking Devices for ORB Infrastructure

Cisco Talos Intelligence reported that UAT-7810, a China-nexus advanced persistent threat actor, continued developing and deploying custom malware to build and maintain Operational Relay Box (ORB) networks that enabled associated secondary threat actors to conduct malicious attacks against high-value targets by primarily exploiting known vulnerabilities in unpatched Ruckus wireless routers: CVE-2020-22653, CVE-2020-22658, CVE-2023-25717 and ASUS AiCloud Routers CVE-2025-2492. The threat actor's malware arsenal included SHORTLEASH, the original custom backdoor capable of C2 communication and tunnel management; LONGLEASH, a significantly enhanced successor featuring advanced proxy functionality for HTTP, DNS, SOCKS, TCP, ICMP, and UDP, along with capabilities to remove implants if tampering was detected; DOGLEASH, a passive C-based backdoor that bound to ports and executed arbitrary commands through hardcoded password-protected mechanisms; JARLEASH, a Java-based administrator tool deployed for file management, FTP, SFTP, and Netcat access with configuration files containing Simplified Chinese comments; and LEASHTEST, a testing binary for rudimentary MIPS-based embedded device functionality verification. Talos discovered four new servers hosting these malware variants across multiple hardware platforms including MIPS, ARM, and x64 architectures, with the infrastructure demonstrating UAT-7810's active development and deployment operations, while the organization's opportunistic, financially motivated behavior prioritized high-yield exploitation targets through scripted playbooks with minimal human interaction, establishing ORB networks that functioned as intermediate command-and-control infrastructure for broader threat operations across compromised networking devices.

Open-Source Software (OSS) vulnerabilities are security weaknesses discovered in publicly available codebases that can be exploited across widely used libraries, frameworks, and tools, often impacting thousands of downstream applications.

PRE-NVD vulnerabilities refer to security flaws that are discovered, discussed, or even exploited in the wild before their official inclusion in the National Vulnerability Database (NVD). These early-stage vulnerabilities often emerge through threat actor chatter, exploit proof-of-concepts, and technical disclosures shared across social media platforms and underground forums, signaling potential exploitation risks before public awareness.

Taken together, this week's developments - spanning newly cataloged KEV vulnerabilities and sustained adversary campaigns underscore that both fresh zero-days and legacy flaws remain equally attractive to attackers, with public proof-of-concept exploits already available for most of them, further lowering the barrier to exploitation. Organizations that delay patching, even on decades-old systems, risk becoming the next entry in an incident report. Staying ahead of this pace demands continuous, enriched visibility rather than periodic review cycles which is exactly where LOVI, Loginsoft's Vulnerability Intelligence platform, adds value, correlating CVE data with EPSS, CISA-KEV, and real-time threat intelligence to help teams prioritize and mitigate before attackers gain the upper hand.

‍FAQs:

1) What is Microsoft Active Directory Federation Services (ADFS)?

Active Directory Federation Services (AD FS) is a Microsoft identity solution that provides single sign-on access to systems and applications across organizational boundaries. AD FS issues and signs security tokens that establish trust between an organization and external services, enabling federated authentication.

2) What is Cisco IOS?

Cisco IOS Mainline refers to the primary, standard release train of Cisco's Internetwork Operating System for routers and switches. It receives regular feature updates and bug fixes during its active support period, before being phased into maintenance and eventually marked obsolete once superseded by newer trains.  

3) Does inclusion in the CISA KEV catalog mean exploitation is widespread?

Not necessarily widespread - but confirmed. KEV inclusion indicates verified in-the-wild exploitation. While the scale may vary, the operational reality is that threat actors possess working exploits, making patch prioritization urgent regardless of observed targeting volume.

4) How does LOVI help organizations manage vulnerabilities effectively?

Loginsoft Vulnerability Intelligence empowers you to efficiently prioritize and respond to potential vulnerabilities by focusing on those actively exploited in the wild. LOVI correlates vulnerability data with real-world threat activity to reduce noise and improve decision-making. This approach enables faster remediation and stronger security posture.

5) What is Cytellite?

Cytellite is a Loginsoft security intelligence platform that provides real-time visibility into emerging threats through a global sensor network. It delivers actionable IP intelligence to help organizations detect, analyze, and respond to attacks quickly. By correlating threat data with live activity, Cytellite strengthens resilience across dynamic threat landscapes.