Rapid Weaponization, Credential Theft, and Infrastructure Compromise: This Week's Multi-Threat Attack Campaign

A significant surge in cybersecurity threats emerged this week as the Cybersecurity and Infrastructure Security Agency (CISA) officially cataloged four critical vulnerabilities across widely deployed web development and enterprise platforms, while simultaneously threat researchers documented active exploitation campaigns targeting critical infrastructure. Adobe ColdFusion, PageBuilder CK for Joomla, Langflow AI orchestration platform, and JoomShaper's SP Page Builder were all added to CISA's Known Exploited Vulnerabilities catalog following confirmation of weaponization in the wild, with each vulnerability enabling unauthenticated remote code execution or improper access control on vulnerable installations.  

Beyond CISA's official listings, security researchers confirmed active in-the-wild exploitation of Gitea Docker images through authentication bypass vulnerabilities and the iCagenda extension for Joomla through arbitrary file upload flaws, with automated attack tooling actively harvesting vulnerable installations within hours of patch releases and establishing persistent backdoors on compromised systems.  

The threat landscape expanded further with the discovery that Storm-2603, a sophisticated financially motivated threat actor, actively exploited a critical SharePoint Server remote code execution vulnerability to compromise enterprise environments, demonstrating rapid weaponization capabilities and establishing persistence mechanisms through legitimate remote access tools and secondary implant deployment. Meanwhile, suspected China-aligned threat cluster UNK_MassTraction conducted a coordinated campaign targeting physics and engineering departments of United States and Canadian universities, leveraging cross-tenant access vulnerabilities and unauthenticated code execution flaws in Roundcube mailservers to establish network footholds and pivot into sensitive research and academic infrastructure. In parallel, Cisco Talos Intelligence uncovered UAT-7810, a China-nexus advanced persistent threat actor, actively developing and deploying a custom five-malware arsenal specifically designed to compromise unpatched networking devices and establish Operational Relay Box infrastructure that enables associated threat actors to conduct downstream attacks against high-value targets, demonstrating the convergence of supply-chain compromise tactics with critical infrastructure targeting.

Key points

• Adobe ColdFusion, PageBuilder CK, Langflow, and JoomShaper SP Page Builder vulnerabilities added to CISA KEV catalog
• Gitea Docker images and iCagenda extension for Joomla actively exploited within hours of patch release
• Storm-2603 actively exploited critical SharePoint Server RCE vulnerability to compromise enterprise environments
• UNK_MassTraction conducted coordinated campaign targeting US and Canadian university physics departments by exploiting Roundcube mailserver vulnerabilities
• UAT-7810 deployed custom five-malware arsenal targeting unpatched networking devices to establish Operational Relay Box infrastructure

Several high-impact vulnerabilities are currently trending across the cybersecurity community, demanding immediate attention and patch prioritization. Monitoring these emerging and widely discussed threats provides valuable insights, enabling organizations to make informed security decisions and strengthen their overall defense posture.

CVE-2026-20896 - Authentication Bypass vulnerability in Gitea Docker Image

An Authentication Bypass vulnerability in Gitea Docker images enables any source IP to impersonate users when reverse-proxy authentication headers such as X-WEBAUTH-USER are enabled, affecting versions up to and including 1.26.2. Gitea released version 1.26.3 in June 2026 to resolve this vulnerability. The vulnerability stems from the Gitea Docker image shipping an insecure default configuration hard-coding REVERSE_PROXY_TRUSTED_PROXIES = *, which trusts the X-WEBAUTH-USER HTTP header from any source IP regardless of origin, instead of the documented safe default 127.0.0.0/8,::1/128 that restricts trusted proxies to localhost only. With reverse-proxy login enabled and the vulnerable default configuration in place, any unauthenticated internet client reaching the Gitea container's HTTP port directly can send a malicious X-WEBAUTH-USER header and achieve authentication as any user with known or guessable login names, requiring no password or token. When auto-registration is enabled, attackers immediately obtain administrator-level access by impersonating known admin usernames. Active exploitation of CVE-2026-20896 has been detected, with initial activity originating from a ProtonVPN-associated IP address (159.26.98[.]241) conducting reconnaissance and investigation phases. Approximately 6,200 internet-facing Gitea instances remain exposed to this vulnerability, creating significant attack surface for opportunistic threat actors. The vulnerability manifests only when administrators explicitly enable ENABLE_REVERSE_PROXY_AUTHENTICATION = true while leaving REVERSE_PROXY_TRUSTED_PROXIES at its vulnerable default value. The flaw enables full account takeover of any user, with administrator accounts representing primary targets due to their high-value access and guessable usernames.

CVE-2026-48282 - Path Traversal vulnerability in Adobe ColdFusion

A Path Traversal vulnerability in Adobe ColdFusion's Remote Development Services (RDS) FileServlet component enables unauthenticated attackers to write arbitrary files to disk and achieve remote code execution by bypassing directory restrictions through improper path canonicalization in the FileWriteOperator() method. Affected versions include ColdFusion 2025.9 and earlier, as well as ColdFusion 2023.20 and earlier, with attackers exploiting the vulnerability by sending crafted HTTP POST requests to /CFIDE/main/ide.cfm?ACTION=FILEIO containing RDS protocol payloads that specify target file paths and malicious content, leveraging this capability to upload CFML templates with <cfexecute> tags that execute arbitrary system commands with NT AUTHORITY\SYSTEM privileges. Adobe released security updates resolving the vulnerability through ColdFusion 2025 Update 10 and ColdFusion 2023 Update 21, which enforce canonical path resolution through RdsFileSecurity.resolveCanonical() to block absolute paths, directory traversal sequences, null bytes, and paths resolving outside allowed RDS-accessible directories. The vulnerability has been added to the CISA KEV catalog underscoring the critical urgency for immediate patching and mitigation across all affected organizations given the compressed exploitation timeline and widespread attack surface exposure.

CVE-2026-48908 - Unrestricted Upload of File with Dangerous Type vulnerability in JoomShaper SP Page Builder

An Unrestricted Upload of File with Dangerous Type vulnerability in JoomShaper's SP Page Builder enables unauthenticated attackers to upload arbitrary files, including PHP webshells, by exploiting the asset.uploadCustomIcon task which operates with no authentication checks and no server-side file type restrictions. JoomShaper patched this vulnerability in version 6.6.2. The vulnerable endpoint processes uploaded files without validating user login status or permissions, writing files directly to web-accessible folders and failing to use Joomla's built-in file validation helpers. Attackers exploit this to upload PHP shells, browse to them, and achieve full remote code execution. Real-world attacks demonstrate sophisticated persistence mechanisms where malicious payloads create hidden Super Administrator accounts with hard-coded usernames combined with random digits and @secure.local email addresses that serve as reliable compromise signatures. The dropper code directly accesses the Joomla database, disables SQL validation, inserts unblocked admin accounts into the Super Users group, and creates database rows making rogue accounts appear legitimate in the admin interface. Secondary persistence establishes through PHP file manager backdoors scattered across innocuous locations like images/random/fonts/ and /media directories, ensuring continued access even if individual copies are discovered. The vulnerability bypasses web application firewall rules designed for previous Joomla exploits through its distinct request signature and URL-encoded task names (%2e). The vulnerability has been added to the CISA KEV catalog, requiring immediate patching across all affected Joomla installations.

CVE-2026-48939 - Unrestricted Upload of File with Dangerous Type vulnerability in iCagenda extension for Joomla

An Unrestricted File Upload vulnerability in iCagenda extension for Joomla enables unauthenticated attackers to upload arbitrary files with no login required by exploiting the frontend "Submit and Event" form that processes file attachments without server-side validation of file type or extension. Affected versions include iCagenda 3.2.1 through 3.9.14 and 4.0.0 through 4.0.7. The vulnerable component writes uploaded files directly to images/icagenda/frontend/attachments/ while preserving attacker-supplied file extensions, failing to maintain allow-lists of permitted extensions and failing to block dangerous extensions such as .php or validate MIME types. On Joomla 6, where core file upload filtering is not applied to this specific path, attackers upload PHP web shells and achieve remote code execution with full control over compromised sites. A secondary authorization bypass exists in the same submission flow where access control checks determining whether submissions are restricted to registered users are enforced only in the view layer but never on the backend controller, allowing attackers to bypass permission settings by harvesting form tokens and posting directly to the processing endpoint without authentication. This applies to all Joomla versions. Active exploitation was confirmed on June 15, 2026, with an automated scanner (icagenda-batch/1.0) executing complete attack sequences: grabbing session tokens, uploading malicious files, and fetching planted PHP shells at predictable paths. JoomliC's advisory dated automated attacks from June 15, 2026, 8 AM UTC, establishing active exploitation in the wild before any patched version existed, qualifying it as a zero-day vulnerability.

CVE-2026-55255 - Authorization Bypass Through User-Controlled Key vulnerability in Langflow

An Authorization Bypass Through User-Controlled Key vulnerability in Langflow enables authenticated attackers to execute any flow belonging to another user by specifying the victim's flow ID in requests, exploiting a flaw in the get_flow_by_id_or_endpoint_name function where UUID-based lookups lack user ownership verification. Langflow patched this cross-tenant insecure direct object reference (IDOR) vulnerability in version 1.9.1 released in June 2026. On June 25, 2026, Sysdig Threat Research Team documented the first known active exploitation where attackers enumerated flow IDs from the /api/v1/flows/ endpoint and replayed them at /api/v1/responses with prompt injection payloads reading "leak api keys" to extract embedded LLM provider keys, cloud credentials, and database secrets. The attacker simultaneously exploited CVE-2026-33017, an unauthenticated RCE vulnerability, through four exploitation waves downloading second-stage malware via custom components executing shell commands. Operating with financially motivated behavior, the threat actor pursued two parallel monetization vectors: RCE for botnet enrollment and compute hijacking, while the IDOR targeted credential theft for high-value API key resale and LLM model abuse. Despite CVE-2026-55255's higher CVSS score, the attacker prioritized the lower-scored RCE for maximum return-per-effort, using scripted playbooks from a single IP (45.207.216.55) functioning as both C2 and staging infrastructure. The vulnerability has been added to the CISA KEV catalog, underscoring the urgent need for immediate patching across all affected Langflow installations.

CVE-2026-56290 - Improper Access Control vulnerability in Joomlack Page Builder

An Improper Access Control vulnerability in PageBuilder CK for Joomla enables unauthenticated attackers to upload arbitrary files without any login requirements by exploiting a front-end endpoint that only verifies a basic anti-CSRF token obtainable from public pages, allowing attackers to choose both destination folders and filenames including extensions to upload PHP files to any web-accessible directory and achieve full remote code execution over the entire site. Affected versions include PageBuilder CK up to and including 3.5.10, with the vulnerability patched in version 3.6.0 for current Joomla installations, version 3.1.1 for the legacy Joomla 3 line, and version 3.4.10 for Joomla 4 users, all requiring immediate deployment to mitigate the critical risk. Within hours of the security patch release on June 27, 2026, attackers began actively exploiting this vulnerability in the wild, with confirmed web shells discovered at /media/com_pagebuilderck/gfonts/bhup.php functioning as self-contained file managers allowing additional file uploads and execution anywhere on the server, effectively establishing permanent backdoors independent of the original vulnerability by deliberately choosing plausible subfolder names to evade detection. Because the vulnerability allows attackers to choose any destination folder, simply blocking PHP execution in one directory proves ineffective as attackers can write to /media, /templates, or /administrator directories, and unpublishing the component provides no protection as the vulnerable endpoint remains reachable and uploaded files continue to be web-served. The vulnerability has been recently added to the CISA KEV catalog, underscoring the critical need for immediate patching across all affected Joomla installations given the rapid weaponization and widespread deployment of PageBuilder CK across thousands of websites.

Cytellite telemetry captured active exploit attempts and mass scanning campaigns against exposed services globally. The data highlights which vulnerabilities are under attack and provides source IPs and payloads to authorized teams for detailed threat analysis and validation.

Active malware campaigns exploited specific vulnerabilities to deliver payloads and carry out post-exploitation actions. Each targeted vulnerability is proactively monitored, manually analysed, and mapped to MITRE ATT&CK tactics and techniques. Insights are derived from the LOVI vulnerability intelligence platform, which aggregates and curates data from multiple sources, OSINT groups, blogs, and data leak sites.

Critical SharePoint RCE Vulnerability Exploited by Storm-2603

According to Rescana, CVE-2026-45659 is a critical remote code execution vulnerability affecting Microsoft SharePoint server rooted in improper deserialization of untrusted data that enabled authenticated attackers with Site Member permissions to execute arbitrary code by sending crafted requests containing malicious serialized payloads, resulting in the vulnerability added to the CISA KEV catalog following confirmed active exploitation in early July 2026. The exploitation was attributed to sophisticated financially motivated and ransomware groups including the Storm-2603 group, characterized by rapid weaponization of newly disclosed vulnerabilities, use of legitimate remote administration tools such as Velociraptor, Cloudflare Tunnels, Zoho Assist, and SSH via Visual Studio Code for persistence and lateral movement. Post-exploitation activities observed in the wild included privilege escalation through creation of new local or domain administrator accounts, exploitation of vulnerable drivers like NSecKrnl.sys to disable security solutions, and deployment of custom backdoors using DLL side-loading and defense evasion techniques. Victims spanned government, healthcare, finance, education, and critical infrastructure sectors globally, with no specific geographic or industry targeting, indicating opportunistic exploitation of any unpatched SharePoint Server instance regardless of organization size or sector. Microsoft released security updates for SharePoint Enterprise Server 2016, SharePoint Server 2019, and SharePoint Server Subscription Edition to resolve the vulnerability, requiring immediate patching across affected installations combined with comprehensive audits of SharePoint permissions, monitoring for indicators of compromise including suspicious remote access tools and administrator account creation, and implementation of least privilege access controls.

UNK_MassTraction Campaign Targeting University Physics Departments of US and Canadian universities

Since May 2026, Proofpoint Threat Research tracked UNK_MassTraction, a suspected China-aligned threat cluster, exploiting multiple n-day vulnerabilities in Roundcube mailservers belonging to physics and engineering departments of US and Canadian universities, leveraging CVE-2024-42009 (cross-site scripting vulnerability) to execute malicious JavaScript inside victim browsers and steal credential information including usernames, passwords, two-factor authentication material, and cookies stored in browser sessions. The campaign deployed IceCube, a fully-featured Roundcube stealer payload that escaped iFrame instantiation through DOM traversal to gain access to the complete document object model and authentication sessions, then utilized CVE-2025-49113 (PHP deserialization vulnerability) to install SquareShell webshell at plugins/newmail_notifier/mail_preview.php for remote code execution capabilities on the compromised mailserver. If webshell deployment failed, the infection chain deployed a fallback shell script that executed an architecture-dependent ELF loader (SNOWLIGHT) to establish VShell backdoor for interactive shell access and port-forwarding features enabling network pivoting. UNK_MassTraction demonstrated mature operational tradecraft by deliberately crafting the infection chain to avoid detection through cleanup of local storage, removal of forensic evidence from Roundcube servers, deferred trigger monitoring of user actions, and abuse of Roundcube mailservers as edge devices to pivot into target networks rather than targeting mailserver contents directly. The attribution assessment indicated UNK_MassTraction was likely China-aligned based on access to covert VPS infrastructure networks shared by multiple China-aligned threat actors, usage of VShell malware, presence of Chinese language artifacts in phishing emails, and targeting patterns consistent with espionage-motivated operations against US and Canadian universities with national security or theoretical physics research ties.

Talos Intelligence Uncovers UAT-7810's Targeting Networking Devices for ORB Infrastructure

Cisco Talos Intelligence reported that UAT-7810, a China-nexus advanced persistent threat actor, continued developing and deploying custom malware to build and maintain Operational Relay Box (ORB) networks that enabled associated secondary threat actors to conduct malicious attacks against high-value targets by primarily exploiting known vulnerabilities in unpatched Ruckus wireless routers: CVE-2020-22653, CVE-2020-22658, CVE-2023-25717 and ASUS AiCloud Routers CVE-2025-2492. The threat actor's malware arsenal included SHORTLEASH, the original custom backdoor capable of C2 communication and tunnel management; LONGLEASH, a significantly enhanced successor featuring advanced proxy functionality for HTTP, DNS, SOCKS, TCP, ICMP, and UDP, along with capabilities to remove implants if tampering was detected; DOGLEASH, a passive C-based backdoor that bound to ports and executed arbitrary commands through hardcoded password-protected mechanisms; JARLEASH, a Java-based administrator tool deployed for file management, FTP, SFTP, and Netcat access with configuration files containing Simplified Chinese comments; and LEASHTEST, a testing binary for rudimentary MIPS-based embedded device functionality verification. Talos discovered four new servers hosting these malware variants across multiple hardware platforms including MIPS, ARM, and x64 architectures, with the infrastructure demonstrating UAT-7810's active development and deployment operations, while the organization's opportunistic, financially motivated behavior prioritized high-yield exploitation targets through scripted playbooks with minimal human interaction, establishing ORB networks that functioned as intermediate command-and-control infrastructure for broader threat operations across compromised networking devices.

Open-Source Software (OSS) vulnerabilities are security weaknesses discovered in publicly available codebases that can be exploited across widely used libraries, frameworks, and tools, often impacting thousands of downstream applications.

PRE-NVD vulnerabilities refer to security flaws that are discovered, discussed, or even exploited in the wild before their official inclusion in the National Vulnerability Database (NVD). These early-stage vulnerabilities often emerge through threat actor chatter, exploit proof-of-concepts, and technical disclosures shared across social media platforms and underground forums, signaling potential exploitation risks before public awareness.

The week's surge in nation-state campaigns, financially motivated exploitation, and AI-weaponized botnets reveals that vulnerability management alone is insufficient. Loginsoft Vulnerability Intelligence (LOVI) platform addresses this critical need by providing real-time vulnerability intelligence enriched with diverse sources, AI-powered threat scores, customizable alerts, and seamless API integration to correlate vulnerabilities with CISA KEV and live threat intelligence for accelerated mitigation. By aggregating pre-NVD insights, comprehensive asset mapping, and lifecycle monitoring, LOVI reduces mean time to remediation and transforms reactive patching into strategic risk prioritization. Organizations must shift from patch-centric approaches to intelligence-driven vulnerability management - LOVI enables this transformation by delivering actionable context empowering security teams to prioritize threats that matter most, ensuring resilience against accelerating risks.

FAQs

1) What is SP Page Builder?

‍SP Page Builder is a popular drag-and-drop page builder component for Joomla developed by JoomShaper that enables users to create and design layouts visually without coding. The component is widely installed across Joomla sites and integrates into the Joomla ecosystem to handle page creation, icon uploads, and content building tasks through front-end endpoints.  

2) What is Gitea?

Gitea is an open-source DevOps and version control platform that provides Git repository hosting and collaboration features for teams and organizations. The platform is available in multiple deployment forms including self-hosted binaries, Docker containers, and cloud-managed instances through Gitea Cloud.

3) Does inclusion in the CISA KEV catalog mean exploitation is widespread?

Not necessarily widespread - but confirmed. KEV inclusion indicates verified in-the-wild exploitation. While the scale may vary, the operational reality is that threat actors possess working exploits, making patch prioritization urgent regardless of observed targeting volume.

4) How does LOVI help organizations manage vulnerabilities effectively?

Loginsoft Vulnerability Intelligence empowers you to efficiently prioritize and respond to potential vulnerabilities by focusing on those actively exploited in the wild. LOVI correlates vulnerability data with real-world threat activity to reduce noise and improve decision-making. This approach enables faster remediation and stronger security posture.

5) What is Cytellite?

Cytellite is a Loginsoft security intelligence platform that provides real-time visibility into emerging threats through a global sensor network. It delivers actionable IP intelligence to help organizations detect, analyze, and respond to attacks quickly. By correlating threat data with live activity, Cytellite strengthens resilience across dynamic threat landscapes.