When Trusted Infrastructure Becomes the Target: This Week in Vulnerability Intelligence

This week reinforced a familiar lesson: attackers moved fastest against the systems organizations trust most, from edge VPNs to build servers and management consoles. Vulnerability disclosures and confirmed exploitation converged, leaving defenders little room between patch release and active abuse.

CISA added five vulnerabilities to its Known Exploited Vulnerabilities catalog, including two affecting N-able N-central and one each in JetBrains TeamCity, IBM Langflow, and Apache Tomcat. Beyond those additions, researchers detected fresh active exploitation of a 2013 IPMI flaw, proving that decade-old exposures still offered attackers a viable way in.

On the malware front, INC Ransomware weaponized a SonicWall SMA zero-day chain to seize root-level control of internet-facing VPN appliances. Separately, the China-nexus SNOWLIGHT campaign exploited Apache Tomcat flaw to deliver its stealthy, fileless SNOWLIGHT loader against government targets.

Key points:

• CISA added five vulnerabilities to its Known Exploited Vulnerabilities catalog
• Threat actors resumed active exploitation of a 2013 IPMI flaw
• INC Ransomware chained a SonicWall SMA zero-day to gain root access
• China-nexus SNOWLIGHT campaign exploited Apache Tomcat flaw

Several high-impact vulnerabilities are currently trending across the cybersecurity community, demanding immediate attention and patch prioritization. Monitoring these emerging and widely discussed threats provides valuable insights, enabling organizations to make informed security decisions and strengthen their overall defense posture.

CVE-2026-9198 - Code Injection vulnerability IBM Langflow  

A Code Injection vulnerability affected IBM Langflow OSS and allowed unauthenticated attackers to achieve full remote code execution on default deployments running versions 1.0.0 through 1.10.0. According to IBM, the /api/v1/auto_login route automatically issued a SUPERUSER session token without gating by network origin or configuration, so any caller reaching the HTTP listener received a fully privileged token. The attacker then presented that token to /api/v1/validate/code, an endpoint that passed submitted Python source to the built-in exec() function, granting arbitrary command execution under the service account. Recommended workarounds included blocking both routes at the reverse proxy for non-trusted networks, setting LANGFLOW_AUTO_LOGIN to false with explicit LANGFLOW_SUPERUSER credentials, binding the listener to 127.0.0.1 behind an authenticating gateway, and running Langflow as a non-privileged user. IBM addressed the flaw in Langflow OSS version 1.10.1, a public proof of concept remained available on GitHub, and the vulnerability entered the CISA KEV catalog.

CVE-2026-18556 - Authentication Bypass Using an Alternate Path or Channel vulnerability in N-able N-central

An Authentication Bypass Using an Alternate Path or Channel vulnerability affected N-able N-central and allowed authentication bypass and account takeover across cloud-hosted and on-premises deployments. N-central serves as N-able's flagship remote monitoring and management platform, so a single compromised server granted privileged, hands-on-keyboard reach into every downstream environment a managed service provider oversaw. According to Huntress, the flaw enabled unauthenticated "god-mode" access to the RMM console, equivalent to the full administrative control held by trusted NOC and engineering staff. Across observed intrusions, attackers conducted high-level reconnaissance to prioritize key servers such as Domain Controllers, then abused the built-in Take Control remote-access feature to pivot into managed endpoints. N-able addressed the flaw in N-central version 2026.2, and CISA added the vulnerability to the Known Exploited Vulnerabilities catalog.

CVE-2026-18577 - Authentication Bypass vulnerability or Channel vulnerability in N-able N-central

An Authentication Bypass Using an Alternate Path or Channel vulnerability affected N-able N-central as an incomplete patch for CVE-2026-18556, leaving an alternate exploitation path that allowed the same authentication bypass and account takeover through version 2026.3.1. According to Huntress, the residual flaw preserved the unauthenticated "god-mode" access to the RMM console that the original fix intended to close, keeping all supported builds including 2026.3 exposed. Windows Application Event Logs evidenced exploitation through Event IDs 4102, 8192, and 8193, where a connection via the default "MSP Support" account originated from a listed N-able address and the Take Control session started and ended. N-able published six attacker IP addresses and three malicious domains and directed customers to hunt for a rogue svchost.exe and a Cloudflared tunnel-persistence service. N-able released build 2026.3.1.7 on August 2 as the first version to fully remediate both vulnerabilities, and CISA listed the flaw in the KEV catalog.

CVE-2026-34486 - Missing Encryption of Sensitive Data vulnerability in Apache Tomcat

A Missing Encryption of Sensitive Data vulnerability affected Apache Tomcat and allowed a bypass of the EncryptInterceptor in the Tribes clustering component. According to SOCRadar, the flaw originated as a regression from the fix for CVE-2026-29146, where a control-flow change moved the receiver from fail-closed to fail-open behavior, so a node forwarded attacker-supplied bytes up the processing chain even after decryption failed. The forwarded bytes reached an unauthenticated Java deserialization sink, and given Tribes clustering with EncryptInterceptor enabled and the receiver reachable on default TCP/4000, an attacker achieved unauthenticated remote code execution through a viable gadget chain. Where patching proved impossible, guidance restricted TCP/4000 to trusted cluster members and hunted for decrypt-failure log events correlated with unusual inbound connections. Apache addressed the flaw by restoring fail-closed behavior in versions 9.0.117, 10.1.54, and 11.0.21, Tomcat 8.5.x remained unaffected, and CISA added the flaw to its KEV catalog.

CVE-2026-63077 - Deserialization of Untrusted Data vulnerability in JetBrains TeamCity

A Deserialization of Untrusted Data vulnerability affected JetBrains TeamCity and enabled unauthenticated remote code execution through the agent polling protocol. According to JetBrains, exploitation allowed an attacker with HTTP(S) access to a TeamCity server to bypass authentication checks and execute arbitrary operating system commands with the privileges of the TeamCity server process. All versions of TeamCity On-Premises before 2026.1.3 and 2025.11.7 remained affected, while TeamCity Cloud environments required no action and showed no evidence of exploitation. JetBrains also recommended limiting access to internet-facing TeamCity servers, running servers with minimum operating system privileges, and using VPN connections to prevent unauthorized access. A fix arrived in versions 2025.11.7 and 2026.1.3, along with a security patch plugin for 2017.1 and later, and the vulnerability has been added to the CISA KEV catalog.

CVE-2013-4786 - Improper Authentication vulnerability in IPMI 2.0 protocol

An Improper Authentication vulnerability disclosed in 2013 affected the IPMI 2.0 protocol and allowed unauthenticated remote attackers to retrieve password-derived hashes from Baseboard Management Controllers. The weakness originated in the 2004 IPMI 2.0 specification, where the RAKP message 2 response returned an HMAC-SHA1 code computed from a valid account password, so any party reaching UDP port 623 requested that value and cracked candidate passwords offline without repeated login attempts. According to Lava, nearly 37,000 internet-exposed IPMI interfaces remained reachable and more than 24,000 disclosed authentication hashes before login, while thousands accepted empty usernames or relied on default and wordlist passwords. Because IPMI, Redfish, and the web console often shared a single user database, one recovered credential granted privileged out-of-band control across the entire management plane. Mitigation relied on enforcing strong unique passwords, restricting UDP 623 to isolated management networks, and disabling the interface where unused, and threat actors continued to target exposed controllers in the wild.

Cytellite telemetry captured active exploit attempts and mass scanning campaigns against exposed services globally. The data highlights which vulnerabilities are under attack and provides source IPs and payloads to authorized teams for detailed threat analysis and validation.

Active malware campaigns exploited specific vulnerabilities to deliver payloads and carry out post-exploitation actions. Each targeted vulnerability is proactively monitored, manually analysed, and mapped to MITRE ATT&CK tactics and techniques. Insights are derived from the LOVI vulnerability intelligence platform, which aggregates and curates data from multiple sources, OSINT groups, blogs, and data leak sites.

INC Ransomware exploits SonicWall SMA Zero-Day chain for root access

According to Resecurity, threat actors chained two SonicWall SMA 1000 vulnerabilities, CVE-2026-15409 and CVE-2026-15410, to seize full root control of internet-facing VPN appliances, and INC Ransomware became the dominant group weaponizing that chain against victims worldwide. CVE-2026-15409, a pre-authentication /wsproxy bypass, allowed an unauthenticated attacker to open a WebSocket tunnel to internal localhost-only services, while CVE-2026-15410, a path-traversal flaw in the remove_hotfix workflow, escalated that foothold to root. After gaining root, the attackers deployed a persistent malware toolkit of ROOTRUN, KNUCKLEBALL, Suo5, and ORANGETAIL, harvested credentials, and pivoted into internal networks. Volexity first observed pre-disclosure exploitation by the actor tracked as UTA0533 from June 22, 2026, and Rapid7 linked overlapping activity to the same INC Ransomware campaign now hitting organizations across multiple countries.

SNOWLIGHT Malware Deployed Through Apache Tomcat Flaw CVE-2026-34486

According to SOCRadar, the China-nexus SNOWLIGHT campaign exploited CVE-2026-34486, an Apache Tomcat Tribes Java deserialization flaw, to deliver the SNOWLIGHT malware against Taiwanese servers. The operator weaponized the flaw with an exp.py and ysoserial CommonsCollections6 gadget chain against Tomcat 9.0.x on port 4000, using an --rce parameter that ran a curl-pipe-sh sequence to pull a stage loader from the /slt endpoint. That loader identified the host architecture and fetched the matching SNOWLIGHT ELF payload, a compact C-based loader under 10 KB that checked in over a raw TCP socket to a hardcoded IP, decoded its next stage with a single-byte XOR key of 0x99, and executed it filelessly through memfd_create and fexecve while masquerading as the kernel thread [kworker/0:2]. The loader also carried a kill switch that halted execution when a file existed at /tmp/log_de.log, and cross-platform Windows PE variants mirrored the same check-in, XOR key, and behavior. SOCRadar attributed the SNOWLIGHT family delivered through this flaw to China-nexus access brokers UNC5174 and UNC6586.

Open-Source Software (OSS) vulnerabilities are security weaknesses discovered in publicly available codebases that can be exploited across widely used libraries, frameworks, and tools, often impacting thousands of downstream applications.

PRE-NVD vulnerabilities refer to security flaws that are discovered, discussed, or even exploited in the wild before their official inclusion in the National Vulnerability Database (NVD). These early-stage vulnerabilities often emerge through threat actor chatter, exploit proof-of-concepts, and technical disclosures shared across social media platforms and underground forums, signaling potential exploitation risks before public awareness.

From decade-old flaws to fresh zero-days, the window between disclosure and exploitation kept narrowing, and unpatched, internet-facing infrastructure paid the price. Organizations that paired rapid patching with continuous monitoring stood the best chance of staying ahead. LOVI (Loginsoft Vulnerability Intelligence) continued to track these threats in real time, delivering the actionable intelligence defenders needed to prioritize what mattered most.

‍FAQs:

1) What is JetBrains TeamCity?

JetBrains TeamCity is a continuous integration and continuous delivery (CI/CD) server used by development teams to automatically build, test, and deploy software. It takes code changes, compiles them, runs tests, and packages the results, streamlining the path from source code to a shippable product.

2) What is Apache Tomcat?

Apache Tomcat is an open-source web server and servlet container maintained by the Apache Software Foundation. It runs Java-based web applications by implementing the Jakarta Servlet, JSP, and WebSocket specifications, and enterprises deploy it widely to host internal portals, APIs, and public-facing Java services.

3) Does inclusion in the CISA KEV catalog mean exploitation is widespread?

Not necessarily widespread - but confirmed. KEV inclusion indicates verified in-the-wild exploitation. While the scale may vary, the operational reality is that threat actors possess working exploits, making patch prioritization urgent regardless of observed targeting volume.

4) How does LOVI help organizations manage vulnerabilities effectively?

Loginsoft Vulnerability Intelligence empowers you to efficiently prioritize and respond to potential vulnerabilities by focusing on those actively exploited in the wild. LOVI correlates vulnerability data with real-world threat activity to reduce noise and improve decision-making. This approach enables faster remediation and stronger security posture.

5) What is Cytellite?

Cytellite is a Loginsoft security intelligence platform that provides real-time visibility into emerging threats through a global sensor network. It delivers actionable IP intelligence to help organizations detect, analyze, and respond to attacks quickly. By correlating threat data with live activity, Cytellite strengthens resilience across dynamic threat landscapes.