Daily Threat Briefing
← All briefings

Google Chrome · Apache CXF · Microsoft Teams

Date: 2026-08-07 Prepared for: SOC Analysts | Incident Responders | Vulnerability Management | Security Leadership

Executive Summary

Google Chrome 151 received a critical security update patching two sandbox-escape flaws (CVE-2026-19149, CVE-2026-19170) alongside multiple high-severity V8 RCE vulnerabilities — update all enterprise browsers immediately. Apache CXF disclosed four critical vulnerabilities including unauthenticated JMS deserialization RCE and OAuth authorization-code replay. BSI published new advisories for Cisco IOS/IOS XE, Cisco SD-WAN Manager, Red Hat Keycloak, n8n, and GStreamer. UNC6671 has rebranded across multiple extortion fronts and is actively targeting financial services via vishing.

Critical Vulnerabilities

CVE-2026-19149 / CVE-2026-19170 — Google Chrome (Sandbox Escape, Linux & Android)

  • Severity: CVSS 9.6 (both)
  • EPSS: 0 (newly published; no exploitation data yet)
  • Technical detail: Two use-after-free vulnerabilities — one in the Aura window manager on Linux (CVE-2026-19149) and one in WebGL on Android (CVE-2026-19170) — allow a remote attacker to escape the Chrome sandbox via a crafted HTML page. Both are rated Critical by the Chromium security team. All Chrome versions prior to 151.0.7922.109 on Linux and Android are affected. Enterprise deployments with managed Chrome on Linux workstations and Android devices are directly exposed.
  • Exploitation status: No confirmed in-the-wild exploitation reported; Critical Chromium severity rating warrants urgent treatment.
  • Remediation: Update Chrome to 151.0.7922.109 or later on all platforms. Push managed updates via Chrome Browser Cloud Management or equivalent MDM. Verify Chromium-based browsers (Edge, Brave, etc.) receive equivalent upstream patches.

CVE-2026-66909 — Apache CXF (JMS Transport Unauthenticated RCE via Deserialization)

  • Severity: CVSS 9.8
  • EPSS: 0 (newly published)
  • Technical detail: Apache CXF’s JMS transport deserializes the body of any inbound JMS ObjectMessage using native Java deserialization with no type restrictions. Any attacker able to place a message on the JMS broker queue — including unauthenticated actors if the broker is exposed — can achieve arbitrary code execution on the CXF server. Affected versions: < 3.6.12, 4.0.x < 4.1.8, 4.2.x < 4.2.3. Apache CXF is widely used in enterprise Java SOA/microservice stacks and is embedded in products such as Apache Karaf, WSO2, and IBM WebSphere.
  • Exploitation status: No confirmed exploitation; high-severity deserialization RCE in a widely deployed framework warrants priority treatment.
  • Remediation: Upgrade to Apache CXF 3.6.12, 4.1.8, or 4.2.3. If immediate upgrade is not possible, disable JMS transport or restrict broker access to trusted internal hosts only.

CVE-2026-68079 — Apache CXF (OAuth2 Authorization Code Replay)

  • Severity: CVSS 9.8
  • EPSS: 0 (newly published)
  • Technical detail: A flaw in DefaultEncryptingCodeDataProvider.removeCodeGrant() allows a captured OAuth2 authorization code to be redeemed an unlimited number of times. An attacker who intercepts a single authorization code — via network sniffing, log exposure, or referrer leakage — can repeatedly obtain access tokens without re-authenticating. Affects the same version ranges as CVE-2026-66909. Organizations using CXF as an OAuth2 authorization server are directly impacted.
  • Exploitation status: No confirmed exploitation.
  • Remediation: Upgrade to CXF 3.6.12, 4.1.8, or 4.2.3. Audit OAuth2 authorization server logs for repeated code redemption attempts.

CVE-2026-65667 — Microsoft Teams (Unauthenticated Privilege Escalation)

  • Severity: CVSS 10.0
  • EPSS: 0 (newly published)
  • Technical detail: A missing authorization flaw in Microsoft Teams allows an unauthenticated network attacker to elevate privileges. CVSS 10.0 reflects full impact across confidentiality, integrity, and availability with no authentication required. Microsoft Teams is ubiquitous in enterprise environments. The version field is listed as unspecified, suggesting this is a cloud-side fix; however, organizations should verify client update status and monitor for Microsoft’s remediation confirmation.
  • Exploitation status: No confirmed exploitation. EPSS score is 0 (newly published).
  • Remediation: Ensure Microsoft Teams clients are on the latest version. Monitor Microsoft’s security update guidance for server-side remediation confirmation. Review Teams audit logs for anomalous privilege changes.

CVE-2026-63077 — JetBrains TeamCity (Unauthenticated RCE via Deserialization)

  • STATUS CHANGE: BSI updated advisory WID-SEC-2026-2534 on 2026-08-06. CISA KEV remediation deadline is 2026-08-08 — patch immediately if not already done.

ONGOING:

  • CVE-2026-20304/20303 (Cisco SD-WAN Manager/Controller): CVSS 9.9; patch required, no confirmed exploitation.
  • CVE-2026-20272 et al. (Cisco IOS XE): CVSS 9.8; apply IOS XE updates, prioritize perimeter devices.
  • CVE-2026-9192 et al. (Progress MarkLogic): CVSS 9.8; upgrade to 11.3.6 / 12.0.3.
  • CVE-2026-70426 (Jenkins Remoting): CVSS 9.0; upgrade to Jenkins 2.576 / LTS 2.568.2.
  • CVE-2026-9198 (IBM Langflow): Actively exploited; CISA KEV deadline 2026-08-07 — patch immediately.
  • CVE-2026-34486 (Apache Tomcat): Actively exploited; CISA KEV deadline 2026-08-07 — apply latest release.
  • CVE-2026-16232 (Check Point SmartConsole): Actively exploited — treat unpatched instances as compromised.
  • CVE-2026-0257 (PAN-OS GlobalProtect): Qilin ransomware exploitation ongoing — patch immediately.

European Advisories

BSI published a significant batch of new advisories on 2026-08-06. New items of highest enterprise relevance:

[NEU] WID-SEC-2026-2677 — Red Hat Build of Keycloak: Multiple vulnerabilities allow privilege escalation to administrator, account takeover, security bypass, information disclosure, data manipulation, and DoS. Keycloak is widely deployed as an enterprise identity provider across European public sector and financial organizations. Apply Red Hat Keycloak updates immediately; audit admin account activity.

[NEU] WID-SEC-2026-2674 / WID-SEC-2026-2676 / WID-SEC-2026-2664 — Cisco IOS XE, Catalyst SD-WAN Manager, and IOS: BSI published three new advisories covering the Cisco vulnerability cluster reported yesterday. Critical items are detailed in Critical Vulnerabilities (yesterday’s report). Apply Cisco patches per vendor advisory.

[NEU] WID-SEC-2026-2681 — n8n: 18 vulnerabilities patched including RCE, security bypass, SSRF, XSS, and DoS. n8n is a popular open-source workflow automation tool used in enterprise and SMB environments. Apply the latest n8n release; restrict n8n instances to internal networks.

[NEU] WID-SEC-2026-2673 — Cisco Integrated Management Controller: Authenticated attackers can execute arbitrary code with root privileges or conduct XSS attacks. Apply Cisco IMC updates; restrict IMC management access to OOB networks.

[NEU] WID-SEC-2026-2684 — Cacti: Authenticated SQL injection vulnerability. Apply Cacti patches; restrict access to authenticated administrators only.

[NEU] WID-SEC-2026-2675 — IBM Langflow Desktop: Multiple vulnerabilities including RCE, XSS, SQL injection, and DoS. Apply IBM Langflow Desktop updates.

BSI also updated advisories for GNU libc, Samba, vm2, WSO2 API Manager, Atlassian suite, PHP, Red Hat Ansible Automation Platform, Red Hat OpenShift, IBM App Connect Enterprise, Linux Kernel, and rclone — apply vendor patches per standard patch cycles.

Active Threats and Campaigns

NEW — UNC6671 Rebrands Across Multiple Extortion Fronts, Targets Financial Services: Google Threat Intelligence Group reports that UNC6671 — previously associated with the BlackFile extortion brand — has diversified operations across at least four new brands: Redact, Pink, Helix, and Falcon. The group continues to rely on vishing to compromise enterprise employees, with a current focus on financial services (hedge funds, private equity) and enterprise cloud environments. Recent attacks have led to data theft and extortion. Organizations in financial services should brief staff on vishing tactics, enforce MFA on all cloud access, and monitor for unauthorized data exfiltration. Source: Mandiant/GTIG

NEW — ChainDrop npm Supply-Chain Worm (GitHub Actions Secret Exfiltration): Unit 42 published analysis of ChainDrop, a self-propagating npm worm that extracts GitHub Actions runner secrets and uses Ethereum smart contracts for C2 routing, evading traditional domain-based detection. Audit npm dependencies and GitHub Actions runner environments for compromise; enforce lockfile integrity and least-privilege secrets scoping. Source: Unit 42

NEW — ClickFix macOS Infostealer (Crypto Theft): A Go-based infostealer delivered via ClickFix social engineering is targeting macOS users, stealing cryptocurrency assets, browser-stored passwords, Apple Keychain data, and cached credentials. Update macOS endpoint detection; alert on unexpected osascript execution.

ONGOING — Kali365 Device-Code Phishing (Microsoft 365): Block OAuth device-code flow in Entra ID Conditional Access; alert on anomalous token grants. ONGOING — Midnight Blizzard hotel Wi-Fi campaign: Enforce VPN-before-browsing for traveling staff.

Security News and Context

  • Swiss government SharePoint breach: Hackers exploited vulnerabilities in Microsoft SharePoint servers of Switzerland’s federal IT office, compromising approximately 200 accounts. Bleeping Computer
  • INTERRUPT INJECTION / TONTOU — Spectre v2 bypass: MIT CSAIL researchers demonstrated a new interrupt-injection technique that re-poisons branch predictors after Spectre v2 mitigations run, leaking Linux password hashes on AMD Zen 2 and Intel CPUs. No patch available yet; monitor vendor advisories. The Hacker News / Bleeping Computer
  • Snowflake hacker guilty plea: Connor Riley Moucka pleaded guilty to breaching 165 organizations and exposing data on at least 100 million people; sentencing carries 2–30 years. Heise
  • AI token jacking: Unit 42 documented attackers hijacking developer AI API keys to fuel gray-market LLM transfer stations — audit API key exposure in CI/CD and developer environments. Unit 42
  1. Chrome 151: Deploy update to 151.0.7922.109 immediately across all platforms; prioritize Linux and Android endpoints for sandbox-escape CVEs.
  2. Apache CXF (CVE-2026-66909, CVE-2026-68079): Upgrade to 3.6.12 / 4.1.8 / 4.2.3; disable JMS transport if upgrade is delayed; audit OAuth2 authorization server logs.
  3. Microsoft Teams (CVE-2026-65667): Ensure Teams clients are fully updated; monitor Microsoft guidance for server-side remediation confirmation.
  4. Red Hat Keycloak (BSI WID-SEC-2026-2677): Apply updates immediately; audit admin accounts for unauthorized privilege changes.
  5. n8n (BSI WID-SEC-2026-2681): Apply latest n8n release; restrict instances to internal networks only.
  6. Cisco IMC (BSI WID-SEC-2026-2673): Apply Cisco IMC updates; restrict management access to OOB networks.
  7. UNC6671 / Vishing (Financial Services): Brief staff on vishing TTPs; enforce MFA on all cloud access; monitor for bulk data exfiltration from cloud storage.
  8. ChainDrop npm worm: Audit npm dependency trees and GitHub Actions runner secrets; enforce lockfile integrity and least-privilege secrets scoping.
  9. ClickFix macOS infostealer: Update macOS EDR signatures; alert on unexpected osascript or clipboard-paste execution.
  10. Continue remediation of previously reported items: CVE-2026-63077 (TeamCity, deadline 2026-08-08), CVE-2026-9198 (Langflow, deadline 2026-08-07), CVE-2026-34486 (Tomcat, deadline 2026-08-07), CVE-2026-20304/20303 (Cisco SD-WAN), CVE-2026-20272 (IOS XE), CVE-2026-16232 (Check Point), CVE-2026-0257 (PAN-OS).