Daily Threat Briefing
← All briefings

Progress LoadMaster · JetBrains TeamCity · WordPress Core

Date: 2026-08-08 Prepared for: SOC Analysts | Incident Responders | Vulnerability Management | Security Leadership

Executive Summary

CISA added CVE-2026-8037 (Progress LoadMaster command injection) to the KEV catalog with a three-day remediation deadline of 2026-08-10 — unauthenticated exploitation is confirmed. Rapid7 published a detailed technical analysis and public proof-of-concept for CVE-2026-63077 (JetBrains TeamCity unauthenticated RCE), whose CISA KEV deadline expired today. A Metabase SQL injection zero-day was actively exploited against Framework and Tally before a patch was available. BSI published new advisories for Arista VeloCloud Orchestrator, Flowise (unpatched), Wazuh, WordPress, Sophos Endpoint, and Google Chrome.

Critical Vulnerabilities

CVE-2026-8037 — Progress LoadMaster (Unauthenticated Command Injection)

  • Severity: Not yet scored (CWE-77; CISA KEV)
  • EPSS: Not yet available
  • Technical detail: Unsanitized input in multiple command endpoints allows an unauthenticated remote attacker to inject and execute arbitrary OS commands on the LoadMaster appliance. No authentication or user interaction is required. LoadMaster is widely deployed as an ADC/load balancer in enterprise and government environments, making network-exposed management interfaces a high-value target.
  • Exploitation status: Actively exploited in the wild; added to CISA KEV 2026-08-07.
  • Remediation: Apply the vendor-supplied patch immediately. CISA BOD 26-04 deadline for federal agencies: 2026-08-10. Restrict management interface access to trusted IP ranges pending patching.

CVE-2026-63077 — JetBrains TeamCity (Unauthenticated RCE via XStream Deserialization)

  • STATUS CHANGE: Rapid7 published a full technical analysis and public proof-of-concept exploit on 2026-08-07. The exploit chain uses the unauthenticated agent polling endpoint (POST /app/agents/v1/commands/error) to deliver a crafted XStream gadget chain, writes a .jspws webshell to the TeamCity webroot via HSQLDB’s SCRIPT command, and achieves OS command execution. CISA KEV deadline was today (2026-08-08) — any unpatched instance must be treated as potentially compromised.
  • IOCs: In teamcity-server.log, look for ForbiddenClassException or ConversionException referencing HSQLMetadataStorage$SchemaMismatchException on POST /app/agents/v1/commands/error from unexpected IPs. In teamcity-javaLogging-*.log, look for HsqlException referencing .jspws file paths. Scan the TeamCity webroot for unexpected *.jspws files.
  • Remediation: Upgrade to TeamCity 2026.1.3 immediately. If already patched, hunt for webshells and review logs for prior exploitation attempts.

CVE-2026-64638 — WordPress Core (Pre-Auth Reflected XSS → PHP Code Execution)

  • Severity: CVSS 8.9
  • EPSS: 0 (newly published)
  • Technical detail: A reflected XSS vulnerability on the WordPress login screen affects all versions. Researcher pwn.ai demonstrated that the flaw can be chained into server-side PHP code execution when a logged-in administrator visits an attacker-controlled page — effectively enabling unauthenticated-to-RCE via social engineering. The attack surface is every public-facing WordPress login page. BSI advisory WID-SEC-2026-2701 covers this and related WordPress issues.
  • Exploitation status: No confirmed in-the-wild exploitation; public chain demonstrated.
  • Remediation: Apply the WordPress core patch immediately. Enforce CSP headers on login pages; educate administrators about phishing links.

CVE-2026-64637 — Plesk (Authenticated Reseller → Root Admin Session Hijack)

  • Severity: CVSS 9.9
  • EPSS: 0 (newly published)
  • Technical detail: An improper privilege management flaw in Plesk’s XML-RPC API allows an authenticated reseller-level user to obtain an administrative session for the root account. Affects Plesk before 18.0.80.1. Plesk is widely used by European hosting providers and MSPs; a compromised reseller account — obtainable via credential stuffing or phishing — becomes a full root compromise of the hosting panel.
  • Exploitation status: No confirmed exploitation.
  • Remediation: Upgrade Plesk to 18.0.80.1 or later. Audit reseller account activity; enforce MFA for all Plesk accounts.

Metabase SQL Injection Zero-Day (CVE pending) — Actively Exploited

  • Severity: Critical (CVE not yet assigned in available data)
  • Technical detail: A SQL injection vulnerability in Metabase was exploited as a zero-day before a patch was available, resulting in confirmed data theft at Framework (laptop manufacturer) and Tally. Metabase is commonly deployed as a self-hosted business intelligence and analytics platform in enterprise environments. The attack vector and affected versions are confirmed by Metabase’s own security advisory; Heise and Bleeping Computer both reported active exploitation.
  • Exploitation status: Actively exploited in the wild (zero-day at time of attack).
  • Remediation: Apply Metabase’s emergency patch immediately. Audit Metabase instance logs for unauthorized query execution; treat any exposed instance as potentially compromised pending investigation.

ONGOING:

  • CVE-2026-63077 (TeamCity): CISA KEV deadline today — patch to 2026.1.3; hunt for .jspws webshells if previously unpatched.
  • CVE-2026-19149 / CVE-2026-19170 (Chrome): Update to 151.0.7922.109+; BSI WID-SEC-2026-2695 confirms.
  • CVE-2026-66909 / CVE-2026-68079 (Apache CXF): Upgrade to 3.6.12 / 4.1.8 / 4.2.3; patch still required.
  • CVE-2026-65667 (Microsoft Teams CVSS 10.0): Monitor Microsoft remediation confirmation; keep clients updated.
  • CVE-2026-9198 (IBM Langflow): CISA KEV deadline passed — patch immediately if not done.
  • CVE-2026-34486 (Apache Tomcat): CISA KEV deadline passed — apply latest release.
  • CVE-2026-16232 (Check Point SmartConsole): Actively exploited — treat unpatched instances as compromised.
  • CVE-2026-0257 (PAN-OS GlobalProtect): Qilin ransomware exploitation ongoing — patch immediately.

European Advisories

BSI published a new batch of advisories on 2026-08-07. Key new items:

[NEU] WID-SEC-2026-2702 — Arista VeloCloud Orchestrator: An unauthenticated remote attacker can execute arbitrary code with root privileges. Arista VeloCloud is deployed in enterprise SD-WAN environments across European organizations. Apply vendor patches immediately; restrict orchestrator management access to trusted networks.

[NEU] WID-SEC-2026-2703 — Flowise (UNPATCHED): Multiple vulnerabilities enabling security bypass, information disclosure, and data manipulation. No patch is currently available. Flowise is an open-source LLM workflow builder increasingly used in enterprise AI pipelines. Isolate Flowise instances from public networks; monitor for vendor patch release.

[NEU] WID-SEC-2026-2699 — Wazuh: Multiple vulnerabilities including RCE, privilege escalation, DoS, information disclosure, data manipulation, and SQL injection. Wazuh is widely deployed as a SIEM/XDR platform in European SOC environments. Apply Wazuh updates immediately; a compromised SIEM platform has severe detection-gap implications.

[NEU] WID-SEC-2026-2690 — Sophos Endpoint: A local attacker can escalate privileges and execute arbitrary code with administrator rights. Apply Sophos Endpoint updates; monitor for local privilege escalation attempts on managed endpoints.

[NEU] WID-SEC-2026-2701 — WordPress: Covered in Critical Vulnerabilities (CVE-2026-64638).

BSI also published new advisories for Microsoft Azure/Entra (WID-SEC-2026-2689), Microsoft Teams/Azure Managed Instance/Service Bus (WID-SEC-2026-2692), Microsoft Power Apps (WID-SEC-2026-2688), Microsoft SharePoint Online XSS (WID-SEC-2026-2691), Apache Portable Runtime (WID-SEC-2026-2697), and Google Chrome (WID-SEC-2026-2695). Apply respective vendor patches. Updates were also issued for GNU libc (kritisch), Linux Kernel (multiple advisories), Bouncy Castle, PHP, ffmpeg, ISC BIND, and Red Hat Ansible Automation Platform — apply per standard patch cycles.

Active Threats and Campaigns

NEW — ~800 Malicious npm Packages Delivering Cross-Platform RAT/Infostealer: A campaign published nearly 800 typosquatting and AI-generated package names to the npm registry, delivering a cross-platform RAT and infostealer targeting Windows, macOS, and Linux. This follows the separately reported Shai-Hulud worm targeting the keyv package and 440+ npm packages (reported by Heise). Audit npm dependency trees immediately; enforce lockfile integrity and use tools such as npm audit or Socket.dev. Remove any recently added unrecognized packages from CI/CD pipelines.

NEW — UNC6671 Vishing Campaign Targeting SaaS Data (Financial Services): UNC6671 is actively targeting employees at financial services, private equity, and professional services firms via voice phishing, impersonating IT help desk staff. Attackers contact employees on personal phones to bypass enterprise controls, then steal SaaS-hosted data for extortion. Brief staff on this TTP; enforce MFA on all SaaS access; monitor for bulk downloads from SharePoint, OneDrive, and similar platforms. Source: The Hacker News

NEW — Microsoft 365 AitM Phishing Campaign (Payroll/Finance Targeting): An active widespread campaign uses adversary-in-the-middle phishing with residential proxies to hijack Microsoft 365 accounts, specifically targeting personnel involved in financial workflows to harvest payroll and finance emails. Enable Entra ID Conditional Access policies blocking legacy authentication; alert on sign-ins from residential proxy ranges. Source: The Hacker News

ONGOING — ClickFix macOS infostealer (crypto/credential theft): No new developments; update macOS EDR signatures and alert on unexpected osascript execution. ONGOING — ChainDrop npm supply-chain worm: Audit GitHub Actions runner secrets; enforce least-privilege scoping. ONGOING — Kali365 device-code phishing (M365): Block OAuth device-code flow in Entra ID Conditional Access.

Security News and Context

  • Linux SCTP use-after-free (18-year-old flaw): A use-after-free in Linux’s SCTP networking stack — present since 2008 — allows local users to gain root and escape containers; patched in kernels 7.1.6, 6.18.42, 6.12.101, and 6.6.148 (released 2026-08-03). The Hacker News
  • Windows Hello for Business key abuse: Researcher Dirk-jan Mollema demonstrated that malware in a signed-in Windows session can silently use the victim’s WHfB key to authenticate to Entra ID, register attacker-controlled devices, and obtain a Primary Refresh Token — enabling persistent cloud access. The Hacker News
  • Levi Strauss corporate data theft: Attackers used social engineering against three employees to steal corporate data; highlights ongoing BEC/social engineering risk to large enterprises. Bleeping Computer
  1. Progress LoadMaster (CVE-2026-8037): Apply vendor patch immediately; CISA deadline 2026-08-10. Restrict management interface access to trusted IPs.
  2. JetBrains TeamCity (CVE-2026-63077): CISA deadline expired today — if not patched, treat as compromised. Hunt for .jspws webshells in webroot; review server logs for exploitation IOCs.
  3. Metabase (zero-day SQLi): Apply emergency patch; audit query logs; treat exposed instances as potentially compromised.
  4. WordPress (CVE-2026-64638): Apply core patch immediately; enforce CSP on login pages.
  5. Plesk (CVE-2026-64637): Upgrade to 18.0.80.1; audit reseller accounts; enforce MFA.
  6. Wazuh (BSI WID-SEC-2026-2699): Apply Wazuh updates immediately; a compromised SIEM has critical detection-gap implications.
  7. Arista VeloCloud Orchestrator (BSI WID-SEC-2026-2702): Apply vendor patch; restrict orchestrator access to trusted management networks.
  8. Flowise (BSI WID-SEC-2026-2703, unpatched): Isolate from public networks; monitor for vendor patch.
  9. npm supply chain (~800 malicious packages + Shai-Hulud): Audit all npm dependencies; enforce lockfile integrity; scan CI/CD pipelines for unrecognized packages.
  10. Continue remediation of previously reported items: CVE-2026-19149/CVE-2026-19170 (Chrome), CVE-2026-66909/CVE-2026-68079 (Apache CXF), CVE-2026-65667 (Teams), CVE-2026-9198 (Langflow), CVE-2026-34486 (Tomcat), CVE-2026-16232 (Check Point), CVE-2026-0257 (PAN-OS), Sophos Endpoint (WID-SEC-2026-2690).