Daily Threat Briefing
← All briefings

Fabrik Extension for Joomla · Mailgun for WordPress · NLTK

Date: 2026-08-23 Prepared for: SOC Analysts | Incident Responders | Vulnerability Management | Security Leadership

Executive Summary

Today’s new vulnerability data is dominated by a large cluster of critical flaws in the Fabrik extension for Joomla (multiple CVSS 10.0 unauthenticated RCE and path traversal CVEs) and a separate batch of security vulnerabilities in the NLTK Python NLP library. A notable EPSS-scored SSRF in the Mailgun for WordPress plugin (EPSS 0.53) warrants attention for WordPress environments. No new CISA KEV entries, government advisories, or active campaign updates were published in the last 24 hours. Previously reported items dominate the action queue.

Critical Vulnerabilities

CVE-2026-76604 / CVE-2026-76605 / CVE-2026-76606 / CVE-2026-76607 / CVE-2026-76602 / CVE-2026-76571 — Fabrik Extension for Joomla (Multiple Critical Flaws)

  • Severity: CVSS 10.0 (RCE/path traversal entries); CVSS 9.3 (SQL injection entries)
  • EPSS: 0.0 — newly published; no exploitation observed yet
  • Technical detail: Six CVEs published simultaneously cover the full attack surface of the Fabrik data management extension for Joomla (versions 1.0.0–4.7.3). CVE-2026-76604 is the most severe: the PHP form element executes user-supplied code without sanitization, enabling unauthenticated RCE. CVE-2026-76605 and CVE-2026-76606 allow RCE and path traversal via the image element. CVE-2026-76607 exposes a missing ACL check in the download element. CVE-2026-76602 and CVE-2026-76571 are unauthenticated SQL injection flaws in list ORDER BY and filter condition parameters respectively. Any internet-facing Joomla site running Fabrik is at immediate risk of full compromise without authentication.
  • Exploitation status: No confirmed exploitation; CVSS 10.0 unauthenticated RCE in a widely deployed Joomla extension warrants urgent treatment.
  • Remediation: Upgrade Fabrik to ≥ 4.7.3 immediately. If patching is not immediately possible, disable the Fabrik extension and restrict access to Joomla admin interfaces. Audit web server logs for anomalous POST requests to Fabrik endpoints.

CVE-2026-78003 — Mailgun for WordPress (SSRF via Path Traversal)

  • Severity: CVSS 9.8
  • EPSS: 0.53 — high exploitation probability
  • Technical detail: The Mailgun for WordPress plugin (versions ≤ 2.2.0) fails to validate path input, allowing an unauthenticated attacker to perform server-side request forgery via path traversal. In WordPress environments, SSRF can be leveraged to probe internal network services, access cloud metadata endpoints (e.g., AWS IMDSv1), or pivot to internal infrastructure. The EPSS score of 0.53 indicates meaningful real-world exploitation probability.
  • Exploitation status: No confirmed exploitation; elevated EPSS warrants prioritized patching.
  • Remediation: Update Mailgun for WordPress to a patched release. If running on cloud infrastructure, verify IMDSv2 is enforced (AWS) or equivalent metadata endpoint protections are in place. Review outbound HTTP request logs from the WordPress host.

CVE-2026-71513 / CVE-2026-63310 / CVE-2026-63312 / CVE-2026-62388 / CVE-2026-62384 — NLTK (Multiple Security Flaws)

  • Severity: CVSS 8.7 across entries
  • EPSS: 0.0 — newly published
  • Technical detail: Five CVEs published against the Natural Language Toolkit (NLTK) Python library span multiple vulnerability classes. CVE-2026-71513 (< 3.10.3) is the most critical: AllowlistUnpickler validates only the pickle module string, not the global name, enabling RCE via dotted-name resolution in crafted pickle data. CVE-2026-63310 (< 3.9.3) allows MitM or DNS-poisoning attacks to inject malicious packages during download due to missing integrity verification. CVE-2026-63312 and CVE-2026-62384 enable arbitrary local file reads via StreamBackedCorpusView and symlink attacks in FramenetCorpusReader. CVE-2026-62388 (< 3.10.0) disables all path security enforcement by defaulting ENFORCE=False. NLTK is widely used in data science, ML pipelines, and research environments.
  • Exploitation status: No confirmed exploitation.
  • Remediation: Upgrade NLTK to ≥ 3.10.3 (addresses all listed CVEs). Do not load NLTK corpora or pickle data from untrusted sources. Audit ML pipeline environments for NLTK version compliance.

CVE-2026-47895 — strongSwan (Double-Free / DoS)

  • Severity: CVSS 7.5
  • EPSS: 0.0 — newly published
  • Technical detail: In strongSwan before 6.0.7, EAP-Identity parsing produces an empty but non-NULL encoding that is not correctly cloned, triggering a double-free when the duplicate is released. This affects the IKE daemon and can be triggered remotely during EAP authentication negotiation, potentially causing daemon crash or, in edge cases, memory corruption. Relevant for any organization using strongSwan for IPsec VPN infrastructure — common in European enterprise and government environments.
  • Exploitation status: No confirmed exploitation.
  • Remediation: Upgrade strongSwan to ≥ 6.0.7. If immediate upgrade is not possible, restrict IKE/EAP endpoint exposure to trusted IP ranges.

ONGOING:

  • CVE-2026-19478 (GitLab): Actively exploited — apply latest security release; audit repository logs.
  • CVE-2026-72529 / CVE-2026-72530 (TrueConf): KEV deadline was 2026-08-23 — patch immediately or block port 4307/TCP.
  • CVE-2026-73570 (Zimbra ZCS): KEV deadline 2026-08-24 — patch today; audit for web shells.
  • CVE-2026-68820 (Windows AFD/Lazarus): KEV deadline 2026-08-25 — apply August Patch Tuesday.
  • CVE-2026-69502 (Azure SQL): Verify Microsoft service-side patch; review IAM and audit logs.
  • CVE-2026-48749 cluster (Incus): Upgrade to ≥ 7.3.0; restrict image/backup sources.
  • CVE-2026-61539 (Xinference): Upgrade to ≥ 2.7.0; restrict API network exposure.
  • CVE-2026-64849 (MLflow SSRF): KEV deadline 2026-09-02 — patch and audit IAM.
  • CVE-2026-77647 / CVE-2026-77806 (SPIP): Upgrade to ≥ 4.4.21.
  • CVE-2026-69414 (Microsoft Defender ShieldBreak): No patch available — monitor MSRC.

European Advisories

No new BSI WID or CERT-EU advisories were published in the last 24 hours.

ONGOING updates:

  • WID-SEC-2026-2962 (Apache CloudStack): Covered in yesterday’s report — upgrade to ≥ 4.20.4.0 or ≥ 4.22.2.0.
  • WID-SEC-2026-2964 (TP-Link Omada): Apply firmware updates; no change.
  • WID-SEC-2026-2963 (PTC Windchill/FlexPLM): Apply PTC patches; restrict external access.
  • WID-SEC-2026-2951 (Microsoft Azure/Entra ID/Exchange): Apply current Microsoft patches; CVE-2026-69502 remains ONGOING above.

Active Threats and Campaigns

No new campaigns or material updates to existing campaigns were published in the last 24 hours.

ONGOING:

  • RedC2 4.0 npm supply chain: 14 trojanized packages identified — audit npm dependency trees, rotate secrets from affected build environments.
  • SynkLoader / Microsoft Teams phishing: Enforce Teams external access policies; monitor EDR for fake lock screen activity.
  • FTP Banner RAT delivery (E4del / PINHOLE): Hunt for anomalous FTP banner content and unexpected outbound connections.
  • Berlin Senatsverwaltungen cyberattack: Two agencies remain isolated; no new public developments.
  • Rust supply chain, Russian OAuth clusters (UNC6293/UNC7005/UNC5976), UAT-10147/SPECTRE, ToxicPanda 2.0: No material new developments; prior guidance applies.

Security News and Context

  • TikTok $400M child privacy settlement: ByteDance agreed to pay $400 million to the U.S. DoJ to settle a 2024 lawsuit alleging violations of child privacy laws; $300M payable immediately. (The Hacker News)
  • Windows Named Pipes security guidance: ThreatLocker published analysis on securing Windows IPC named pipes against privilege escalation via weak access controls — relevant for endpoint hardening programs. (Bleeping Computer)
  1. Fabrik for Joomla (CVE-2026-76604 cluster): Upgrade to ≥ 4.7.3 immediately; disable extension if patching is delayed; audit web logs for exploitation attempts.
  2. Mailgun for WordPress (CVE-2026-78003): Update plugin; enforce IMDSv2 on cloud-hosted WordPress instances; review outbound HTTP logs.
  3. NLTK (CVE-2026-71513 cluster): Upgrade to ≥ 3.10.3 across all ML/data science environments; prohibit loading untrusted pickle or corpus data.
  4. strongSwan (CVE-2026-47895): Upgrade to ≥ 6.0.7; restrict IKE/EAP endpoints to trusted IP ranges if patching is delayed.
  5. TrueConf (CVE-2026-72529/72530): KEV deadline today — patch or block port 4307/TCP immediately.
  6. Zimbra ZCS (CVE-2026-73570): KEV deadline tomorrow (2026-08-24) — patch today; audit for web shells and unauthorized accounts.
  7. Windows AFD/Lazarus (CVE-2026-68820): KEV deadline 2026-08-25 — apply August Patch Tuesday without further delay.
  8. Continue remediation of previously reported items: CVE-2026-19478 (GitLab — actively exploited), CVE-2026-69502 (Azure SQL), CVE-2026-48749 cluster (Incus), CVE-2026-61539 (Xinference), CVE-2026-64849 (MLflow — deadline 2026-09-02), CVE-2026-77806 (SPIP ≥ 4.4.21), CVE-2026-69414 (Defender ShieldBreak — no patch, monitor).