Cyber Threat Brief

---

Today: Microsoft's August Patch Tuesday drops 421 CVEs with one actively exploited zero-day (CVE-2026-68820) used by North Korea's Lazarus group in Operation Dream Job attacks against defense and aerospace targets. Cisco patches a firewall zero-day (CVE-2026-20349) hitting ASA/FTD SSL VPN with a CISA KEV deadline of August 14. The Gunra ransomware gang is weaponizing old Fortinet flaws to breach critical infrastructure, and a two-part SharePoint exploit chain now has both halves publicly documented.

Critical Alerts

Windows WinSock Driver Zero-Day Exploited by Lazarus (CVE-2026-68820)

A use-after-free in the Windows Ancillary Function Driver for WinSock (afd.sys) allows a locally authenticated attacker to trigger a race condition and escalate to SYSTEM privileges. CVSS 7.0. Check Point Research confirmed Lazarus exploited this as a zero-day in Operation Dream Job, deploying a new version of the FudModule kernel-mode rootkit to disable EDR visibility. This is the fourth afd.sys zero-day exploited in the wild since 2022, following CVE-2024-38193 (Lazarus/North Korea), CVE-2025-21418, and CVE-2025-32709. CISA KEV deadline: August 25, 2026.

• Action: Apply August cumulative updates immediately on all Windows endpoints and servers. Monitor for suspicious privilege escalation from low-privilege accounts. Review unsolicited recruiting outreach and block IOCs from the Check Point Operation Dream Job report.
• Sources: Check Point Research | SecurityWeek | CrowdStrike | CISA KEV

Cisco ASA/FTD Firewall Zero-Day, Remote DoS (CVE-2026-20349)

A heap inspection vulnerability in Cisco Secure Firewall ASA and FTD software allows an unauthenticated remote attacker to cause device reload via crafted HTTP request to the Remote Access SSL VPN service. CVSS 8.6. Affects devices with IKEv2 Remote Access VPN, SSL-VPN, or Zero Trust Network Access2 enabled. Cisco confirmed active exploitation in August 2026. CISA KEV deadline: August 14, 2026. No workarounds available.

• Action: Apply hotfixes immediately. ASA 9.16 through 9.24 and FTD 7.0 through 10.0 all have specific hotfix builds. This is the 12th Cisco KEV addition this year. Deadline is two days away for federal agencies.
• Sources: SecurityWeek | The Hacker News | CISA

Metabase SQL Injection Under Active Exploitation (CVE-2026-72898)

CISA added CVE-2026-72898, a SQL injection vulnerability in the Metabase analytics platform, to the KEV catalog based on evidence of active exploitation. EPSS 0.007 (49th percentile). CISA KEV deadline: August 14, 2026.

• Action: Patch Metabase instances immediately. Check access logs for signs of SQLi exploitation.
• Source: CISA

ShieldBreak: Defender Patch Bypass PoC with 100% Success Rate (CVE-2026-50656 bypass)

The researcher Chaotic Eclipse released ShieldBreak, a full patch bypass for the RoguePlanet vulnerability (CVE-2026-50656, CVSS 7.8) in Microsoft Defender's Malware Protection Engine (mpengine.dll). The PoC achieves SYSTEM-level shell access on Windows 11 25H2 and Windows Server 2025 with a claimed 100% success rate. Windows 10 is also vulnerable. Microsoft is investigating. EPSS for CVE-2026-50656 is 0.107 (95th percentile).

• Action: Monitor for Microsoft's response. No patch available yet for the bypass. Watch for Defender engine updates (mpengine.dll). Layered EDR beyond Defender is prudent.
• Source: The Hacker News

Ransomware Claims (Last 48h)

Group	Victim	Sector	Country
Kraken	Ginger Consulting	Consulting	Unknown

1 claim tracked across 1 group in the last 48 hours. These are unverified claims from ransomware leak sites.

Ransomware & Extortion

Gunra Ransomware Gang Exploiting Fortinet Flaws, Bypassing MFA

The FBI and South Korean government issued a joint advisory on Gunra, a RaaS operation based on leaked Conti source code that emerged in spring 2025. Gunra operators are exploiting CVE-2024-55591 (CVSS critical, EPSS 0.983/100th percentile, CISA KEV) and CVE-2025-24472 (high severity, EPSS 0.039/89th percentile, CISA KEV) in FortiOS/FortiProxy for initial access. In one case, affiliates hijacked an SSL-VPN appliance to harvest credentials and session cookies, then modified the corporate VDI authentication portal to accept a designated OTP value, permanently bypassing MFA. Gunra affiliates also deleted backups at both primary and disaster recovery sites before deploying ransomware.

• Action: Patch FortiOS/FortiProxy if not already done. Audit VPN appliance configurations for unauthorized admin accounts or modified authentication files. Monitor identity infrastructure for credential dumping. Verify backup integrity and isolation.
• Sources: Dark Reading | The Register

DeadLock Ransomware Uses Blockchain-Backed Infrastructure

Microsoft Threat Intelligence documented DeadLock, a double-extortion group active since July 2025 with 96 claimed victims across Italy, Spain, Poland, Turkey, and the US. DeadLock uses Session messaging and Polygon smart contracts for victim communications and data leak operations. The ransomware uses Curve25519 + XChaCha20 encryption, deletes Volume Shadow Copies, disables logging via Registry manipulation, and uses AnyDesk for remote control. It drops an interactive HTML ransom note that functions as a self-contained single-page app with E2E encrypted chat and a file browser, all without a traditional backend.

• Action: Block AnyDesk if not authorized. Monitor for ".dlock" file extensions and wallpaper changes. Detection: watch for PowerShell stopping non-allowlisted services and VSS deletion.
• Source: The Hacker News

Business & Infrastructure Threats

LiteLLM Supply Chain Attack Exposed 2,500+ Organizations

CloudSEK reports the LiteLLM Python library was compromised via a cascading supply chain attack originating from the Aqua Security Trivy compromise. Two malicious PyPI versions (1.82.7, 1.82.8) were live for 40 minutes but propagated to 434,000 CI/CD pipelines across 2,500+ organizations including Nvidia, AWS, Samsung, Cisco, and Siemens. The payload executed on every Python invocation, exfiltrating package publishing credentials, cloud keys, SSH keys, tokens, and AI provider keys.

• Action: Verify LiteLLM version is not 1.82.7 or 1.82.8. Rotate any secrets accessible to LiteLLM processes. Review CI/CD pipeline logs for the affected time window. Pin dependency versions and verify checksums.
• Source: SecurityWeek

SonicWall Patches Critical RCE in Discontinued GMS Platform

SonicWall fixed six vulnerabilities in Global Management System (GMS), which was retired in October 2025. CVE-2026-66147 (CVSS 9.4) is a command injection in the GMS Dispatcher Service. CVE-2026-66145 (CVSS 9.1) is an RCE with arbitrary file write via zipslip. Two additional high-severity code injection flaws (CVE-2026-66149, CVE-2026-66150) in Email Security allow OS command execution with root privileges.

• Action: Update GMS to 9.5.2 and Email Security to 10.0.36. If GMS is still running post-retirement, evaluate migration to a supported platform.
• Source: SecurityWeek

SharePoint Exploit Chain: Unauthenticated RCE via Auth Bypass + Code Execution

Rapid7 disclosed a two-vulnerability chain against on-premises SharePoint. CVE-2026-55040 (CVSS 9.1) is an authentication bypass in the JWT validation pipeline that lets an unauthenticated attacker impersonate any user, including administrators, given a known SID or UPN. CVE-2026-63520 (CVSS 8.1) is an unsafe .NET type instantiation in Business Connectivity Services enabling code execution as the SharePoint service account. July's patch (KB5002882/KB5002883/KB5002891) breaks the chain. August completes the RCE fix. CISA rated the bypass as automatable with total technical impact.

• Action: Confirm July SharePoint updates are installed. Apply August updates when available. SharePoint 2016 and 2019 reached end of support July 14; evaluate migration urgency.
• Sources: The Hacker News | The Hacker News

Windows / AD Security

Microsoft August Patch Tuesday: 421 CVEs, 62 Critical

Microsoft's second consecutive mega-release patches 421 CVEs: 236 in Windows, 98 in Office, 98 in Office 2016, 30 in SharePoint, 26 in Developer Tools, 17 in Azure, 7 in Exchange. 180 are elevation of privilege issues. One zero-day under active exploitation (CVE-2026-68820), two publicly disclosed (CVE-2026-62832, CVE-2026-72971). Microsoft attributes the volume increase to AI-assisted vulnerability discovery.

Key critical/high-priority CVEs beyond CVE-2026-68820:

• CVE-2026-62878 (CVSS 9.8) - Windows DNS Server stack-based buffer overflow. Unauthenticated, no user interaction. ZDI describes it as wormable.
• CVE-2026-62893 (CVSS 9.8) - Windows Deployment Services TFTP Server use-after-free. Unauthenticated RCE.
• CVE-2026-62815 (CVSS 9.8) - Microsoft QUIC use-after-free. Unauthenticated remote code execution.
• CVE-2026-59124 (CVSS 9.8) - HPC Pack deserialization RCE. Not installed by default but exploitation rated "more likely."
• CVE-2026-62832 (CVSS 7.8) - Windows User Profile Service EoP. Publicly disclosed (LegacyHive). Pairs with CVE-2026-68820 for initial foothold to full compromise.
• CVE-2026-62911 (CVSS 8.0) - Exchange Server authentication bypass via capture-replay. EoP over network.
• CVE-2026-49179 - Windows Active Directory Domain Services command injection RCE over network.
• CVE-2026-62830 (CVSS 9.9) - Azure SRE Agent missing authorization EoP. Exploitation "less likely."

• CVE-2026-50516 (CVSS 9.4) - Azure Kubernetes Service missing authentication EoP.

• Action: Deploy August cumulative updates. Prioritize CVE-2026-68820 (exploited), then the four CVSS 9.8 unauthenticated RCEs (DNS, WDS, QUIC, HPC). For Exchange, apply the capture-replay fix. Verify AD DS is patched for CVE-2026-49179.

• Sources: Talos | Dark Reading | SecurityWeek | CrowdStrike | SANS ISC | Krebs on Security

General Security News

OpenAI Launches GPT-5.6-Cyber for Exploit Development

OpenAI released GPT-5.6-Cyber through its Daybreak Red program, a cybersecurity-focused model with reduced refusals for exploit development, authentication bypass, and privilege escalation tasks. The model completes 95% of advanced cybersecurity prompts vs. 1.5% for the standard GPT-5.6 Sol. It discovered CVE-2026-15903 (CVSS 8.8), a V8 engine out-of-bounds read/write, and over 400 kernel privilege escalation vulnerabilities. Access is limited to trusted partners including CrowdStrike, Palo Alto Networks, and Cisco.

• Source: The Hacker News

ICS Patch Tuesday: Siemens, Schneider, Phoenix Contact

Siemens published 10 advisories including a maximum-severity missing-authentication vulnerability in Simatic IoT2050 Advanced devices allowing unauthenticated remote code execution, and a critical code execution flaw in Siveillance Video Management Servers. Schneider fixed code/command execution in NetBotz 5. Phoenix Contact patched multiple flaws in PLCnext firmware.

• Action: Review vendor advisories for any deployed ICS products. Prioritize the Simatic IoT2050 and Siveillance patches.
• Source: SecurityWeek

Operation Dream Job Campaign Targets Defense Sector

Beyond the zero-day exploitation, Lazarus distributed trojanized PDF viewers (SecurityPDF) that execute the new Troy backdoor (17 operator commands including file exfil, shell access, DLL injection) via DLL sideloading. Compromised Roundcube servers (CVE-2025-49113, EPSS 0.977/100th percentile, CISA KEV) serve as C2 relay nodes via RelayShell, a new PHP webshell. Targets include defense, aerospace, and aviation organizations in France, Germany, Brazil, and India.

• Action: Block IOCs from the Check Point report. Patch Roundcube instances against CVE-2025-49113. Scrutinize unsolicited recruiting outreach in defense/aerospace organizations.
• Sources: Check Point Research | SecurityWeek

Patch Priority

• Windows (all versions): August cumulative update. CVE-2026-68820 actively exploited, CVE-2026-62832 publicly disclosed. Both are EoP chains.
• Windows DNS Server: CVE-2026-62878 (CVSS 9.8), wormable stack overflow. Internet-facing DNS servers first.
• Cisco ASA/FTD: CVE-2026-20349 hotfixes. CISA deadline August 14. SSL VPN, IKEv2, and ZTNA configurations affected.
• SharePoint on-premises: July updates (break auth bypass chain) + August updates (RCE fix). 2016/2019 are end-of-life.
• SonicWall GMS/Email Security: GMS 9.5.2, Email Security 10.0.36. Critical RCE in a retired product.

Vulnerability Disclosures

Microsoft Office RCE Cluster

Nine RCE vulnerabilities affect Microsoft Office (CVE-2026-63515, CVE-2026-65657, CVE-2026-63532, CVE-2026-64898, CVE-2026-64903, CVE-2026-64909, CVE-2026-64910, CVE-2026-64911, CVE-2026-70130), all CVSS 7.8-8.4, involving heap overflows, integer overflows, and use-after-free conditions. Three Excel RCEs (CVE-2026-68794, CVE-2026-68816, CVE-2026-68804) also at CVSS 7.8. All covered by Office cumulative updates.

• Action: Apply Office cumulative updates. These require local exploitation (malicious documents).
• Source: Talos

Additional Windows/Azure CVEs of Note

CVE-2026-62816 - RMCAST heap overflow, RCE over adjacent network. CVE-2026-61936 - Windows Defender Firewall Service security feature bypass. CVE-2026-54984 - Windows Imaging Component heap overflow RCE. CVE-2026-50472 - Windows LUAFV heap overflow EoP. CVE-2026-58650 - VS Code security feature bypass. CVE-2026-65768 - Teams for Android path traversal RCE.

• Sources: MSRC

Trends & Context

August Patch Tuesday's 421 CVEs continues the AI-driven vulnerability discovery surge, with Microsoft warning this volume is the new normal. The Lazarus group's continued exploitation of afd.sys zero-days (four since 2022) shows nation-state actors systematically targeting core Windows kernel components. Supply chain risk escalated with the LiteLLM cascading compromise demonstrating how a single compromised dependency can propagate across 2,500+ organizations in minutes.