CVE-2026-18556, CVE-2026-18577, CVE-2026-86218
Get tomorrow's brief in your inbox
Today: N-able issued its fourth emergency hotfix in five weeks for a maximum-severity RCE flaw in N-central that the company contradicts itself on whether it's been exploited. A four-year BEC campaign stole €35 million from French notaries through 500+ network compromises. JetBrains disclosed that hackers breached its Cadence AI training platform via a TeamCity vulnerability and likely stole customer source code.
N-able N-central Unauthenticated RCE (CVE-2026-86218)
N-able released Hotfix 4 for N-central on September 6, addressing CVE-2026-86218, a CVSS 10.0 static code injection flaw allowing unauthenticated remote code execution on N-central servers. The vulnerability affects all on-premises N-central builds below 2026.3.1.14, including servers patched with Hotfix 3 just eight hours earlier. N-able's communications conflict on exploitation status: release notes state "no confirmations" of exploitation, while the incident notice claims the flaw "has been observed being exploited in the wild." Huntress investigated a customer compromise on September 4 but cannot confirm if CVE-2026-86218 was used due to log rotation. This marks the fourth hotfix since August 2, following CVE-2026-18577 (CISA KEV, EPSS 0.541/99th percentile, due August 6) and CVE-2026-18556 (CISA KEV, EPSS 0.402/99th percentile, due August 7), both confirmed as exploited. N-able assigned all three CVEs as the CNA.
MikroTik Critical Vulnerability
SANS Internet Storm Center flagged a critical MikroTik vulnerability requiring immediate patching. Article excerpt provides no CVE, affected versions, or technical details beyond urgency.
2 claims tracked across 2 groups in the last 48 hours. These are unverified claims from ransomware leak sites.
| Group | Victim | Sector | Country |
|---|---|---|---|
| Kazu | MSM Unify | Education Technology | Canada |
| Blacklocks | Kwangmyung Industry (광명산업) | Automotive Manufacturing | South Korea |
Four-Year BEC Campaign Nets €35M from French Notaries
Hackers stole over €35 million from French notary offices through a sustained BEC campaign affecting more than 500 victims (7% of all French notaries) over four years. Attackers breached firms via phishing, established persistent network access, and silently modified transaction details to hijack wire transfers. France's ANSSI spent two years working behind the scenes to help victims remediate. Investigators initially feared attackers might issue fake notarized acts (marriage certificates, real estate deeds) for citizenship fraud schemes but found no evidence of forged documents to date. French notaries now require two-factor authentication for notary-specific operations and prohibit sending banking details via email. Banks added procedural checks in 2024, but BEC attacks continued. ANSSI described the threat actors as particularly persistent with deep access.
JetBrains Cadence Cloud Platform Breach
JetBrains disclosed a breach of its Cadence cloud-based LLM training platform in August. Attackers exploited a vulnerability in JetBrains' own TeamCity servers to gain access. JetBrains warns hackers likely stole any source code or credentials customers were storing in Cadence instances.
$320M Cryptocurrency Heist - Liquid Network
Blockstream paused its Liquid Network cryptocurrency platform after unknown individuals extracted $320 million in Bitcoin. The attackers left a message on the blockchain claiming to be white-hat security researchers and asked the company to reach out. If confirmed malicious, this becomes the largest crypto-heist of 2026.
JSCeal Malware Campaign via Fake Crypto Sites
Check Point documented JSCeal, a sophisticated compiled V8 JavaScript malware targeting cryptocurrency traders through malvertising on Facebook and Google. The campaign, overlapping with WEEVILPROXY/MeadowLocust, uses fake TradingView and crypto trading sites to distribute Node.js-based malware. JSCeal harvests credentials, cookies, and OAuth tokens from Chromium-based browsers (Chrome, Edge, Brave, Opera, Vivaldi, Avast Secure Browser, Cốc Cốc). The malware uses stolen session cookies to conduct active session replay attacks, bypassing authentication to hijack Google accounts. The malware is protected with javascript-obfuscator using RC4-protected strings, control-flow flattening, and proxy functions. Confiant's SourTrade research shows the campaign has been active since late 2024, targeting retail traders across 12 countries in 25 languages, primarily in APAC and Latin America. The landing pages deliver assembly instructions to victims' browsers, which build the malware in memory without finished malware ever existing on the network.
Two Major US Law Firms Disclose Breaches
Quinn Emanuel and McDermott, two major US law firms, disclosed security breaches. No details on scope or timeline provided in the excerpt.
Roanoke, Virginia Delays Breach Notification Three Months
The city of Roanoke, Virginia, took three months to notify residents of a May data breach. Hackers accessed a local government department system for five days and stole internal documents. City officials face criticism for the notification delay.
Natural Resources Wales Data Breach
Natural Resources Wales exposed sensitive employee information (ethnicity, disability status, religion, sexual orientation, caring responsibilities) through accidental publication of an internal spreadsheet on its website. The breach was due to human error and affects current and former employees.
US Offers $10M Bounty for Iranian Cyber Official
The State Department posted a $10 million reward for information on Amir Yaryab, alleged leader of the Islamic Revolutionary Guard Corps' Cyber-Electronic Command (IRGC-CEC). U.S. officials accuse Yaryab of directing Iranian hacking groups targeting critical infrastructure sectors including defense, news, and shipping.
UK Cybersecurity Bill Excludes Executive Personal Liability
UK peers are questioning why proposed cybersecurity legislation does not include personal liability provisions for executives. Details limited in excerpt.
CVE-2026-86218 - N-able N-central Static Code Injection
Maximum severity (CVSS 10.0) static code injection (CWE-96) in N-able N-central allowing unauthenticated remote code execution. Affects all builds before 2026.3.1.14. Conflicting statements on whether exploited in the wild. This is the third distinct vulnerability set requiring hotfixes since August 2, following CVE-2026-18577 and CVE-2026-18556 (both CISA KEV, both exploited).
RMM platforms remain high-value targets. N-able's fourth emergency patch in five weeks, combined with previous CISA KEV additions for this product line, demonstrates persistent attacker interest in IT management infrastructure. The French notary BEC campaign's four-year duration and 500+ victim count shows sophisticated persistence in business email compromise operations. Cryptocurrency platforms continue as major targets with the Liquid Network $320M incident potentially becoming the year's largest crypto-heist.