Affected Systems or Products

Mitigations / Workarounds

Upgrading to the release for your branch remediates this vulnerability; Metabase Cloud customers were patched automatically and do not need to take action. Given Metabase announced their Cloud instance was already attacked, users of this service should monitor communications from Metabase regarding whether their data was accessed. If the /api/session/reset_password endpoint on a self-hosted instance was publicly accessible, treat the instance as potentially compromised and take the following steps after upgrading:

1. Remove the Metabase instance from publicly accessible networks.

2. Revoke all active user sessions by deleting every row in the core_session table of the Metabase application database.

3. Review API keys and delete any that are unrecognized.

4. Review administrator accounts for unexpected changes.

5. Rotate credentials for every database connected to the instance.

6. Review data warehouse logs for signs of unauthorized access.

7. Review Metabase activity and query history for unexpected activity.

Organizations that cannot upgrade immediately should consider blocking network access to their Metabase instance, and if possible, block the /api/session/reset_password endpoint at the reverse proxy or firewall as a temporary workaround until the update can be applied.

Patches

Metabase Cloud instances have already received the fix from the vendor. Metabase has released patched point releases for each affected self-hosted branch (58 through 63). Administrators can find the version numbers for affected products in the Affected Systems and Products section above. Update instructions and patches can be accessed within Metabase’s official security advisory.

Indicators of Compromise (IoCs)

Metabase has published the specific request sequence attackers used to exploit the flaw that defenders can watch for:

• a POST request to /api/session/reset_password that returns a 400 http status code followed by

• a GET request to /api/user/current which returns a 200 http status code.

Organizations that find this pattern in Metabase server ingress logs or application logs should look for signs of post exploitation activity and review Metabase for unexpected administrator accounts, unrecognized API keys, and unusual query activity against connected data warehouses. Regardless of exploitation activity, rotation of Metabase connection API keys should be considered if the organization had ran a publicly accessible Metabase instance before the vulnerability was disclosed.

Technical Details

The vulnerability stems from how Metabase's Clojure codebase handles undeclared fields in the password-reset API. The affected endpoint, POST /api/session/reset_password, is intended to accept only a token and password.

Metabase’s password reset endpoint builds a database query used to look up the account being reset but does not restrict which fields it accepts in the reset request body. An attacker could add additional unexpected fields alongside the expected parameters. Metabase’s query-building layer treated one of those fields as a structured query condition rather than an identifier. An attacker therefore could splice arbitrary SQL into the lookup query that would run against the Metabase application database before any authentication check occurs.

This internal database access allows an attacker to manipulate the reset flow, take over an administrator account, and gain full control of the instance. Metabase’s fix strictly limits the reset flow to its expected inputs, so extra fields can no longer reach the query.

Researchers at Bishop Fox, who published a technical analysis after the disclosure, described the root cause as a failure to restrict undeclared fields in the request body rather than a classic string-concatenation flaw.

At the time of publication, no proof-of-concept exploit code had been publicly released, potentially reducing exploitation of this vulnerability to a limited number of attackers. However, Framework and Tally have both confirmed attackers leveraged this vulnerability to exfiltrate customer records, password hashes, and API tokens beginning as early as August 3rd, 2026.

Our Organizational Response

Beazley Security is monitoring client perimeter devices through our Exposure Management Platform to identify impacted devices and support organizations in remediation of any issues found.

We are also conducting threat hunts across our MDR environment to detect potential exploitation attempts against our clients.

If you believe your organization may have been impacted by this attack campaign and need support, please contact our Incident Response team.

Sources

• https://nvd.nist.gov/vuln/detail/CVE-2026-72898

• https://www.metabase.com/blog/security-update

• https://bishopfox.com/blog/critical-sql-injection-in-metabase-via-password-reset-cve-2026-72898

• https://www.techtimes.com/articles/324060/20260812/metabase-sql-injection-breached-five-companies-exposed-all-connected-database-credentials.htm

• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-72898

Affected Systems or Products

Mitigations / Workarounds

N-able advises that applying the hotfix is the only complete remediation. N-able has confirmed that build 2026.3.1.7 (2026.3 Hotfix 1) is the first release unaffected by CVE-2026-18577 and the related vulnerability CVE-2026-18556. If the hotfix cannot be applied right away, restrict access to the N-central console to trusted administrative networks and consider taking the server offline until it can be patched.

1. Upgrade self-hosted N-central instances to version 2026.3.1.7 or later immediately.

2. Review accounts and their permissions, rotate credentials for N-central administrative accounts, and enforce multi-factor authentication going forward.

Patches

Patches were already released at the time of advisory and can be found in N-able's user guide.

Indicators of Compromise (IoCs)

CVE-2026-18577 is listed in CISA's KEV catalog, and both N-able and Huntress have independently confirmed exploitation in the wild. Attackers have used the flaw to obtain administrator access to N-central, pivot into managed endpoints through the Take Control feature, and establish persistence by registering outbound Cloudflare tunnels as Windows services, an approach that survives reboots and avoids inbound firewall rules. You can take the following steps to determine whether a system has been compromised by this vulnerability:

• Review N-central admin logins and Take Control session history for unfamiliar source IPs or unexpected use of the built-in support account mspsupport@n-able.com, and check ui_access_control.log for anomalous entries.

• On endpoints managed through N-central, check the user Documents folder for an executable named svchost.exe and check for a Windows service registered as Cloudflared. N-able has also published logs at C:\ProgramData\GetSupportService_N-Central\Logs\BASupSrvc_*.log.gz that can help confirm unauthorized Take Control activity.

• Review account and permission changes and logins to the N-central console and Take Control sessions originating from unfamiliar IP addresses or from the built-in support account mspsupport@n-able.com, particularly sessions directed at domain controllers or other critical infrastructure.

N-able identified the following IP addresses in their advisory:

173[.]249[.]252[.]200

87[.]249[.]138[.]34

37[.]19[.]210[.]32

68[.]235[.]46[.]214

37.153.90[.]88

92.118.112[.]181

Including the following malicious domains:

mousears.synology[.]me

wagoosh.direct.quickconnect[.]to

who-ripped-one.direct.quickconnect[.]to

Technical Details

CVE-2026-18577 stems from an incomplete fix for an earlier N-central authentication bypass vulnerability, tracked as CVE-2026-18556 and patched in version 2026.2. N-able's own review of that earlier fix, prompted by a spike in licensing errors on self-hosted servers, found a second path around the same authentication check. At the time of publication, a publicly released proof of concept has not been identified for either. The mechanisms of this authorization bypass are likely very similar to the previous bypass and were likely developed in response to the previous vulnerability.

This is notable given that N-central was targeted in zero-day attacks as recently as last year. Because RMM platforms allow access to multiple organizations, they are attractive targets for threat actors, and other widely used RMM platforms have a similar history of being targeted to reach the many organizations they manage.

Our Organizational Response

Beazley Security is monitoring client perimeter devices through our Exposure Management Platform to identify impacted devices and support organizations in remediation of any issues found.

We are also conducting threat hunts across our MDR environment to detect potential exploitation attempts against our clients.

If you believe your organization may have been impacted by this attack campaign and need support, please contact our Incident Response team.

Sources

• https://nvd.nist.gov/vuln/detail/CVE-2026-18577

• https://status.n-able.com/2026/08/02/n-central-2026-3-hotfix-1-mitigation-for-cve-2026-18577/

• https://documentation.n-able.com/N-central/Release_Notes/GA/Content/N-central_2026.3_HF1_Release_Notes.htm

• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-18577

• https://www.huntress.com/blog/n-able-vulnerability-exploitation

Affected Systems or Products

Mitigations / Workarounds

Affected organizations should block the following command-and-control endpoints identified used for this attack:

• npm-cache[.]com - 104.21.35[.]216

• eth-mainnet.nodereal[.]io - 35.175.164[.]77

• go.getblock[.]io - 185.44.207[.]215

• eth.llamarpc[.]com - 172.67.167[.]200

• pypi-get[.]com - 172.67.136[.]8, 104[.]21.54.63

• js-mirror[.]com - 104.21.88[.]80, 172.67.174[.]77

If you believe that a machine has already been compromised, we do not advise cleaning in place and instead recommend reimaging or rebuilding affected machines from known good images.

Using pinned versions of libraries is also recommended to prevent this kind of attack if new malicious versions are released for any library.

Additionally, npm offers a npm config set min-release-age 3 configuration setting that will enforce a 48 to 72-hour delay on new package releases before installing them on your machine. This is advised for all developers using external packages. For machines running without human interaction, such as CI/CD pipelines, we advise not only pinning package versions but also disabling scripts on installation with the --ignore-scripts argument wherever possible.

Patches

While not strictly a patch, affected npm packages should be removed and purged from impacted machines. This involves removing the affected packages and installing pinned versions of the unaffected npm package with these commands:

• rm -rf node_modules/plain-crypto-js

• npm install --ignore-scripts

• npm cache clean --force

Indicators of Compromise (IoCs)

Network Activity

The following domains and IP addresses have been associated with malicious activity observed during this campaign.

Wiz Research has also identified the user-agent performing malicious calls as Bun/1.3.13

Files

The following file names and hashes have been identified as part of the malware’s execution.

Our Organizational Response

Beazley Security is conducting threat hunts across our MDR environment to detect potential exploitation attempts against our clients.

If you believe your organization may have been impacted by this attack campaign and need support, please contact our Incident Response team.

Sources

• www.wiz.io/blog/keyv-and-cacheable-npm-supply-chain-attack

• https://github.com/wiz-sec-public/wiz-research-iocs/blob/main/reports/keyv-packages.csv

Affected Systems or Products

Mitigations / Workarounds

Check Point released a single hotfix that remediates all three vulnerabilities; no separate action is required per CVE. Where immediate patching is not possible, apply these interim steps:

1. Restrict SmartConsole Trusted Clients (GUI clients) to specific, trusted IP addresses or subnets rather than Any. This closes the preconditions for CVE-2026-16232 and CVE-2026-62144.

2. Place the Management Server behind a firewall that permits only trusted administrative access and verify that implied rules for control connections are enabled.

Patches

Check Point released a hotfix on July 22nd, 2026 that addresses all three vulnerabilities. Hotfixes are confirmed as available for currently supported versions R81.20, R82, and R82.10. Further details are available in Check Point’s advisory and the corresponding GitHub security advisories linked in Sources.

Indicators of Compromise (IoCs)

On July 22nd, 2026, CISA added CVE-2026-16232 to its Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild. Check Point has published six attacker IP addresses observed in the activity:

• 151.241.99[.]207

• 151.241.99[.]233

• 158.62.198[.]182

• 192.142.10[.]99

• 139.28.37[.]250

• 194.213.18[.]137

Administrators can check for access in SmartConsole under Logs & Monitor > Logs & Events > Audit Logs View and search for events showing Authentication method: application token alongside connections to or from the listed IP addresses. CVE-2026-62144 and CVE-2026-62145 have not been reported as exploited as of publication.

Technical Details

CVE-2026-16232 is an authentication logic flaw that allows an authenticated attacker to obtain a valid login token, which allows access into the SmartConsole as an administrator. This allows an attacker to make modifications to the security policy and configuration within SmartConsole, effectively changing the security promises of existing deployments. Check Point has identified this as the only publicly exploited vulnerability in this release.

CVE-2026-62144 is another authentication issue but instead allows an attacker to bypass authentication entirely and perform various administrative commands directory on the management server. Check Point has specially identified the run-script and exec-command commands as vulnerable to abuse. These commands provide similar controls to the attacker and equally put the deployment at risk.

CVE-2026-62145 is a privilege escalation issue that allows an authenticated user to gain root access and subsequently perform commands which change the security controls on Security Management deployments.

Our Organizational Response

Beazley Security is monitoring client perimeter devices through our Exposure Management Platform to identify impacted devices and support organizations in remediation of any issues found.

We are also conducting threat hunts across our MDR environment to detect potential exploitation attempts against our clients.

If you believe your organization may have been impacted by this attack campaign and need support, please contact our Incident Response team.

Sources

• https://nvd.nist.gov/vuln/detail/CVE-2026-16232

• https://nvd.nist.gov/vuln/detail/CVE-2026-62144

• https://nvd.nist.gov/vuln/detail/CVE-2026-62145

• https://github.com/advisories/GHSA-m2xx-23gx-734v

• https://github.com/advisories/GHSA-qg2m-c9gf-4qvp

• https://github.com/advisories/GHSA-jh99-mm75-xrmv

• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-16232

• https://blog.checkpoint.com/security/security-advisory-action-required-active-exploitation-of-check-point-smartconsole-authentication-bypass-cve-2026-16232/

Affected Systems or Products

Mitigations / Workarounds

As active exploitation has been confirmed in the wild and Palo Alto have released fixes for this vulnerability, and affected organizations should apply patches as soon as possible. Ifimmediately updating is not an option, risk can be temporarily reduced by the following mitigation steps:

• Disable Authentication Override within the GlobalProtect portal. Configuration steps are included within Palo Alto’s original advisory.

• Restricting access to GlobalProtect to trusted networks where operationally feasible until patches can be applied.

• If Authentication Override is required, use a dedicated certificate exclusively for signing Authentication Override cookies and ensure keys are securely stored and managed.

Additionally, CISA recommends either turning off the vulnerable technologies or restricting the VPN access to them only to trusted IP addresses. It is suggested to monitor VPN connection logs for suspicious authentication patterns and to consider implementing additional authentication methods outside of GlobalProtect.

Indicators of Compromise (IoCs)

On July 20^th, Arctic Wolf reported multiple engagements in which Qilin ransomware affiliates exploited CVE-2026-0257 as the initial access vector. Following successful exploitation, the threat actors established GlobalProtect SSL VPN sessions from systems identifying themselves with the hostname “kali”. In the investigated intrusions, VPN sessions originated from the following IP addresses:

• 108.61.229[.]217

• 108.61.75[.]232

• 2.188.33[.]52

• 199.247.22[.]193

• 70.34.205[.]43

Arctic Wolf has made available and are updating this GitHub repository with additional IoCs related to the campaign.

Technical Details

Palo Alto suggests that the vulnerability came from an authentication bypass vulnerability in GlobalProtect which allows attackers to bypass security restrictions and establishunauthorized VPN connections. This vulnerability is being actively exploited in the wild by ransomware operaters, as reported by security researchers at Arctic Wolf.

To be exploited, specific conditions on the GlobalProtect portal must be met. First, the authentication override feature must be enabled. Then, an affected device would need to be configured in a way where the certificate used for the authentication override cookie mechanism is also used elsewhere, like the GlobalProtect portal or the gateway HTTPS service. If this is the case, threat actors may be able to derive the public key, enabling the crafting of malicious override cookies. A possible attack chain would resemble as follows:

• The attacker retrieves a public encryption certificate from the target’s GlobalProtect portal or gateway to forge an authentication override cookie

• The attacker uses the certificate to encrypt an arbitrary authentication bypass cookie

• The maliciously crafted bypass cookie is implicitly trusted by the device, allowing access

To check a device configuration, users can look under Network > GlobalProtect > Gateways > [Gateway/Portal Name] > Agent Tab > Authentication Override Cookie to see if the functionality is enabled.

Due to active exploitation in the wild, publicly available proof of concept exploit code, and potential for unauthorized access through the VPN gateway, Beazley Security stronglyrecommends affected organizations patch immediately.

Our Organizational Response

Beazley Security is monitoring client perimeter devices through our Exposure Management Platform to identify impacted devices and support organizations in remediation of any issues found.

We are also conducting threat hunts across our MDR environment to detect potential exploitation attempts against our clients.

If you believe your organization may have been impacted by this attack campaign and need support, please contact our Incident Response team.

Sources

• https://nvd.nist.gov/vuln/detail/cve-2026-0257

• https://gbhackers.com/cisa-warns-palo-alto-networks-pan-os-vulnerability/

• https://www.theregister.com/cyber-crime/2026/06/01/palo-alto-vpn-bug-graduates-from-advisory-to-active-exploitation/5249114

• https://security.paloaltonetworks.com/CVE-2026-0257

• https://www.decryptiondigest.com/blog/cisa-patch-deadlines-june-2026-pan-os-defender-langflow

• https://www.rapid7.com/blog/post/etr-rapid7-observed-exploitation-of-pan-os-globalprotect-authentication-bypass-vulnerability-cve-2026-0257/

• https://arcticwolf.com/resources/blog/exploitation-of-cve-2026-0257-leads-to-qilin-ransomware/

Affected Systems or Products

Versions before 6.9.0 are not affected.

Mitigations / Workarounds

If security update patches cannot be immediately applied, the following recommended mitigations were provided for this specific vulnerability:

• Block anonymous access to the rest API, this can be achieved with plugins like Disable WP REST API, which are available on the official WordPress Plugin Directory.

• Block traffic to the web endpoints /wp-json/batch/v1 and ?rest_route=/batch/v1 via a Web Application Firewall (WAF).

• Cloudflare has deployed new WAF rules to protect all customers, including those on free and paid plans, if their application traffic is proxied through the Cloudflare WAF. The rules were reportedly deployed at 17:03 UTC on July 17, 2026.

Patches

Patches were already released at the time of advisory and can be found on the WordPress site and their GitHub repository.

Technical Details

At the time of publication, WordPress provided limited technical information about the critical vulnerabilities in its security release. However, Cloudflare published a concurrent advisory announcing new Web Application Firewall (WAF) protections for both critical vulnerabilities and additional technical analysis.

According to Cloudflare, CVE-2026-60137 is a SQL injection vulnerability affecting WordPress 6.8 and later, while CVE-2026-63030 is an unauthenticated remote code execution vulnerability affecting WordPress 6.9 and later. The RCE vulnerability is directly related to the SQL injection flaw and can be exploited through the REST API batch endpoint when a persistent object cache is not enabled.

The root cause lies in a route confusion condition within the REST API Batch Endpoint that causes attacker-controlled input to be misrouted or interpreted incorrectly. This allows crafted requests to reach unintended code paths, ultimately triggering the SQL injection vulnerability and providing a path to remote code execution.

Beazley Security recommends organizations upgrade to the latest supported version of WordPress as soon as possible, prioritizing patching of internet facing instances of the software. Organizations leveraging Cloudflare should ensure the latest managed WAF rules are enabled.

Our Organizational Response

Beazley Security is monitoring client perimeter devices through our Exposure Management Platform to identify impacted devices and support organizations in remediation of any issues found.

We are also conducting threat hunts across our MDR environment to detect potential exploitation attempts against our clients.

If you believe your organization may have been impacted by this attack campaign and need support, please contact our Incident Response team.

Sources

• https://slcyber.io/research-center/wp2shell-pre-authentication-rce-in-wordpress-core

• https://nvd.nist.gov/vuln/detail/CVE-2026-63030

• https://wordpress.org/news/2026/07/wordpress-7-0-2-release/

• https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-ff9f-jf42-662q

• https://blog.cloudflare.com/wordpress-vulnerabilities/

Affected Systems or Products

BIG-IP, BIG-IQ, F5 Distributed Cloud, F5OS, and F5 AI Gateway are not affected; the issues are confined to NGINX’s data plane components.

Mitigations / Workarounds

A single upgrade path remediates all three vulnerabilities on NGINX Open Source and NGINX Plus. Downstream products require their own separate updates.

• Upgrade NGINX Open Source to 1.31.3 or 1.30.4.

• Upgrade NGINX Plus to 37.0.3.1 or R36 P7.

• Upgrade NGINX Gateway Fabric to 2.6.7, and NGINX Ingress Controller to 5.5.3 or 2026-lts-r4.

If immediate patching is not possible, F5 advises replacing unnamed regex captures with named captures in any map or slice directive, and referencing those captures only within the block that holds the regex match. Replacing unnamed regex captures with named ones mitigates the vulnerabilities CVE-2026-42533 and CVE-2026-60005 target. No workaround exists for CVE-2026-56434; organizations relying on SSI with proxy_pass and proxy_buffering off should prioritize patching.

Patches

Fixed releases are available for NGINX Open Source, NGINX Plus, NGINX Gateway Fabric, and NGINX Ingress Controller, with additional downstream products receiving updates on their own branches. Administrators of customer-managed NGINX deployments must apply these updates directly. Further details on patching procedures are available in F5’s NGINX security advisory.

Technical Details

CVE-2026-42533 is a vulnerability that leverages the map directive when it’s configured to use regex matching. Map directives take a string expression that references the map’s regex capture variables before referencing the map’s own output variable. NGINX parses strings with $variables like proxy_set_header, map outputs, and conditionals by compiling them into a script at runtime. These map runtimes are executed twice for each request to ensure that an appropriately sized buffer can be allocated.

Because a map directive needs to run a regex across its input, the number captured variables in the regex matches (for example, $1, $2, ...) will be iterated in order. This initial pass reads $1 first, and its value may still hold whatever was left inside it from a previous capture state. On the second pass, when the map variable is evaluated and the regex is triggered, $1 will be overwritten with user-influenced content. If the two passes do not result in the same length, the new capture content can be longer than what was allocated, and the copy pass writes beyond the end of the allocated buffer causing a heap overflow.

The changelog notes a second related trigger, “non-cacheable variables”. These non-cacheable variables can produce the same result when referenced in a string expression because a non-cacheable variable is explicitly allowed to return a different value each time it’s evaluated.

Grepping your configs for string expressions (proxy_set_header, add_header, return, rewrite, log_format, set, etc.) that reference $1/$2/... values before referencing a map-produced variable can identify whether you have a vulnerable configuration. If so, using a named capture group (?<name>...) instead of a numbered one will reduce accidental register reuse across unrelated directives.

The other two flaws are lower-impact siblings from the same release. CVE-2026-60005 is an uninitialized-memory read in the optional slice module (not enabled by default) that can leak fragments of worker memory or force a restart. CVE-2026-56434 is a use-after-free in the SSI module, reachable only when SSI, proxy_pass, and proxy_buffering off are all configured together, and only by an attacker with man-in-the-middle control over upstream responses.

Our Organizational Response

Beazley Security is monitoring client perimeter devices through our Exposure Management Platform to identify impacted devices and support organizations in remediation of any issues found.

We are also conducting threat hunts across our MDR environment to detect potential exploitation attempts against our clients.

If you believe your organization may have been impacted by this attack campaign and need support, please contact our Incident Response team.

Sources

• https://nvd.nist.gov/vuln/detail/CVE-2026-42533

• https://nvd.nist.gov/vuln/detail/CVE-2026-56434

• https://nvd.nist.gov/vuln/detail/CVE-2026-60005

• https://github.com/advisories/GHSA-fxfg-v4rj-hp95

• https://github.com/advisories/GHSA-m73p-xg7q-m8f2

• https://github.com/advisories/GHSA-vxcv-h5wj-jxr5

• https://www.securityweek.com/f5-patches-multiple-nginx-big-ip-vulnerabilities

Affected Systems or Products

*Oracle states that the vulnerability specifically affects the File Transmission component of Oracle Payments.

Mitigations / Workarounds

Beazley Security strongly recommends affected organizations apply updates immediately due to active exploitation in the wild. Oracle has released patches to remediate this vulnerability, please see the “patches” section below for more information.

If patching cannot be immediately applied, the below mitigations may help to temporarily reduce risk:

• Remove or restrict public internet exposure of the Oracle E-Business Suite web interface where Oracle Payments are used, particularly the `/OA_HTML/` path, limiting access to trusted internal and administrative networks only.

• Deploy Web Application Firewalls (WAF) with signatures that detect exploitation attempts of this vulnerability

• Treat any internet-facing instance left unpatched since May, 2026 as potentially compromised and review it before reconnecting it to the internet.

Patches

Oracle addressed CVE-2026-46817 in its May 2026 Critical Patch Update, released May 28, 2026, and reinforced the fixes in a supplementary Critical Patch Update issued June 16, 2026. Patches are available through Oracle’s Patch Update and Security Alert program. Additional information can be found here.

Indicators of Compromise (IoCs)

Security researchers have reportedly observed isolated exploitation attempts against Oracle EBS honeypots in the wild since as early as late June, 2026.

Captured traffic from observed exploitation consisted of POST requests to /OA_HTML/ibytransmit carrying a crafted XML DeliveryRequest payload using the CODEX_PULL transmission scheme, with the FULL_FILE_PATH parameter set to /etc/passwd demonstrating attempts to exfiltrate sensitive server files:

Technical Details

CVE-2026-46817 is a critical, remotely exploitable vulnerability in the File Transmission component of Oracle Payments within Oracle E-Business Suite, affecting versions 12.2.3 through 12.2.15. Oracle classifies the flaw as resulting from improper privilege management, improper authentication, and missing authentication for a critical function.

The vulnerable code path is the /OA_HTML/ibytransmit endpoint, which accepts unauthenticated HTTP POST requests carrying XML payloads. By crafting a malicious POST request to this endpoint, an attacker can redirect an internal Oracle Java function to read arbitrary files from the underlying server filesystem without any credentials, session token, or user interaction. Demonstrated exploitation attempts targeted files such as /etc/passwd, with the broader risk extending to EBS configuration files that may contain database credentials, encryption keys, and payment-processor API keys.

Because the File Transmission component operates within Oracle Payments, successful exploitation could expose financial transaction and other sensitive ERP data. Exploitation observed to date has been limited to file disclosure, but the same unauthenticated access path could enable further escalation. As recent history would indicate, released proof of concept code and a lower barrier to exploitation may attract additional campaigns from threat actors.

Our Organizational Response

Beazley Security is monitoring client perimeter devices through our Exposure Management Platform to identify impacted devices and support organizations in remediation of any issues found.

We are also conducting threat hunts across our MDR environment to detect potential exploitation attempts against our clients.

If you believe your organization may have been impacted by this attack campaign and need support, please contact our Incident Response team.

Sources

• https://www.oracle.com/security-alerts/cpufaq.html

• https://nvd.nist.gov/vuln/detail/CVE-2026-46817

• https://www.oracle.com/security-alerts/cspumay2026.html

Affected Systems or Products

Mitigations / Workarounds

Microsoft’s July 2026 updates address CVE-2026-55040, CVE-2026-58644, and CVE-2026-50522 across supported on-premises SharePoint Server versions. Organizations should apply the latest SharePoint security updates immediately and verify successful installation. If immediate patching is not possible, risk may be temporarily reduced by implementing the following mitigations for SharePoint servers:

• Avoid exposing on-premises SharePoint Server directly to the internet. Where internet access is required, place it behind a Layer 7 reverse proxy or equivalent control that requires authentication and can inspect and filter requests.

• Enable AMSI integration for each SharePoint web application. Use Full Mode for Request Body Scan Mode where feasible. This enables Microsoft Defender to inspect request bodies associated with exploitation attempts.

• Restrict network access to SharePoint administration planes, and limit activity to systems that require access.

• Monitor affected SharePoint Servers for signs of exploitation or unusual activity, especially systems that were internet reachable before patching.

Patches

Microsoft released fixes for CVE-2026-55040, CVE-2026-58644, and CVE-2026-50522 as part of the July 2026 Patch Tuesday cycle. The fixes cover SharePoint Server Subscription Edition, SharePoint Server 2019, and SharePoint Server 2016. The specific SharePoint Updates can be accessed on Microsoft’s Learn Portal, or directly from the links below:

Administrators should apply updates through the official Microsoft Security Response Center advisories and confirm successful installation on each server in the farm. Validation matters as incomplete servicing can leave a multi-server SharePoint farm exposed even while updates are being applied.

Indicators of Compromise (IoCs)

At the time of CISA’s July 14 alert, neither CVE-2026-55040 nor CVE-2026-58644 had been reported as actively exploited by CISA or Microsoft. However, CISA provided the following Microsoft detection signatures associated with related SharePoint exploitation activity that organizations can use to identify indicators of attack:

• AMSI: Exploit:Script/SuspSignoutReqBody.A - request body scanning; SharePoint Server Subscription only; Microsoft has blocked observed attempts.

• AMSI: Exploit:Script/ToolPaneAuthBypass.A - request header scanning; SharePoint Server 2016, 2019, and Subscription Edition.

• AMSI: Exploit:Script/ToolPaneAuthBypass.C - RCE coverage; SharePoint Server 2016, 2019, and Subscription Edition.

• MDAV: Backdoor:MSIL/LeakFang.A!dha - post-exploitation activity alert involving IIS-protected secrets.

Technical Details

On July 14^th, Microsoft disclosed CVE-2026-55040, CVE-2026-58644, and CVE-2026-50522, three critical vulnerabilities affecting on-premises SharePoint Server versions 2016, 2019, and Subscription Edition:

• CVE-2026-55040 is an authentication bypass vulnerability affecting Microsoft SharePoint Server. The flaw stems from issues in SharePoint's JWT token validation pipeline allowing a remote, unauthenticated attacker to bypass the SharePoint authentication process. An attacker who knows a target's Active Directory Security ID or User Principal Name can use the flaw to forge a JWT token for existing users on a SharePoint installation, including a site administrator. According to researchers at Rapid7, the disclosed flaw is the first stage of a two-step chain that can lead to unauthenticated remote code execution. The second vulnerability remains undisclosed and unpatched at the time of writing, with a Microsoft fix expected in August.

• CVE-2026-58644 and CVE-2026-50522 are a deserialization-of-untrusted-data vulnerabilities in SharePoint. Deserialization flaws occur when an application reconstructs objects from attacker-supplied serialized data without properly validating type or origin. If an attacker can direct the deserializer to a class already available to the application, the attacker can trigger unintended code execution and run code in the context of the SharePoint service account.

The same day these vulnerabilities were disclosed, CISA issued an official alert regarding ongoing attacks against internet-exposed SharePoint servers involving active exploitation of three separate vulnerabilities: CVE-2026-32201, CVE-2026-45659, and CVE-2026-56164. In these cases, CISA reported remote code execution, IIS machine key theft, deserialization techniques, persistence, and malware deployment.

At the time of writing, the newly disclosed critical CVEs above have not been reported as exploited in the wild. However, given the sustained targeting of SharePoint servers and active campaigns reported by CISA, Beazley Security assesses that threat actors are likely to weaponize these flaws in the near future. CISA has also provided SharePoint hardening guidance within their official alert. Organizations should follow hardening guidance, apply Microsoft’s July 2026 SharePoint updates immediately, and prioritize the additional SharePoint update expected in August as soon as it becomes available.

Our Organizational Response

Beazley Security is monitoring client perimeter devices through our Exposure Management Platform to identify impacted devices and support organizations in remediation of any issues found.

We are also conducting threat hunts across our MDR environment to detect potential exploitation attempts against our clients.

If you believe your organization may have been impacted by this attack campaign and need support, please contact our Incident Response team.

Sources

• https://support.microsoft.com/en-us/servicing/office/update/2026/5002882

• https://support.microsoft.com/en-us/servicing/office/update/2026/5002883

• https://support.microsoft.com/en-us/servicing/office/update/2026/5002891

• https://www.microsoft.com/en-us/download/details.aspx?id=108730

• https://www.microsoft.com/en-us/download/details.aspx?id=108726

• https://www.microsoft.com/en-us/download/details.aspx?id=108723

• https://learn.microsoft.com/en-us/officeupdates/sharepoint-updates

• https://www.rapid7.com/blog/post/ve-cve-2026-55040-microsoft-sharepoint-jwt-token-authentication-bypass-fixed/

• https://www.cisa.gov/news-events/alerts/2026/07/14/cisa-urges-sharepoint-hardening-after-new-exploitations

• https://cybersecuritynews.com/sharepoint-rce-exploited-in-the-wild/

• https://www.cve.org/CVERecord?id=CVE-2026-50522

Affected Systems or Products

Mitigations / Workarounds

Given active exploitation in the wild, Beazley Security strongly recommends organizations apply updates immediately. SonicWall has released hotfixes to remediate these vulnerabilities. Please see the “patches” section for more information.

• If patching cannot be applied, other mitigations may temporarily reduce risk of exposure:

• Temporarily limit access to the Workplace interface to trusted, administrative networks

• Disable or restrict any unnecessary external access to the Management Console

• Monitor for indicators of attack or compromise. See the “Indicators of Compromise” section in this document for more information.

Patches

SonicWall has released hotfix firmware that address both vulnerabilities. Additional details are available in the official SonicWall advisory and fixes are available for download at mysonicwall.com.

Indicators of Compromise (IoCs)

SonicWall PSIRT has reportedly investigated multiple cases indicating the active exploitation of these vulnerabilities. No specific threat actor or public PoC have been disclosed, however SonicWall released the following indicators of attack that defenders can review:

• Requests to /__api__/login or /__api__/logout with HTTP 200 status codes appearing in extraweb_access.log

• Requests to /wsproxy with suspicious host parameters returning HTTP 101 status codes in extraweb_access.log

• Hotfix rollbacks with path traversal names appearing in ctrl-service.log

• Routes for /__api__/login or /__api__/logout present in /var/lib/unit/conf.json (these URIs do not exist in legitimate configuration)

If IoCs are present on the system, SonicWall strongly encourages customers to reimage appliances, change user and administrative passwords, and reset TOTP tokens.

Technical Details

SMA1000 appliances are SSL VPN gateways that provide secure remote access to enterprise networks, making them high-value targets for threat actors seeking an initial foothold. SonicWall remote access products have repeatedly been targeted through both zero-day and previously disclosed vulnerabilities to gain access to victim environments.

• CVE-2026-15409 is a critical server-side request forgery (SSRF) vulnerability in the SMA1000 Workplace interface. The flaw allows a remote, unauthenticated attacker to cause the appliance to send requests to unintended destinations, potentially attacker-controlled infrastructure. An attacker may also be able to probe internal network segments and reach services that the appliance would normally shield from the outside world.

• CVE-2026-15410 is a high-severity code injection vulnerability in the SMA1000 Appliance Management Console (AMC). Under specific conditions, a remote attacker with administrative access to the console can exploit the flaw to execute arbitrary operating system commands on the appliance.

At the time of writing, SonicWall has not publicly disclosed the exploitation techniques or the specific relationship between the two vulnerabilities beyond confirming their use in active attacks. It cannot be discounted that the pre-authentication SSRF vulnerability may be leveraged to target the management console to trigger arbitrary commands and achieve remote code execution on the appliance.

Our Organizational Response

Beazley Security is monitoring client perimeter devices through our Exposure Management Platform to identify impacted devices and support organizations in remediation of any issues found.

We are also conducting threat hunts across our MDR environment to detect potential exploitation attempts against our clients.

If you believe your organization may have been impacted by this attack campaign and need support, please contact our Incident Response team.

Sources

• https://nvd.nist.gov/vuln/detail/CVE-2026-15409

• https://nvd.nist.gov/vuln/detail/CVE-2026-15410

• https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0008

• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-15409