🔴 Cisco SD-WAN Manager CVE-2026-76504 exploited and KEV-listed, 📧 Microsoft confirms mass Zimbra CVE-2026-73570 exploitation, 🤖 DIVD names Zammad zero-days as AI agent entry point, 🌐 MikroTik RouterOS pre-auth root RCE CVE-2026-84411, 🌍 WatchGuard Fireware OS BOVPN root RCE batch, 💸 OFAC sanctions Tren de Aragua ATM jackpotting network

[NEW] Cisco's edge management plane is the newest actively exploited emergency: CVE-2026-76504 is a CVSS 9.8 authentication bypass in Catalyst SD-WAN Manager, formerly vManage, where mishandled URI encoding in API session authentication lets a single crafted HTTP request slip past an authentication rule and hand an unauthenticated remote attacker administrative access to the console that can manage up to 6,000 SD-WAN devices, on every deployment regardless of configuration. Cisco confirmed exploitation in the wild and published the marker that matters, the URI-encoded character %6a standing in for "j", now the prime hunt string in HTTP logs; CISA added the flaw to the KEV catalog on September 30 and Rapid7 updated its analysis on October 1 to reflect the listing, and there is no workaround, only the fixed release. Admin on the manager is effectively control of the SD-WAN fabric, so any confirmed hit means assuming credential and configuration exposure for the whole estate.

[REVISIT] Microsoft threat intelligence has put campaign-scale weight behind CVE-2026-73570, confirming that one crafted email to an internet-facing Zimbra server running the zimbra-snmp package with SNMP notifications enabled executes commands with no credentials or user interaction, and documenting JSP web shells, reverse shells, memory-backed execution and mailbox plus archive exfiltration across victims in multiple regions and industries, mixing automated delivery with hands-on-keyboard access. That stacks on top of the TargetZimbra ransomware campaign Positive Technologies has tracked since mid-August and more than 270 confirmed breached servers, a floor not a ceiling among the 12,100-plus internet-exposed instances Shadowserver counts; the KEV deadline passed August 24, and patching alone does not evict a web shell, which is why responders recommend OS reinstall with mail data migration.

[UPDATE] The DIVD breach got its promised technical disclosure a day early: the AI agent's entry point was a chain of two Zammad zero-days, CVE-2026-102489 and CVE-2026-102490, hijacking sessions, running code and escalating to root before the agent moved laterally and exfiltrated data in seconds of automated activity.

[NEW] CISA's advisory ICSA-26-272-06 details CVE-2026-84411, a pre-auth integer underflow in MikroTik RouterOS web management where one crafted HTTP request delivers arbitrary code execution as root (CVSS 9.8), affecting all versions before 7.24; fixed builds have shipped since September 16 (7.24.4 stable, 7.23.7 long-term) but no vendor notice names the CVE. No public exploitation is reported yet, which on a platform that already hosted an exploited RouterOS cluster this month is a statement about hours rather than intent; CISA's guidance is patch, pull web management off untrusted interfaces, and re-image any internet-reachable device via Netinstall since an upgrade alone does not clear compromise.

[UPDATE] With the federal remediation deadline for the NetScaler zero-days now passed, the delta is forensic: Unit 42 published attacker TTPs and malware analysis of the CVE-2026-88771 and CVE-2026-88772 campaign including pre-disclosure activity, and CERT-EU followed with log-by-log threat hunting guidance for exploitation evidence.

[NEW] Browser patch day arrived all at once: Chrome 154 fixes 32 vulnerabilities led by a critical ANGLE buffer overflow, CVE-2026-102331, reachable from malicious web content, plus 25 high-severity bugs across V8, the GPU stack, Mojo IPC and Bluetooth, while Mozilla's Firefox 157 in the same cycle patched roughly 76 more, 38 of them high severity. None are known to be exploited yet, but the detail worth flagging is attribution: three high-severity V8 type-confusions, CVE-2026-102323, CVE-2026-102326 and CVE-2026-102328, came from a researcher credited to OpenAI Codex Security, a marker of AI-assisted bug discovery at browser scale.

[NEW] WatchGuard's fifteen-advisory Fireware OS batch is easy to scroll past and shouldn't be: CVE-2026-86131 (CVSS v4 9.2) is code injection in the BOVPN over TLS client, and since the Firebox is the client, an attacker who controls or can impersonate the remote VPN peer, whether through BGP or DNS hijacking, provider-level interception or a compromised branch device, executes commands as root on the perimeter appliance itself. The same batch closes a pre-auth fingerd RCE (CVE-2026-81433, CVSS 8.7) and an SAML login bypass enabling unauthorized SSL VPN access (CVE-2026-86101), a day after two 9.3-severity unauthenticated AP flaws (CVE-2026-101891, CVE-2026-86102); WatchGuard reports no exploitation so far, but this product line went from patch to KEV with CVE-2025-9242, so upgrade to 2026.3.2, 2026.2.3 or 12.12.3 and inventory every configured tunnel peer.

[NEW] CloudSEK profiled MALFEX, an actor that has run a supply chain campaign against npm and GitHub users for two years: postinstall scripts in malicious packages deliver Overlord RAT to Windows hosts and harvest Discord tokens, browser credentials and cryptocurrency wallet data, and the flagged packages are still active. Treat unexpected postinstall scripts as untrusted code execution at npm install time, and audit lockfiles for packages nobody deliberately added.

[NEW] Treasury's OFAC sanctioned the Tren de Aragua ATM jackpotting network, with ten linked individuals and entities designated and seven TRON cryptocurrency addresses named in parallel Chainalysis and TRM Labs reporting that traces a multi-million-dollar scheme using malware against ATMs and laundering proceeds through crypto. Jackpotting crews are now getting the sanctions-plus-blockchain-analytics treatment once reserved for ransomware brands.

[UPDATE] The Pentagon's DMDC breach now carries official confirmation and firmer numbers: roughly 2.76 million current personnel plus 294,000 deceased individuals, with unencrypted Social Security numbers and job details exposed.

[UPDATE] In the ShinyHunters FBI breach, the bureau has pulled its public threat videos aimed at the crew after the Amsterdam arrest of its alleged ringleader, while ShinyHunters denies the arrested man is a member and stays defiant in media interviews, reiterating that it will not publish or sell the stolen trove.

Watchlist: a named actor or %6a scanning telemetry against SD-WAN Manager endpoints as the CVE-2026-76504 KEV deadline is set, first public exploitation of MikroTik CVE-2026-84411 (a KEV listing would follow fast), whether CISA flips Zimbra's KEV ransomware flag to Known given the documented TargetZimbra campaign, and ShinyHunters' next move now that the FBI has pulled its surrender videos.

Generated by zai/glm-5.3-flash (token counts unavailable).