Skip to content

Security Sense

AI Threat Intelligence

  • About
  • Blog
  • Privacy Policy

CVE-2026-60004: Gitea Code Injection Vulnerability Actively Exploited

Posted on September 6, 2026 by Kyle

Overview

CVE-2026-60004 is a critical code injection vulnerability in Gitea versions prior to 1.27.1, actively exploited in the wild. It allows an attacker with repository write access to achieve remote code execution by leveraging the diffpatch API to install malicious Git hooks. This enables the execution of arbitrary shell commands under the Gitea service account, posing a significant risk to affected organizations.

Technical Analysis

  • Vulnerability: Gitea contains a code injection vulnerability (CWE-94) in its diffpatch API endpoint.
  • Affected Versions: Gitea versions gitea >= 1.17.0 < 1.27.1 are vulnerable.
  • Attack Vector: Exploitation requires an attacker with repository write access. Despite the NVD CVSS vector indicating PR:N (No Privileges), successful exploitation of this specific vulnerability path necessitates an authenticated user with sufficient permissions to modify repository content.
  • Exploitation: The attacker sends a malicious patch to the diffpatch API endpoint. This patch is crafted to plant an executable Git hook within the repository’s .git/hooks/ directory.
  • Impact: The malicious Git hook allows the attacker to run arbitrary shell commands as the Gitea service account, leading to remote code execution (RCE).
  • CVSS: CVSS 3.1 Base Score: 9.8 (CRITICAL) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

Detection

  • Monitor Gitea server logs for unusual diffpatch API requests, especially those containing suspicious content or attempting to modify Git hooks.
  • Look for unexpected process spawns originating from the Gitea application process or the Gitea service account (e.g., git, sh, bash, powershell, cmd.exe).
  • Monitor for new or modified executable files within Git repository .git/hooks/ directories that are not part of legitimate operations.
  • Hunt for outbound network connections from the Gitea server to unusual or untrusted destinations.

Sigma Detection Rules

⚠️ AI-generated detection rules. These are experimental starting points. Review field names, EventIDs, and logic against your environment’s schema before deploying. Tune to reduce false positives.

Gitea RCE – Suspicious Child Process From Gitea

title: Gitea RCE - Suspicious Child Process From Gitea
id: 95d7e8a3-2c1b-4f8e-a9d0-1e2f3g4h5i6j
status: experimental
description: Detects suspicious child processes spawned by the Gitea application, indicative of successful CVE-2026-60004 exploitation leading to remote code execution.
logsource:
  product: windows
  service: sysmon
detection:
  selection:
    ParentImage|endswith:
      - '\gitea.exe'
      - '\gitea-windows-amd64.exe'
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\bash.exe'
      - '\sh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\certutil.exe'
      - '\bitsadmin.exe'
      - '\regsvr32.exe'
      - '\rundll32.exe'
  condition: selection
level: critical

Mitigations

  1. Patch Immediately: Upgrade Gitea to version 1.27.1 or later. This is the primary and most effective mitigation.
  2. Restrict Access: Ensure that only trusted users have repository write access, as this is a prerequisite for exploitation.
  3. Network Segmentation: Isolate Gitea instances on the network to limit potential lateral movement in case of compromise.
  4. Least Privilege: Run the Gitea service with the minimum necessary privileges to reduce the impact of successful exploitation.

References

  • https://github.com/0xBlackash/CVE-2026-60004
  • https://github.com/go-gitea/gitea/security/advisories/GHSA-rcr6-4jqh-j84m
  • https://blog.gitea.com/release-of-1.27.1/
  • https://www.runzero.com/blog/gitea/
  • https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-60004
  • https://thehackernews.com/2026/08/critical-gitea-rce-actively-exploited.html

Indicators of Compromise

Type Value Description
SHA256 0b8e037d160bdb0b621c975c424f680b814bc438fd492ae376ff3140e209e480 XMRIG · confidence 100% · first seen 2026-08-27
SHA256 3928c5874249cc71b2d88e5c0c00989ac394238747bb7638897fc210531b4aab XMRIG · confidence 100% · first seen 2026-08-27
SHA256 a5d9970129afd6e1874cbeafa08df65a3d3599862357ae48bdad211e0f47264a XMRIG · confidence 100% · first seen 2026-08-27
IP Address 167.179.119.120 XMRIG · confidence 100% · first seen 2026-08-08
IP Address 176.65.148.184 Attacker IP address observed in exploitation attempts against Switchvox instances (via https://thehackernews.com/2026/09/attackers-exploit-critical-switchvox.html)
IP Address 176.65.148.250 XMRIG · confidence 100% · first seen 2026-08-08
IP Address 193.41.68.194 XMRIG · confidence 100% · first seen 2026-08-08
IP Address 2.26.99.68 XMRIG · confidence 100% · first seen 2026-08-08
IP Address 216.98.10.60 XMRIG · confidence 100% · first seen 2026-08-08
IP Address 34.70.205.211 XMRIG · confidence 100% · first seen 2026-08-08
IP Address 92.246.139.83 XMRIG · confidence 100% · first seen 2026-08-27
IP Address 95.85.237.149 XMRIG · confidence 100% · first seen 2026-08-08
Domain 0x1x2x3.top XMRIG · confidence 100% · first seen 2026-08-27
Domain abcdefghijklmnopqrst.net XMRIG · confidence 100% · first seen 2026-08-27
Domain fix.unknower.win XMRIG · confidence 100% · first seen 2026-08-08
Domain kworker.eth.limo XMRIG · confidence 100% · first seen 2026-08-08
Domain kworker.eth.link XMRIG · confidence 100% · first seen 2026-08-08
URL http://0x1x2x3.top/ XMRIG · confidence 100% · first seen 2026-08-27
URL http://176.65.148.250:6556/ok XMRIG · confidence 100% · first seen 2026-08-08
URL http://92.246.139.83/1 XMRIG · confidence 100% · first seen 2026-08-27
URL http://92.246.139.83/2 XMRIG · confidence 100% · first seen 2026-08-27
URL http://92.246.139.83/3 XMRIG · confidence 100% · first seen 2026-08-27
URL http://cta.edu.pe/wp-content/plugins/linux.bin XMRIG · confidence 100% · first seen 2026-08-26
URL http://fix.unknower.win/ XMRIG · confidence 100% · first seen 2026-08-08
URL http://puschl.langhaar-schaeferhunde.com/plugins/linux.bin XMRIG · confidence 100% · first seen 2026-08-27
URL https://casasmediterraneas.com/wp-content/plugins/linux.bin XMRIG · confidence 100% · first seen 2026-08-27
URL https://cloud.calltop.com.br/apps/web/linux.bin XMRIG · confidence 100% · first seen 2026-08-27
URL https://cta.edu.pe/wp-content/plugins/linux.bin XMRIG · confidence 100% · first seen 2026-08-27
URL https://kworker.eth.limo/kworker/api XMRIG · confidence 100% · first seen 2026-08-08
URL https://kworker.eth.link/kworker/api XMRIG · confidence 100% · first seen 2026-08-08
URL https://www.mediocasavolponi.com/wp-content/plugins/linux.bin XMRIG · confidence 100% · first seen 2026-08-27

MITRE ATT&CK

  • T1190 — Exploit Public-Facing Application
  • T1078 — Valid Accounts
  • T1195 — Supply Chain Compromise
  • T1195.002 — Compromise Software Supply Chain
  • T1059 — Command and Scripting Interpreter
🤖 AI Attribution
Generated by gemini-2.5-flash ·
2,477 input / 1,433 output tokens ·
Reviewed and approved by a human analyst before publication
Leave a comment

CVE-2026-48710: Starlette HTTP Request/Response Smuggling Vulnerability

Posted on September 6, 2026 by Kyle

Overview

CVE-2026-48710 affects Kludex Starlette, a lightweight ASGI framework, specifically versions prior to 1.0.1. The vulnerability stems from insufficient validation of the HTTP Host request header, allowing attackers to inject paths into the host part. This manipulation causes request.url.path to differ from the raw scope path, enabling authentication bypass in middleware or endpoints that rely on request.url for security decisions. This vulnerability can be chained with others, such as CVE-2026-42271.

Technical Analysis

Starlette versions before 1.0.1 do not adequately validate the HTTP Host request header before using it to reconstruct request.url. The routing algorithm, however, relies on the raw HTTP path (scope path). An attacker can craft a malformed Host header to prepend paths or inject other characters, causing request.url.path to diverge from the actual requested path.

  • Vulnerability Type: HTTP Request/Response Smuggling (CWE-444), Improper Input Validation (CWE-1289).
  • Affected Versions: encode starlette versions >= 0.8.3 and < 1.0.1. Various Red Hat products including ai_inference_server, ansible_automation_platform, migration_toolkit_for_applications, openshift_ai, openshift_lightspeed, and satellite are also affected.
  • Attack Vector: Network-based, unauthenticated (CVSS:3.1/AV:N/AC:L/PR:N/UI:N).
  • Impact: Authentication bypass, potentially leading to unauthorized access to resources. Can be chained with other vulnerabilities for broader impact, including remote code execution or cryptomining as observed in community intelligence.
  • Prerequisites: The application must be using an affected version of Starlette, and security-sensitive middleware or endpoints must rely on request.url for access control decisions.
  • Resolution: Starlette version 1.0.1 and later validate the Host header against RFC 9112 §3.2 / RFC 3986 §3.2.2 and fall back to scope["server"] for malformed values.

Detection

Defenders can identify potential exploitation attempts by monitoring web server and application logs for anomalies related to the Host header.

  • Web Server Logs: Monitor Host header fields (e.g., cs-host, Host) for the presence of path separators (/, \) or their URL-encoded equivalents (%2f, %2F, %5c, %5C). These characters are invalid within the hostname part of a standard HTTP Host header.
  • Application Logs: Look for unexpected authentication bypasses, unauthorized access to restricted resources, or unusual requests to internal paths that do not align with expected user behavior, especially when correlated with suspicious Host headers.
  • WAF/API Gateway Logs: Review logs for requests flagged due to malformed Host headers or unusual URL structures that might indicate an attempt to exploit this vulnerability.

Sigma Detection Rules

⚠️ AI-generated detection rules. These are experimental starting points. Review field names, EventIDs, and logic against your environment’s schema before deploying. Tune to reduce false positives.

Starlette CVE-2026-48710 Malformed Host Header Path Separator

title: Starlette CVE-2026-48710 Malformed Host Header Path Separator
id: 757d59b2-3e2a-4f5b-9c7d-0e1f2a3b4c5d
status: experimental
description: Detects attempts to exploit CVE-2026-48710 by injecting path separators into the HTTP Host header, which can lead to request smuggling and authentication bypass in Starlette applications.
logsource:
  category: webserver
detection:
  selection:
    cs-host|contains:
      - '/'
      - '\'
  condition: selection
level: high

Starlette CVE-2026-48710 Malformed Host Header URL Encoded Path

title: Starlette CVE-2026-48710 Malformed Host Header URL Encoded Path
id: 8f9e0a1b-2c3d-4e5f-6a7b-8c9d0e1f2a3b
status: experimental
description: Detects attempts to exploit CVE-2026-48710 using URL-encoded path separators in the HTTP Host header, indicative of request smuggling or authentication bypass attempts against Starlette applications.
logsource:
  category: webserver
detection:
  selection:
    cs-host|contains:
      - '%2f'
      - '%2F'
      - '%5c'
      - '%5C'
  condition: selection
level: high

Mitigations

Prioritize patching and configuration changes to address this vulnerability.

  1. Upgrade Starlette: Immediately upgrade Kludex Starlette to version 1.0.1 or greater. This version includes robust validation for the Host header.
  2. Apply Vendor Patches: For affected Red Hat products, apply the latest security updates and patches provided by Red Hat.
  3. Implement WAF/API Gateway Rules: Configure Web Application Firewalls (WAFs) or API gateways to strictly validate the Host header, blocking requests where the Host header contains path separators or other non-standard characters.
  4. Review Application Logic: Ensure that security-sensitive middleware and application endpoints rely on the raw scope path for access control and routing decisions, rather than the potentially manipulated request.url.

References

  • https://nvd.nist.gov/vuln/detail/CVE-2026-48710
  • https://badhost.org
  • https://github.com/Kludex/starlette/commit/764dab0dcfb9033d75442d7a359645c9f94648c6
  • https://github.com/Kludex/starlette/security/advisories/GHSA-86qp-5c8j-p5mr
  • https://ostif.org/disclosing-the-badhost-vulnerability-in-starlette
  • https://www.secwest.net/starlette
  • https://www.x41-dsec.de/lab/advisories/x41-2026-002-starlette
  • https://www.wiz.io/blog/ai-infrastructure-honeypot
  • https://github.com/pypa/advisory-database/tree/main/vulns/starlette/PYSEC-2026-161.yaml
  • https://www.microsoft.com/en-us/security/blog/2026/08/26/when-ai-infrastructure-becomes-target-securing-gateways-control-points/
  • https://nvd.nist.gov/vuln/detail/CVE-2026-42271
  • https://horizon3.ai/attack-research/vulnerabilities/cve-2026-42271-chained-with-cve-2026-48710/
  • https://ltna.com.au/cyber

Indicators of Compromise

Type Value Description
SHA256 3af9f25a4d45bb4f1ec5627cdbc6703cf3b4be75a892162d299d80ddfb266f42 LiteLLM — XMRig cryptominer binary (variant) (via https://www.microsoft.com/en-us/security/blog/2026/08/26/when-ai-infrastructure-becomes-target-securing-gateways-control-points/)
SHA256 3d24ac736635e0fa0c5c459c9e18ca09d1ec9a1751a4503130934395609bd7e0 LiteLLM — installer / bridge script (via https://www.microsoft.com/en-us/security/blog/2026/08/26/when-ai-infrastructure-becomes-target-securing-gateways-control-points/)
SHA256 49fdcf32bfe837899a84e8938f0d07ae96ddd218a280a09eb60df8d64597bd8f LiteLLM — XMRig cryptominer binary (via https://www.microsoft.com/en-us/security/blog/2026/08/26/when-ai-infrastructure-becomes-target-securing-gateways-control-points/)
SHA256 f64b88e9318bdf23f2dd119a0ce1dd1bdb3c8cd2e0e1e23ba3ef2e19072b79cc LiteLLM #2 — unknown ELF binary (via https://www.microsoft.com/en-us/security/blog/2026/08/26/when-ai-infrastructure-becomes-target-securing-gateways-control-points/)
IP Address 135.125.10.56 RAGFlow exploitation C2 — LLM API key exfiltration endpoint (via https://www.microsoft.com/en-us/security/blog/2026/08/26/when-ai-infrastructure-becomes-target-securing-gateways-control-points/)
IP Address 172.232.38.92 Kestra reverse shell C2 (Linode VPS) (via https://www.microsoft.com/en-us/security/blog/2026/08/26/when-ai-infrastructure-becomes-target-securing-gateways-control-points/)
IP Address 194.213.18.133 Attacker-controlled mail MX / mail infrastructure (via https://www.microsoft.com/en-us/security/blog/2026/08/26/when-ai-infrastructure-becomes-target-securing-gateways-control-points/)
IP Address 45.150.109.151 Scanning/recon infrastructure (via https://www.microsoft.com/en-us/security/blog/2026/08/26/when-ai-infrastructure-becomes-target-securing-gateways-control-points/)
IP Address 47.86.197.116 c3pool mining endpoint (Kestra) (via https://www.microsoft.com/en-us/security/blog/2026/08/26/when-ai-infrastructure-becomes-target-securing-gateways-control-points/)
Domain 45.150.109.151.sslip.io DNS rebinding used in LiteLLM attacks (via https://www.microsoft.com/en-us/security/blog/2026/08/26/when-ai-infrastructure-becomes-target-securing-gateways-control-points/)
Domain auto.c3pool.org XMRig Monero mining pool (Kestra) (via https://www.microsoft.com/en-us/security/blog/2026/08/26/when-ai-infrastructure-becomes-target-securing-gateways-control-points/)
Domain gobygo.net C2 beacon infrastructure — subdomain-encoded LiteLLM beacons (via https://www.microsoft.com/en-us/security/blog/2026/08/26/when-ai-infrastructure-becomes-target-securing-gateways-control-points/)
Domain oast.fun Out-of-band callback domain (via https://www.microsoft.com/en-us/security/blog/2026/08/26/when-ai-infrastructure-becomes-target-securing-gateways-control-points/)
Domain oast.me Out-of-band callback domain (via https://www.microsoft.com/en-us/security/blog/2026/08/26/when-ai-infrastructure-becomes-target-securing-gateways-control-points/)
Domain oast.pro Out-of-band callback domain (via https://www.microsoft.com/en-us/security/blog/2026/08/26/when-ai-infrastructure-becomes-target-securing-gateways-control-points/)
Domain yosemite.jp C2/exfiltration endpoint — LiteLLM credential harvesting (via https://www.microsoft.com/en-us/security/blog/2026/08/26/when-ai-infrastructure-becomes-target-securing-gateways-control-points/)

MITRE ATT&CK

  • T1190 — Exploit Public-Facing Application
  • T1078.004 — Cloud Accounts
  • T1071.004 — DNS
  • T1036.005 — Match Legitimate Resource Name or Location
  • T1082 — System Information Discovery
  • T1071 — Application Layer Protocol
  • T1036 — Masquerading
  • T1552 — Unsecured Credentials
  • T1055 — Process Injection
  • T1552.004 — Private Keys
  • T1059 — Command and Scripting Interpreter
  • T1083 — File and Directory Discovery
  • T1552.001 — Credentials In Files
  • T1059.004 — Unix Shell
  • T1078 — Valid Accounts
  • T1027 — Obfuscated Files or Information
  • T1059.006 — Python
  • T1496 — Resource Hijacking
  • T1518 — Software Discovery
  • T1105 — Ingress Tool Transfer
🤖 AI Attribution
Generated by gemini-2.5-flash ·
2,721 input / 2,018 output tokens ·
Reviewed and approved by a human analyst before publication
Leave a comment

WordPress Core SQL Injection (CVE-2026-60137) Chained for RCE

Posted on July 25, 2026 by Kyle

Overview

CVE-2026-60137 is a SQL injection vulnerability affecting WordPress Core. While rated Medium severity on its own, it is critical because it can be chained with CVE-2026-63030 to enable unauthenticated remote code execution (RCE). This vulnerability is actively exploited, making immediate patching crucial for all WordPress administrators.

Technical Analysis

The vulnerability resides in the WP_Query component of WordPress Core, specifically in how it handles the author__not_in parameter. WordPress versions 6.8.x before 6.8.6, 6.9.x before 6.9.5, and 7.0.x before 7.0.2 do not properly sanitize untrusted input passed to this parameter by a plugin or theme. This allows an attacker to inject arbitrary SQL queries.

  • Vulnerability Type: SQL Injection (CWE-89)
  • Affected Versions:
    • WordPress >= 6.8, < 6.8.6
    • WordPress >= 6.9, < 6.9.5
    • WordPress >= 7.0, < 7.0.2
  • Prerequisites: A plugin or theme must pass untrusted input to the author__not_in parameter of WP_Query.
  • Attack Vector: Network (CVSS:3.1/AV:N)
  • Impact: High confidentiality impact (CVSS:3.1/C:H), no integrity or availability impact on its own. When chained with CVE-2026-63030, it leads to RCE.
  • CVSS 3.1 Score: 5.9 (MEDIUM)

Detection

  • Web Server Logs: Monitor web server access logs (e.g., Apache, Nginx, IIS) for requests containing author__not_in= in the URI or POST body, especially when combined with common SQL injection payloads such as UNION SELECT, ' OR 1=1--, SLEEP(), or LOAD_FILE(). Look for unusual HTTP status codes or response sizes following such requests.
  • Process Monitoring: On web servers, monitor for the web server process (e.g., httpd.exe, nginx.exe, php-fpm.exe, w3wp.exe) spawning unusual child processes, particularly command shells (cmd.exe, powershell.exe, sh, bash) or scripting interpreters, which could indicate successful RCE.
  • File Integrity Monitoring (FIM): Implement FIM on WordPress installation directories. Alert on the creation or modification of new .php files in web-accessible directories (wp-content, wp-includes, plugin/theme directories), as this could indicate a webshell drop.
  • Network Traffic Analysis: Look for outbound connections initiated by the web server process to unusual or known malicious IP addresses/domains, which might indicate command-and-control (C2) communication or data exfiltration post-exploitation.

Sigma Detection Rules

⚠️ AI-generated detection rules. These are experimental starting points. Review field names, EventIDs, and logic against your environment’s schema before deploying. Tune to reduce false positives.

WordPress Core SQL Injection CVE-2026-60137 Attempt

title: WordPress Core SQL Injection CVE-2026-60137 Attempt
id: 9029a1b8-20d0-482a-97a6-407133f93282
status: experimental
description: Detects attempts to exploit CVE-2026-60137, a SQL injection vulnerability in WordPress Core's WP_Query author__not_in parameter.
logsource:
  category: webserver
detection:
  selection_uri:
    - cs-uri-query|contains: 'author__not_in='
    - c-uri|contains: 'author__not_in='
  selection_sqli_patterns:
    - cs-uri-query|contains:
        - ' UNION SELECT '
        - ' OR 1=1-- '
        - ' AND 1=1-- '
        - ' SLEEP('
        - ' WAITFOR DELAY '
        - ' LOAD_FILE('
        - ' CONCAT('
    - c-uri|contains:
        - ' UNION SELECT '
        - ' OR 1=1-- '
        - ' AND 1=1-- '
        - ' SLEEP('
        - ' WAITFOR DELAY '
        - ' LOAD_FILE('
        - ' CONCAT('
  condition: selection_uri and selection_sqli_patterns
level: high

Web Server Process Spawning Suspicious Shell (Windows)

title: Web Server Process Spawning Suspicious Shell (Windows)
id: 4b27f67d-93d3-4a11-a81d-66f688820c7a
status: experimental
description: Detects a web server process spawning a command shell, indicative of successful remote code execution, potentially via CVE-2026-60137 chaining.
logsource:
  product: windows
  service: sysmon
detection:
  selection_parent:
    ParentImage|endswith:
      - '\php-fpm.exe'
      - '\httpd.exe'
      - '\nginx.exe'
      - '\w3wp.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
  condition: selection_parent and selection_child
level: critical

Web Server Process Creating Suspicious PHP File (Windows)

title: Web Server Process Creating Suspicious PHP File (Windows)
id: 7e7f8e1a-5b0c-4d3e-8f9a-2c1d0e6f7b8c
status: experimental
description: Detects a web server process creating a new PHP file in a web-accessible directory, which could indicate a webshell drop after successful exploitation.
logsource:
  product: windows
  service: sysmon
  definition: 'Requires Sysmon EventID 11 (FileCreate) to be enabled.'
detection:
  selection_process:
    Image|endswith:
      - '\php-fpm.exe'
      - '\httpd.exe'
      - '\nginx.exe'
      - '\w3wp.exe'
  selection_file:
    TargetFilename|endswith: '.php'
    TargetFilename|contains:
      - '\wp-content\uploads\'
      - '\wp-content\plugins\'
      - '\wp-content\themes\'
      - '\html\'
      - '\www\'
  condition: selection_process and selection_file
level: high

Mitigations

  1. Patch Immediately: Update all affected WordPress installations to the latest patched versions: 6.8.6, 6.9.5, 7.0.2, or newer. This is the most critical step to prevent exploitation.
  2. Web Application Firewall (WAF): Deploy and configure a WAF to detect and block common SQL injection patterns, specifically targeting the author__not_in parameter in WordPress requests. Ensure rules are updated to cover known exploitation patterns for this CVE.
  3. Review Plugins and Themes: Audit all third-party and custom WordPress plugins and themes. Prioritize those that interact with WP_Query or user-supplied input for author__not_in to ensure proper input sanitization and validation are in place.
  4. Principle of Least Privilege: Ensure the web server process and its associated PHP processes run with the minimum necessary privileges to limit the impact of successful exploitation.

References

  • https://nvd.nist.gov/vuln/detail/CVE-2026-60137
  • https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-fpp7-x2x2-2mjf
  • https://wordpress.org/news/2026/07/wordpress-7-0-2-release/
  • https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-60137
  • https://www.wiz.io/blog/wp2shell-cve-2026-63030-cve-2026-60137

Indicators of Compromise

No public IOCs available at time of writing.

MITRE ATT&CK

  • T1190 — Exploit Public-Facing Application
  • T1505.003 — Web Shell
  • T1140 — Deobfuscate/Decode Files or Information
  • T1087 — Account Discovery
  • T1059 — Command and Scripting Interpreter
  • T1083 — File and Directory Discovery
  • T1552.001 — Credentials In Files
  • T1059.004 — Unix Shell
  • T1078 — Valid Accounts
  • T1068 — Exploitation for Privilege Escalation
  • T1027 — Obfuscated Files or Information
  • T1027.002 — Software Packing
  • T1071.001 — Web Protocols
  • T1136 — Create Account
  • T1018 — Remote System Discovery
  • T1046 — Network Service Discovery
🤖 AI Attribution
Generated by gemini-2.5-flash ·
2,343 input / 2,291 output tokens ·
Reviewed and approved by a human analyst before publication
Leave a comment

CVE-2026-50522: Critical SharePoint RCE via Deserialization of Untrusted Data

Posted on July 25, 2026 by Kyle

Overview

CVE-2026-50522 is a critical deserialization of untrusted data vulnerability affecting Microsoft SharePoint Server. This flaw allows an unauthorized attacker to execute arbitrary code remotely over a network without user interaction. The vulnerability is actively exploited in the wild, posing a significant risk of full SharePoint compromise and potential lateral movement, including machine key theft.

Technical Analysis

The vulnerability, classified as CWE-502 (Deserialization of Untrusted Data), exists within Microsoft SharePoint Server. An attacker can exploit this flaw by sending specially crafted network requests that, when deserialized by the SharePoint application, lead to arbitrary code execution.

  • Vulnerability Type: Deserialization of Untrusted Data (CWE-502).
  • Affected Products:
    • microsoft sharepoint_server versions prior to 16.0.19725.20434
    • microsoft sharepoint_server 2016
    • microsoft sharepoint_server 2019
  • CVSS v3.1 Score: 9.8 (CRITICAL) – CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
  • Attack Vector: Network (AV:N). No authentication or user interaction is required (PR:N, UI:N).
  • Impact: Complete compromise of confidentiality, integrity, and availability (C:H, I:H, A:H) due to remote code execution.
  • Exploitation: Publicly reported exploitation includes the theft of SharePoint machine keys, which can lead to further compromise of the SharePoint farm. The ViewState malware family is linked to exploitation.

Detection

Detection efforts should focus on identifying post-exploitation activity and suspicious network requests targeting SharePoint servers.

  • Process Creation Monitoring: Monitor for unusual child processes spawned by SharePoint-related processes (e.g., w3wp.exe, owstimer.exe). Look for cmd.exe, powershell.exe, pwsh.exe, mshta.exe, cscript.exe, wscript.exe, or other scripting/system utilities.
  • Web Server Logs: Analyze IIS/web server logs for SharePoint for unusual POST requests, particularly those with large payloads, suspicious user agents, or requests to uncommon application pages.
  • File System Monitoring: Monitor for new or modified files in SharePoint web directories (_layouts, _vti_bin, wpresources) that could indicate webshell deployment or other persistence mechanisms.
  • Network Traffic Analysis: Look for unusual outbound connections from SharePoint servers to external IPs, especially after suspicious inbound requests.
  • Registry/File Access: Monitor for access to SharePoint configuration files (web.config) or registry keys related to machine keys, as this has been observed in active exploitation.

Sigma Detection Rules

⚠️ AI-generated detection rules. These are experimental starting points. Review field names, EventIDs, and logic against your environment’s schema before deploying. Tune to reduce false positives.

SharePoint IIS Worker Suspicious Child Process

title: SharePoint IIS Worker Suspicious Child Process
id: d7e0f8b1-c9a3-4e6d-b2f5-a1c8e7d4f0a9
status: experimental
description: Detects suspicious process creation (e.g., cmd, powershell) by an IIS worker process (w3wp.exe), which is a common indicator of RCE on SharePoint servers.
logsource:
  product: windows
  service: sysmon
detection:
  selection:
    ParentImage|endswith: '\\w3wp.exe'
    Image|endswith:
      - '\\cmd.exe'
      - '\\powershell.exe'
      - '\\pwsh.exe'
      - '\\mshta.exe'
      - '\\cscript.exe'
      - '\\wscript.exe'
  condition: selection
level: critical

SharePoint Timer Service Suspicious Child Process

title: SharePoint Timer Service Suspicious Child Process
id: e9c2d1a0-f3b4-4c5d-a6e7-b8f9c0d1e2f3
status: experimental
description: Detects suspicious process creation (e.g., cmd, powershell) by the SharePoint Timer Service (owstimer.exe), which can also be exploited for RCE.
logsource:
  product: windows
  service: sysmon
detection:
  selection:
    ParentImage|endswith: '\\owstimer.exe'
    Image|endswith:
      - '\\cmd.exe'
      - '\\powershell.exe'
      - '\\pwsh.exe'
      - '\\mshta.exe'
      - '\\cscript.exe'
      - '\\wscript.exe'
  condition: selection
level: critical

Mitigations

  1. Patch Immediately: Apply the latest security updates from Microsoft for SharePoint Server. Specifically, update to 16.0.19725.20434 or later for affected versions. Refer to the Microsoft Security Response Center (MSRC) advisory for CVE-2026-50522.
  2. Network Segmentation: Isolate SharePoint servers from untrusted networks and segment them from other critical internal systems.
  3. Least Privilege: Ensure SharePoint service accounts and application pools run with the minimum necessary privileges.
  4. Web Application Firewall (WAF): Deploy a WAF in front of SharePoint servers to detect and block malicious web requests, though specific deserialization payloads may be difficult to block without specific signatures.
  5. Regular Backups: Maintain regular, tested backups of SharePoint farms to facilitate recovery in case of compromise.

References

  • https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50522
  • https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-50522
  • https://nvd.nist.gov/vuln/detail/CVE-2026-50522
  • https://thehackernews.com/2026/07/critical-sharepoint-rce-cve-2026-50522.html
  • https://www.resecurity.com/blog/article/from-web-request-to-domain-compromise-understanding-the-july-2026-sharepoint-attacks
  • https://www.bleepingcomputer.com/news/security/critical-sharepoint-rce-flaw-exploited-to-steal-machine-keys/

Indicators of Compromise

No public IOCs available at time of writing.

MITRE ATT&CK

  • T1190 — Exploit Public-Facing Application
  • T1059 — Command and Scripting Interpreter
  • T1552.004 — Private Keys
  • T1505.003 — Web Shell
  • T1036 — Masquerading
  • T1530 — Data from Cloud Storage
  • T1213 — Data from Information Repositories
  • T1059.001 — PowerShell
🤖 AI Attribution
Generated by gemini-2.5-flash ·
2,289 input / 1,875 output tokens ·
Reviewed and approved by a human analyst before publication
Leave a comment

CVE-2026-63030: WordPress REST API RCE via Chained SQL Injection

Posted on July 25, 2026 by Kyle

Overview

CVE-2026-63030 is a critical vulnerability affecting WordPress Core, specifically its REST API batch endpoint. This flaw, when combined with a separate SQL Injection vulnerability (CVE-2026-60137), enables unauthenticated attackers to execute arbitrary code on vulnerable WordPress installations. Given its CVSS score of 9.8 and confirmed active exploitation, immediate patching is essential for all affected WordPress sites.

Technical Analysis

  • Vulnerability Type: Interpretation Conflict (CWE-436) leading to SQL Injection and Remote Code Execution.
  • Affected Versions:
    • WordPress versions 6.9.x before 6.9.5
    • WordPress versions 7.0.x before 7.0.2
  • Attack Vector: Network (AV:N), Low Attack Complexity (AC:L), No Privileges Required (PR:N), No User Interaction (UI:N). CVSS 3.1 Base Score: 9.8 (CRITICAL).
  • Mechanism: The vulnerability chain involves two distinct issues:
    1. CVE-2026-63030: A REST API batch endpoint route confusion issue. This allows an attacker to manipulate how the batch endpoint processes requests.
    2. CVE-2026-60137: An author__not_in WP_Query SQL Injection. This SQLi can be triggered through the confused batch endpoint.
  • Exploitation: An unauthenticated attacker can leverage the route confusion to inject malicious SQL queries via the author__not_in parameter. This SQL injection can then be escalated to achieve Remote Code Execution, potentially leading to webshell deployment or direct command execution. Tools like CMSmap have been linked to exploitation attempts.

Detection

  • Web Server Logs: Monitor web server access logs for unusual requests to WordPress REST API batch endpoints, specifically wp-json/batch/v1/ or similar paths, containing suspicious parameters (e.g., author__not_in) or large, malformed POST bodies.
  • Process Creation: Look for unexpected child processes spawned by the web server process (e.g., httpd, nginx, w3wp.exe, php-cgi.exe). Specifically, monitor for cmd.exe, powershell.exe, sh, or bash being executed.
  • File System Monitoring: Detect creation of suspicious files (e.g., .php, .asp, .jsp files) in WordPress web root directories, particularly wp-content/uploads/ or wp-includes/, by the web server process. These could indicate webshell deployment.
  • Database Logs: If available, monitor database logs for unusual or malformed SQL queries, especially those targeting user or option tables, originating from the WordPress application.

Sigma Detection Rules

⚠️ AI-generated detection rules. These are experimental starting points. Review field names, EventIDs, and logic against your environment’s schema before deploying. Tune to reduce false positives.

WordPress REST API Batch Endpoint Suspicious Request

title: WordPress REST API Batch Endpoint Suspicious Request
id: 9283e01a-f1c2-4a7b-a1c3-2d4e5f6g7h8i
status: experimental
description: Detects suspicious requests to the WordPress REST API batch endpoint, potentially indicating exploitation attempts for CVE-2026-63030 chained with CVE-2026-60137.
logsource:
  category: webserver
detection:
  selection:
    cs-uri-stem|contains: '/wp-json/batch/v1/'
    cs-method: ['POST', 'PUT']
    c-uri|contains: 'author__not_in'
  condition: selection
level: high

Web Server Spawning Shell Process

title: Web Server Spawning Shell Process
id: a1b2c3d4-e5f6-7890-1234-567890abcdef
status: experimental
description: Detects a web server process spawning a shell interpreter, indicative of successful Remote Code Execution (RCE).
logsource:
  product: windows
  service: sysmon
detection:
  selection:
    ParentImage|endswith: 
      - '\w3wp.exe'
      - '\httpd.exe'
      - '\nginx.exe'
      - '\php-cgi.exe'
      - '\apache.exe'
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\sh.exe'
      - '\bash.exe'
      - '\pwsh.exe'
  condition: selection
level: critical

Web Server Creating Suspicious File in WordPress Directories

title: Web Server Creating Suspicious File in WordPress Directories
id: f0e9d8c7-b6a5-4321-fedc-ba9876543210
status: experimental
description: Detects a web server process creating suspicious files (e.g., webshells) in common WordPress upload or include directories, a common post-exploitation activity.
logsource:
  product: windows
  service: sysmon
detection:
  selection:
    EventID: 11
    ParentImage|endswith:
      - '\w3wp.exe'
      - '\httpd.exe'
      - '\nginx.exe'
      - '\php-cgi.exe'
      - '\apache.exe'
    TargetFilename|contains:
      - '\wp-content\uploads\'
      - '\wp-includes\'
    TargetFilename|endswith:
      - '.php'
      - '.php5'
      - '.phtml'
      - '.asp'
      - '.aspx'
      - '.jsp'
      - '.jspx'
  condition: selection
level: high

Mitigations

  1. Patch Immediately: Upgrade WordPress to version 6.9.5 or 7.0.2, or later, as soon as possible. These versions contain the necessary fixes for both CVE-2026-63030 and CVE-2026-60137.
  2. Restrict REST API Access: If feasible and not critical for site functionality, consider limiting access to the WordPress REST API endpoint (/wp-json/) at the web server or WAF level, especially for unauthenticated users.
  3. Implement Web Application Firewall (WAF): Deploy and configure a WAF to detect and block known SQL injection patterns and suspicious requests targeting WordPress REST API endpoints.
  4. Principle of Least Privilege: Ensure the web server process runs with the minimum necessary privileges to limit the impact of successful exploitation.
  5. Regular Backups: Maintain regular, tested backups of WordPress sites and databases to facilitate recovery in case of compromise.

References

  • https://nvd.nist.gov/vuln/detail/CVE-2026-63030
  • https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-ff9f-jf42-662q
  • https://wordpress.org/news/2026/07/wordpress-7-0-2-release/
  • https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-63030
  • https://www.wiz.io/blog/wp2shell-cve-2026-63030-cve-2026-60137

Indicators of Compromise

No public IOCs available at time of writing.

MITRE ATT&CK

  • T1190 — Exploit Public-Facing Application
  • T1505.003 — Web Shell
  • T1059.003 — Windows Command Shell
  • T1059.004 — Unix Shell
  • T1140 — Deobfuscate/Decode Files or Information
  • T1087 — Account Discovery
  • T1059 — Command and Scripting Interpreter
  • T1083 — File and Directory Discovery
  • T1552.001 — Credentials In Files
  • T1078 — Valid Accounts
  • T1068 — Exploitation for Privilege Escalation
  • T1027 — Obfuscated Files or Information
  • T1027.002 — Software Packing
  • T1071.001 — Web Protocols
  • T1136 — Create Account
  • T1018 — Remote System Discovery
  • T1046 — Network Service Discovery
🤖 AI Attribution
Generated by gemini-2.5-flash ·
2,319 input / 2,116 output tokens ·
Reviewed and approved by a human analyst before publication
Leave a comment

CVE-2026-16232: Check Point SmartConsole Authentication Bypass Vulnerability

Posted on July 23, 2026 - July 23, 2026 by Kyle

Overview

CVE-2026-16232 is a critical authentication bypass vulnerability affecting Check Point SmartConsole, which is used to manage Check Point security products. An unauthenticated remote attacker can exploit this flaw to obtain an application login token and authenticate with full administrative privileges. This allows for complete control over security policies and configurations, posing a significant risk to the integrity and confidentiality of an organization’s security posture. Check Point has observed limited exploitation of this vulnerability in the wild.

Technical Analysis

The vulnerability, classified as CWE-287 (Improper Authentication), resides within the Check Point SmartConsole login process. An unauthenticated remote attacker can exploit this flaw to bypass standard authentication mechanisms, obtain a valid application login token, and subsequently use this token to authenticate to the SmartConsole with full administrative rights. Successful exploitation grants the attacker the ability to modify security policies, firewall rules, and other critical security configurations. Remote exploitation is possible if the Management Server IP address is internet-accessible and its configuration does not restrict access to ‘Trusted Clients’.

Affected Products:
* Check Point Multi-Domain Security Management versions r77.30 through r81.20 (excluding r81.20 itself, which is also affected), r82, and r82.10.
* Check Point Quantum Security Management versions r77.30 through r81.20 (excluding r81.20 itself, which is also affected), r82, and r82.10.

CVSS 3.1 Score: 9.1 (CRITICAL)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Detection

Defenders should focus on monitoring authentication and administrative activity on Check Point Management Servers for anomalies, especially from external or untrusted sources.

  • Authentication Logs: Monitor Check Point Management Server authentication logs (e.g., SmartEvent, audit logs) for successful administrative logins originating from unexpected or untrusted IP addresses, particularly those not defined as ‘Trusted Clients’.
  • Administrative Actions: Look for events indicating modifications to security policies, firewall rules, or system configurations by administrative users, especially if these actions occur shortly after a suspicious login or from an unusual source.
  • Network Traffic: Monitor network traffic to the Check Point Management Server for unusual connection patterns or attempts to access administrative interfaces from external networks.

Sigma Detection Rules

⚠️ AI-generated detection rules. These are experimental starting points. Review field names, EventIDs, and logic against your environment’s schema before deploying. Tune to reduce false positives.

Check Point SmartConsole Admin Login from Untrusted Source

title: Check Point SmartConsole Admin Login from Untrusted Source
id: 92b1e4a3-f5d6-4e8c-8a2b-6c7d8e9f0a1b
status: experimental
description: Detects successful administrative logins to Check Point SmartConsole from IP addresses not typically associated with trusted management clients, potentially indicating exploitation of CVE-2026-16232.
logsource:
  product: checkpoint
  service: management
detection:
  selection:
    action: 'login_success'
    user: '*admin*'
    source_ip|startswith:
      - '172.'
      - '10.'
      - '192.168.'
  filter_trusted_ips:
    source_ip:
      - '192.168.1.10'
      - '10.0.0.5'
  condition: selection and not filter_trusted_ips
level: high

Check Point SmartConsole Policy/Config Modification by Suspicious Admin

title: Check Point SmartConsole Policy/Config Modification by Suspicious Admin
id: 8c7d6e5f-4b3a-2d1c-0a9b-8e7f6d5c4b3a
status: experimental
description: Identifies modifications to security policies or configurations within Check Point SmartConsole, potentially indicating post-exploitation activity after an authentication bypass (CVE-2026-16232).
logsource:
  product: checkpoint
  service: management
detection:
  selection:
    action|contains:
      - 'policy_modified'
      - 'configuration_changed'
      - 'rule_added'
      - 'rule_deleted'
    user: '*admin*'
    source_ip|startswith:
      - '172.'
      - '10.'
      - '192.168.'
  filter_trusted_ips:
    source_ip:
      - '192.168.1.10'
      - '10.0.0.5'
  condition: selection and not filter_trusted_ips
level: high

Mitigations

  1. Apply Patches: Immediately apply the latest security updates and patches provided by Check Point to all affected SmartConsole and Management Server installations. Refer to Check Point’s advisory sk185169 for specific patch information.
  2. Restrict Management Access: Configure Check Point Management Servers to restrict access to SmartConsole only from a predefined list of ‘Trusted Clients’ (specific IP addresses or subnets) and disable internet access to the Management Server IP address where possible.
  3. Network Segmentation: Isolate Check Point Management Servers on a dedicated management network segment, separate from production and internet-facing networks.
  4. Multi-Factor Authentication (MFA): While this vulnerability bypasses initial authentication, ensure MFA is enforced for all administrative access where possible, as a defense-in-depth measure against other potential credential compromise scenarios.
  5. Audit Logs: Regularly review Check Point Management Server audit and authentication logs for any suspicious activity.

References

  • https://nvd.nist.gov/vuln/detail/CVE-2026-16232
  • https://support.checkpoint.com/results/sk/sk185169
  • https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-16232
  • https://ltna.com.au/cyber

Indicators of Compromise

Type Value Description
IP Address 139.28.37.250 Attacker IP address (via https://support.checkpoint.com/results/sk/sk185169)
IP Address 151.241.99.207 Attacker IP address (via https://support.checkpoint.com/results/sk/sk185169)
IP Address 151.241.99.233 Attacker IP address (via https://support.checkpoint.com/results/sk/sk185169)
IP Address 158.62.198.182 Attacker IP address (via https://support.checkpoint.com/results/sk/sk185169)
IP Address 192.142.10.99 Attacker IP address (via https://support.checkpoint.com/results/sk/sk185169)

MITRE ATT&CK

  • T1190 — Exploit Public-Facing Application
  • T1078 — Valid Accounts
🤖 AI Attribution
Generated by gemini-2.5-flash ·
2,004 input / 1,675 output tokens ·
Reviewed and approved by a human analyst before publication
Leave a comment

CVE-2026-46817: Oracle E-Business Suite Payments Takeover Vulnerability

Posted on July 23, 2026 - July 23, 2026 by Kyle

Overview

CVE-2026-46817 is a critical improper privilege management vulnerability affecting Oracle E-Business Suite’s Oracle Payments product. An unauthenticated attacker with network access via HTTP can exploit this flaw to achieve complete takeover of the Oracle Payments component. This vulnerability is easily exploitable and carries a CVSS 3.1 Base Score of 9.8, indicating severe impacts on confidentiality, integrity, and availability.

Technical Analysis

The vulnerability resides within the Oracle Payments product, specifically in the File Transmission component of Oracle E-Business Suite. It is an improper privilege management flaw (CWE-269, CWE-287, CWE-306) that allows an unauthenticated attacker to bypass security controls. By sending specially crafted HTTP requests, an attacker can gain unauthorized administrative control over the Oracle Payments module.

  • Affected Versions: Oracle E-Business Suite versions 12.2.3 through 12.2.15 are vulnerable.
  • Attack Vector: Network access via HTTP. No authentication or user interaction is required.
  • Impact: Successful exploitation results in full takeover of Oracle Payments, implying complete control over payment processing, configuration, and data within that module.
  • Prerequisites: The vulnerable Oracle Payments component must be accessible via HTTP from the attacker’s network location.

Detection

Detecting exploitation attempts for CVE-2026-46817 involves monitoring web server logs for suspicious activity targeting Oracle E-Business Suite’s Payments module.

  • Web Server Logs: Monitor access logs (e.g., Apache, Nginx, IIS) for requests targeting paths associated with Oracle Payments or File Transmission components (e.g., /OA_HTML/ or /OA_CGI/ paths related to payments processing or file handling).
  • Unusual Request Patterns: Look for HTTP requests from unauthenticated sources to sensitive Oracle Payments endpoints that typically require authentication or are not part of normal user workflows.
  • Error Codes followed by Success: Hunt for sequences of failed (e.g., 401, 403) or unusual (e.g., 500) HTTP status codes immediately followed by successful (200) requests to sensitive payment-related URLs from the same source IP, potentially indicating an authentication bypass or exploit attempt.
  • Post-Exploitation Activity: Monitor for any unusual process creation, file modifications, or network connections originating from the Oracle E-Business Suite server that are not part of normal operations, which could indicate a successful takeover.

Sigma Detection Rules

⚠️ AI-generated detection rules. These are experimental starting points. Review field names, EventIDs, and logic against your environment’s schema before deploying. Tune to reduce false positives.

Suspicious Unauthenticated Access to Oracle Payments Component

title: Suspicious Unauthenticated Access to Oracle Payments Component
id: f0e1d2c3-b4a5-6789-cdef-0123456789ab
status: experimental
description: Detects unauthenticated or unusual HTTP requests targeting Oracle E-Business Suite's Payments or File Transmission components, potentially indicating an exploitation attempt for CVE-2026-46817.
logsource:
  category: webserver
detection:
  selection_paths:
    cs-uri-stem|contains:
      - '/OA_HTML/jsp/fnd/payments/'
      - '/OA_CGI/fnd/payments/'
      - '/OA_HTML/jsp/fnd/file_transmission/'
      - '/OA_CGI/fnd/file_transmission/'
  condition: selection_paths
level: high

Mitigations

Prioritize the following actions to mitigate CVE-2026-46817:

  1. Apply Vendor Patches: Immediately apply the security updates provided by Oracle in their May 2026 Critical Patch Update (CPU) advisory. This is the primary and most effective mitigation.
  2. Restrict Network Access: Limit direct network access to Oracle E-Business Suite components, especially the Oracle Payments module, from untrusted networks. Implement strict firewall rules to only allow necessary traffic from authorized sources.
  3. Implement Web Application Firewall (WAF): Deploy and configure a WAF to detect and block known exploit patterns or suspicious requests targeting Oracle E-Business Suite applications.
  4. Regular Auditing: Conduct regular security audits and penetration tests on Oracle E-Business Suite deployments to identify and address potential vulnerabilities.

References

  • https://nvd.nist.gov/vuln/detail/CVE-2026-46817
  • https://www.oracle.com/security-alerts/cspumay2026.html
  • https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-46817

Indicators of Compromise

No public IOCs available at time of writing.

MITRE ATT&CK

  • T1190 — Exploit Public-Facing Application
🤖 AI Attribution
Generated by gemini-2.5-flash ·
2,162 input / 1,298 output tokens ·
Reviewed and approved by a human analyst before publication
Leave a comment

CVE-2026-58644: Microsoft SharePoint Deserialization RCE

Posted on July 23, 2026 - July 23, 2026 by Kyle

Overview

CVE-2026-58644 is a critical deserialization of untrusted data vulnerability affecting Microsoft SharePoint Server. This flaw allows an unauthenticated attacker to execute arbitrary code remotely over the network. Given its high severity (CVSS 9.8) and potential for complete system compromise without user interaction, this vulnerability poses a significant risk to organizations utilizing vulnerable SharePoint deployments.

Technical Analysis

The vulnerability, categorized as CWE-502 (Deserialization of Untrusted Data), resides within Microsoft SharePoint. An attacker can craft malicious serialized data and send it to a vulnerable SharePoint instance. When the SharePoint application attempts to deserialize this untrusted data, it can lead to the execution of arbitrary code in the context of the SharePoint server process. This attack does not require authentication or user interaction, making it highly impactful.

  • Vulnerability Type: Deserialization of Untrusted Data (CWE-502)
  • Affected Products:
    • Microsoft SharePoint Server < 16.0.19725.20434
    • Microsoft SharePoint Server 2016
    • Microsoft SharePoint Server 2019
  • Attack Vector: Network (AV:N)
  • Authentication: Not required (PR:N)
  • User Interaction: Not required (UI:N)
  • Impact: Complete compromise of confidentiality, integrity, and availability (C:H/I:H/A:H)

Detection

Detection efforts should focus on identifying anomalous process creation originating from SharePoint worker processes, as well as suspicious network traffic patterns indicative of exploitation attempts.

  • Process Monitoring: Monitor for unusual child processes spawned by SharePoint-related processes (e.g., w3wp.exe, owstimer.exe, or other SharePoint service executables). Look for cmd.exe, powershell.exe, pwsh.exe, or other scripting interpreters and uncommon executables.
  • Network Traffic Analysis: Look for unusual HTTP/HTTPS requests to SharePoint endpoints that may contain serialized payloads or unexpected data structures. Monitor for outbound connections from SharePoint servers to unknown external IP addresses or domains.
  • Application Logs: Review SharePoint ULS logs and IIS logs for errors related to deserialization or unexpected application behavior immediately preceding suspicious process activity.
  • Endpoint Telemetry: Hunt for EventID 1 (Process Creation) in Sysmon logs where ParentImage is a SharePoint process and Image is a shell or scripting interpreter.

Sigma Detection Rules

⚠️ AI-generated detection rules. These are experimental starting points. Review field names, EventIDs, and logic against your environment’s schema before deploying. Tune to reduce false positives.

SharePoint Worker Process Spawning Cmd.exe

title: SharePoint Worker Process Spawning Cmd.exe
id: 9a7b1c2d-3e4f-5a6b-7c8d-9e0f1a2b3c4d
status: experimental
description: Detects suspicious execution of cmd.exe by an IIS worker process (w3wp.exe) which commonly hosts SharePoint, indicating potential RCE via CVE-2026-58644.
logsource:
  product: windows
  service: sysmon
detection:
  selection:
    EventID: 1
    ParentImage|endswith: '\\w3wp.exe'
    Image|endswith: '\\cmd.exe'
  condition: selection
level: high

SharePoint Worker Process Spawning PowerShell.exe

title: SharePoint Worker Process Spawning PowerShell.exe
id: 1a2b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects suspicious execution of powershell.exe by an IIS worker process (w3wp.exe) which commonly hosts SharePoint, indicating potential RCE via CVE-2026-58644.
logsource:
  product: windows
  service: sysmon
detection:
  selection:
    EventID: 1
    ParentImage|endswith: '\\w3wp.exe'
    Image|endswith: '\\powershell.exe'
  condition: selection
level: high

Mitigations

Prioritize patching and implement compensating controls to reduce the attack surface.

  1. Apply Patches: Immediately apply the security update from Microsoft. For SharePoint Server Subscription Edition, update to version 16.0.19725.20434 or later. Apply the latest cumulative updates for SharePoint Server 2016 and 2019 that address CVE-2026-58644.
  2. Network Segmentation: Isolate SharePoint servers on a dedicated network segment with strict ingress/egress filtering to limit unauthorized access.
  3. Web Application Firewall (WAF): Deploy a WAF in front of SharePoint servers to detect and block malicious requests, particularly those attempting to exploit deserialization vulnerabilities. Configure the WAF to inspect request bodies for suspicious serialized data patterns.
  4. Least Privilege: Ensure SharePoint service accounts operate with the minimum necessary privileges.
  5. Regular Backups: Maintain regular, tested backups of SharePoint farms to facilitate recovery in the event of a successful compromise.

References

  • https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58644
  • https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-58644
  • https://nvd.nist.gov/vuln/detail/CVE-2026-58644

Indicators of Compromise

No public IOCs available at time of writing.

MITRE ATT&CK

  • T1190 — Exploit Public-Facing Application
  • T1210 — Exploitation of Remote Services
  • T1059.003 — Windows Command Shell
  • T1059.001 — PowerShell
🤖 AI Attribution
Generated by gemini-2.5-flash ·
1,755 input / 1,551 output tokens ·
Reviewed and approved by a human analyst before publication
Leave a comment

CVE-2026-39808: Fortinet FortiSandbox OS Command Injection Vulnerability

Posted on July 23, 2026 - July 23, 2026 by Kyle

Overview

CVE-2026-39808 is a critical OS command injection vulnerability affecting Fortinet FortiSandbox appliances. An unauthenticated attacker can exploit this flaw by sending specially crafted HTTP requests, leading to arbitrary code or command execution on the device. Given its presence in CISA’s KEV catalog and community intelligence, this vulnerability is actively exploited and poses an immediate threat to unpatched systems.

Technical Analysis

This vulnerability, classified as CWE-78 (Improper Neutralization of Special Elements used in an OS Command), allows for OS command injection. An unauthenticated attacker can leverage crafted HTTP requests to inject and execute unauthorized commands within the underlying operating system of the FortiSandbox appliance.

  • Affected Products: Fortinet FortiSandbox versions 4.4.0 through 4.4.9.
  • Attack Vector: Network (AV:N). Exploitation is possible remotely without authentication (PR:N) and requires no user interaction (UI:N).
  • Impact: Successful exploitation grants an attacker high confidentiality, integrity, and availability impact (C:H/I:H/A:H) by allowing arbitrary code or command execution.
  • CVSS 3.1 Score: 9.8 (CRITICAL) – CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

Detection

Defenders should focus on monitoring web server logs for suspicious request patterns and host-based logs for unusual process execution on FortiSandbox appliances.

  • Web Server Logs: Monitor FortiSandbox web access logs for HTTP requests containing common command injection payloads (e.g., |, &, ;, $(...), `...`) followed by system commands like id, whoami, cat /etc/passwd, or uname -a within the URI path (cs-uri-stem) or query parameters (cs-uri-query).
  • Process Monitoring: Look for unexpected process spawns on the FortiSandbox appliance, particularly shell processes (sh, bash, python) originating from the web server process or other services exposed to the network.
  • Network IDS/IPS: Deploy and update network intrusion detection/prevention systems with signatures capable of identifying known exploit patterns for CVE-2026-39808.
  • Outbound Connections: Monitor FortiSandbox for unusual outbound network connections to external IP addresses or non-standard ports, which could indicate a successful reverse shell or data exfiltration.

Sigma Detection Rules

⚠️ AI-generated detection rules. These are experimental starting points. Review field names, EventIDs, and logic against your environment’s schema before deploying. Tune to reduce false positives.

Fortinet FortiSandbox OS Command Injection Attempt (CVE-2026-39808)

title: Fortinet FortiSandbox OS Command Injection Attempt (CVE-2026-39808)
id: d7f1e2c3-a4b5-4c6d-8e9f-0123456789ab
status: experimental
description: Detects potential OS command injection attempts targeting Fortinet FortiSandbox via crafted HTTP requests containing shell metacharacters and commands.
logsource:
  category: webserver
detection:
  selection:
    - cs-uri-stem|contains:
        - '|id'
        - '&whoami'
        - ';cat /etc/passwd'
        - '$(uname -a)'
        - '`ls -la`'
    - cs-uri-query|contains:
        - '|id'
        - '&whoami'
        - ';cat /etc/passwd'
        - '$(uname -a)'
        - '`ls -la`'
  condition: selection
level: critical

Fortinet FortiSandbox Suspicious Shell Process Spawn (CVE-2026-39808 Post-Exploitation)

title: Fortinet FortiSandbox Suspicious Shell Process Spawn (CVE-2026-39808 Post-Exploitation)
id: e8d2f3c4-b5a6-4d7e-9f01-23456789abcd
status: experimental
description: Detects suspicious shell process spawns on FortiSandbox, potentially indicating successful OS command injection. Assumes Linux-based OS.
logsource:
  product: linux
  service: auditd # Or other process logging source like Sysmon for Linux
detection:
  selection:
    - a0|contains:
        - '/bin/sh'
        - '/bin/bash'
        - '/usr/bin/python'
        - '/usr/bin/perl'
    - ppid_name|contains:
        - 'httpd'
        - 'nginx'
        - 'fortiwebd' # Placeholder for a potential Fortinet web server process name
        - 'uwsgi'
  condition: selection
level: critical

Mitigations

Prioritize patching and network segmentation to reduce exposure.

  1. Patch Immediately: Upgrade Fortinet FortiSandbox appliances to a version beyond 4.4.9 as soon as a patched release is available from Fortinet. Refer to the vendor advisory for specific patch details.
  2. Restrict Network Access: Limit network access to the FortiSandbox management interface and any exposed web services to only trusted administrative networks and necessary internal systems. Implement strict firewall rules.
  3. Implement Web Application Firewall (WAF): Deploy a WAF in front of the FortiSandbox to filter and block malicious HTTP requests attempting to exploit command injection vulnerabilities.
  4. Regular Auditing: Conduct regular security audits and vulnerability scans of FortiSandbox appliances to identify and remediate potential weaknesses.

References

  • https://nvd.nist.gov/vuln/detail/CVE-2026-39808
  • https://fortiguard.fortinet.com/psirt/FG-IR-26-100
  • https://github.com/samu-delucas/CVE-2026-39808
  • https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-39808
  • https://kudelskisecurity.com/research/fortinet-fortibleed-global-compromise-active-exploitation-of-fortinet-vulnerabilities

Indicators of Compromise

No public IOCs available at time of writing.

MITRE ATT&CK

  • T1190 — Exploit Public-Facing Application
  • T1059.004 — Unix Shell
  • T1040 — Network Sniffing
  • T1078 — Valid Accounts
  • T1110 — Brute Force
  • T1110.002 — Password Cracking
  • T1110.004 — Credential Stuffing
  • T1133 — External Remote Services
  • T1595 — Active Scanning
🤖 AI Attribution
Generated by gemini-2.5-flash ·
2,081 input / 1,754 output tokens ·
Reviewed and approved by a human analyst before publication
Leave a comment

CVE-2026-25089: Fortinet FortiSandbox OS Command Injection Vulnerability

Posted on July 23, 2026 - July 23, 2026 by Kyle

Overview

CVE-2026-25089 is a critical OS command injection vulnerability affecting Fortinet FortiSandbox, FortiSandbox Cloud, and FortiSandbox PaaS. This flaw allows unauthenticated attackers to execute arbitrary commands on the underlying system by sending specially crafted HTTP requests. Given its high severity (CVSS 9.8) and confirmed active exploitation, organizations utilizing affected FortiSandbox products are at immediate risk of compromise.

Technical Analysis

  • Vulnerability: Improper neutralization of special elements used in an OS command (‘OS Command Injection’) (CWE-78).
  • Impact: Unauthenticated remote code execution (RCE).
  • Attack Vector: Network (AV:N). Exploitation occurs via specifically crafted HTTP requests.
  • Authentication: Not required (PR:N).
  • User Interaction: Not required (UI:N).
  • Affected Products and Versions:
    • Fortinet FortiSandbox versions 4.2.0 through 4.2.8
    • Fortinet FortiSandbox versions 4.4.0 through 4.4.8
    • Fortinet FortiSandbox versions 5.0.0 through 5.0.5
    • Fortinet FortiSandbox Cloud versions 5.0.4 through 5.0.5
    • Fortinet FortiSandbox PaaS versions 5.0.4 through 5.0.5
  • CVSS 3.1 Score: 9.8 (CRITICAL) – CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Detection

  • Monitor FortiSandbox web server logs for unusual HTTP request patterns, especially in URI paths or POST body parameters, that may indicate command injection attempts (e.g., &, |, ;, `, $(), &&, || followed by system commands).
  • Look for unexpected process creation originating from the FortiSandbox application’s user or web server process. This could include sh, bash, cmd.exe, powershell.exe, python, perl, wget, curl, nc, ncat, tftp, or other uncommon binaries.
  • Monitor network egress from FortiSandbox appliances for connections to suspicious external IP addresses or domains, indicative of command and control (C2) or data exfiltration.
  • Hunt for new or modified files in web root directories or system binaries that could indicate webshell deployment or persistence mechanisms.

Sigma Detection Rules

⚠️ AI-generated detection rules. These are experimental starting points. Review field names, EventIDs, and logic against your environment’s schema before deploying. Tune to reduce false positives.

FortiSandbox OS Command Injection – Suspicious Process Spawn (Linux)

title: FortiSandbox OS Command Injection - Suspicious Process Spawn (Linux)
id: 0c2d3e4f-5a6b-7c8d-9e0f-1a2b3c4d5e6f
status: experimental
description: Detects suspicious process creation originating from common web server processes, indicative of successful OS command injection on a Linux-based system like FortiSandbox.
logsource:
  product: linux
  service: auditd
detection:
  selection_parent:
    ParentImage|endswith:
      - '/usr/sbin/httpd'
      - '/usr/sbin/nginx'
      - '/usr/sbin/apache2'
      - '/usr/bin/uwsgi'
      - '/usr/bin/gunicorn'
      - '/usr/bin/php-fpm'
      - '/opt/fortinet/fortisandbox/bin/webserver' # Placeholder, actual path might vary
  selection_child:
    Image|endswith:
      - '/bin/sh'
      - '/bin/bash'
      - '/usr/bin/wget'
      - '/usr/bin/curl'
      - '/usr/bin/python'
      - '/usr/bin/perl'
      - '/usr/bin/nc'
      - '/usr/bin/ncat'
      - '/usr/bin/tftp'
      - '/usr/bin/socat'
  condition: selection_parent and selection_child
level: high

FortiSandbox Web Log – OS Command Injection Attempt

title: FortiSandbox Web Log - OS Command Injection Attempt
id: 1a2b3c4d-5e6f-7a8b-9c0d-e1f2a3b4c5d6
status: experimental
description: Detects common OS command injection patterns in web server access logs, targeting FortiSandbox appliances.
logsource:
  category: webserver
  service: fortisandbox_web_access # Custom service for FortiSandbox web logs
detection:
  selection:
    cs-uri-query|contains:
      - '&id='
      - '|id='
      - ';id='
      - '`id='
      - '$('
      - '`'
      - '&&'
      - '||'
      - 'uname'
      - 'whoami'
      - 'cat /etc/passwd'
      - 'ls -la'
      - 'wget '
      - 'curl '
      - 'nc -e '
      - 'bash -c '
  condition: selection
level: medium

Mitigations

  1. Patch Immediately: Apply the latest security updates provided by Fortinet for FortiSandbox, FortiSandbox Cloud, and FortiSandbox PaaS. Refer to the vendor advisory FG-IR-26-141 for specific patch versions.
  2. Network Segmentation: Isolate FortiSandbox appliances on a dedicated network segment with strict ingress/egress filtering to limit potential lateral movement in case of compromise.
  3. Restrict Access: Limit administrative access to FortiSandbox interfaces to trusted IP addresses and enforce strong authentication mechanisms.
  4. Monitor Logs: Ensure comprehensive logging is enabled for FortiSandbox appliances and integrate logs with a SIEM for real-time monitoring and alerting.

References

  • https://fortiguard.fortinet.com/psirt/FG-IR-26-141
  • https://nvd.nist.gov/vuln/detail/CVE-2026-25089
  • https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-25089
  • https://arcticwolf.com/resources/blog/inside-fortibleed-reverse-engineering-the-cyberstrike-harvester-behind-a-global-fortigate-credential-factory/
  • https://kudelskisecurity.com/research/fortinet-fortibleed-global-compromise-active-exploitation-of-fortinet-vulnerabilities

Indicators of Compromise

Type Value Description
SHA256 2758f4d71a2a2dfdefab81737c2d776b2a3dafe5844fdd2157e089a28447ca98 SHA-256 hash of CyberStrike Harvester v1.5 (via https://arcticwolf.com/resources/blog/inside-fortibleed-reverse-engineering-the-cyberstrike-harvester-behind-a-global-fortigate-credential-factory/)
SHA256 38353f95fff270f4e3a9d7add8c64666020dd668ce66e15969a736ec48cadc59 SHA-256 hash of ad_enum.py (LDAP enumeration tooling) (via https://arcticwolf.com/resources/blog/inside-fortibleed-reverse-engineering-the-cyberstrike-harvester-behind-a-global-fortigate-credential-factory/)
SHA256 4253dd1a4c0867b0be7732f75b2f630cebfb7fed94270e15fb3b12ae40546d01 SHA-256 hash of backup_dfs.py (SMB/DFS triage collection) (via https://arcticwolf.com/resources/blog/inside-fortibleed-reverse-engineering-the-cyberstrike-harvester-behind-a-global-fortigate-credential-factory/)
SHA256 479ae5fd7274439ddfa27bc03298ebfdfc5ff17f6412acccf74d4dbd90d94218 SHA-256 hash of bot.py (Telegram Hashcat bot) (via https://arcticwolf.com/resources/blog/inside-fortibleed-reverse-engineering-the-cyberstrike-harvester-behind-a-global-fortigate-credential-factory/)
SHA256 874bcb1c3d050a5b5b333a2198f504fcb27927c2abdd43b07440188a380c52d5 SHA-256 hash of ad_full_audit.py (LDAP/AD audit tooling) (via https://arcticwolf.com/resources/blog/inside-fortibleed-reverse-engineering-the-cyberstrike-harvester-behind-a-global-fortigate-credential-factory/)
SHA256 9eaa577c8ba71646928c1c34c3145536b0498f65f26060a6ba00744bcef57644 SHA-256 hash of backup_dfs2.py (SMB/DFS full/incremental collection) (via https://arcticwolf.com/resources/blog/inside-fortibleed-reverse-engineering-the-cyberstrike-harvester-behind-a-global-fortigate-credential-factory/)
SHA1 268a8420b791df46380ed9ad69905207e15d8a7c GNU Build ID for CyberStrike Harvester (via https://arcticwolf.com/resources/blog/inside-fortibleed-reverse-engineering-the-cyberstrike-harvester-behind-a-global-fortigate-credential-factory/)
MD5 7f74bb6ba185978134c318bc5f91d23c MD5 hash of CyberStrike Harvester v1.5 (via https://arcticwolf.com/resources/blog/inside-fortibleed-reverse-engineering-the-cyberstrike-harvester-behind-a-global-fortigate-credential-factory/)
IP Address 193.8.187.42 SSH exfiltration/staging server (via https://arcticwolf.com/resources/blog/inside-fortibleed-reverse-engineering-the-cyberstrike-harvester-behind-a-global-fortigate-credential-factory/)
IP Address 85.11.187.8 Hashtopolis/API endpoint (via https://arcticwolf.com/resources/blog/inside-fortibleed-reverse-engineering-the-cyberstrike-harvester-behind-a-global-fortigate-credential-factory/)

MITRE ATT&CK

  • T1190 — Exploit Public-Facing Application
  • T1059.004 — Unix Shell
  • T1133 — External Remote Services
  • T1539 — Steal Web Session Cookie
  • T1087.002 — Domain Account
  • T1069.002 — Domain Groups
  • T1119 — Automated Collection
  • T1040 — Network Sniffing
  • T1135 — Network Share Discovery
  • T1558.004 — AS-REP Roasting
  • T1552 — Unsecured Credentials
  • T1021.002 — SMB/Windows Admin Shares
  • T1602.002 — Network Device Configuration Dump
  • T1110.003 — Password Spraying
  • T1020 — Automated Exfiltration
  • T1552.001 — Credentials In Files
  • T1048.002 — Exfiltration Over Asymmetric Encrypted Non-C2 Protocol
  • T1039 — Data from Network Shared Drive
  • T1078 — Valid Accounts
  • T1110.004 — Credential Stuffing
  • T1018 — Remote System Discovery
  • T1046 — Network Service Discovery
  • T1558.003 — Kerberoasting
  • T1110 — Brute Force
  • T1110.002 — Password Cracking
  • T1595 — Active Scanning
🤖 AI Attribution
Generated by gemini-2.5-flash ·
2,278 input / 1,824 output tokens ·
Reviewed and approved by a human analyst before publication
Leave a comment

Posts navigation

Older posts
Proudly powered by WordPress | Theme: micro, developed by DevriX.