Cyber Threat Brief — June 21 2026
⚠️ This report is AI-generated. Always validate findings.
1. Splunk Enterprise Pre-Auth RCE — CISA Deadline TODAY — CVE-2026-20253
TL;DR: Federal remediation deadline for the Splunk Enterprise PostgreSQL sidecar RCE is today June 21. Active exploitation confirmed June 18. Patch to 10.4.0/10.2.4/10.0.7 immediately.
What’s New:
- CISA KEV federal deadline is TODAY — first Splunk CVE ever on KEV
- Limited ITW exploitation confirmed by Splunk PSIRT June 18
- watchTowr DAG detection tool available on GitHub to test exposure (400 = vulnerable, 401 = patched)
- No workarounds — patching is the only remediation
- AWS deployments at elevated risk (sidecar enabled by default)
Actionable Intel
| Artifact | Type | ATT&CK | Log Source | Action |
|---|---|---|---|---|
/v1/postgres/recovery/backup | URI path | T1190 | WAF/proxy logs | Block unauthenticated POST |
/v1/postgres/recovery/restore | URI path | T1190 | WAF/proxy logs | Block unauthenticated POST |
hostaddr= in HTTP body | Injection param | T1190 | WAF deep inspection | Alert on PostgreSQL connection params in body |
lo_export in SQL payload | SQL function | T1059.004 | PostgreSQL audit logs | Alert on large object export to filesystem |
../ in recovery endpoint params | Path traversal | T1083 | WAF/proxy logs | Block traversal sequences |
.pgpass file access | Credential file | T1552.001 | Splunk internal logs / auditd | Alert on read of .pgpass by non-splunk process |
Detection
| Source | Rule | Gap |
|---|---|---|
| Splunk ESCU | None | Critical gap — no rule for sidecar endpoint auth bypass or PostgreSQL lo_export abuse |
| Elastic | None | No coverage for Splunk-specific attack surface |
| Sigma | None | No community rule yet |
Sources: Splunk Advisory, watchTowr PoC, CISA KEV, Help Net Security
2. Chrome 149 Patches 7 Critical Use-After-Free Vulnerabilities
TL;DR: Google shipped Chrome 149.0.7827.155/.156 on June 20 with fixes for 33 vulnerabilities — seven rated Critical, all UAF bugs in high-value attack surfaces including Password Manager and WebAuthn.
What’s New:
- 7 Critical UAF bugs across WebShare, Digital Credentials, File Input, Password Manager, and Web Authentication
- 26 High-severity bugs spanning Extensions, WebRTC, Safe Browsing (heap overflows, OOB reads)
- No confirmed ITW exploitation yet but UAF in Password Manager and WebAuthn are high-value targets
- Firefox also patching 70+ vulnerabilities in concurrent release
Actionable Intel
| Artifact | Type | ATT&CK | Log Source | Action |
|---|---|---|---|---|
| Chrome < 149.0.7827.155 | Version | T1203 | Endpoint agent / SCCM | Force-update or block |
Unusual chrome.exe child processes | Process chain | T1189 | EDR / Sysmon EID 1 | Alert on browser spawning shells/LOLBins |
renderer crash dumps | Crash telemetry | T1203 | Chrome crash reports / WER | Investigate spikes in renderer crashes |
Detection
| Source | Rule | Gap |
|---|---|---|
| Splunk ESCU | None | No Chrome-version-specific detection |
| Elastic | Suspicious Browser Child Process | Covers post-exploitation only |
| Sigma | proc_creation_win_browsers_suspicious_child_process.yml | Partial — no pre-exploitation coverage |
Sources: SecurityWeek, Chrome Releases Blog
Status Updates
- CVE-2026-50656 (Microsoft Defender — RoguePlanet): Still UNPATCHED zero-day. TOCTOU race → SYSTEM on fully-patched Win10/11. Defender definition 1.453.20.0 detects PoC binary but root cause unfixed. WDAC/AppLocker blocks execution. Microsoft “working on patch” since June 16. Original brief.
- CVE-2026-42530 (NGINX HTTP/3 QUIC UAF): Patched in 1.31.2 June 17. No ITW exploitation confirmed. If running HTTP/3 QUIC module on 1.31.0-1.31.1, patch immediately. Original brief.
- CVE-2026-48907 (Joomla JCE RCE): CISA KEV deadline passed June 19. Automated webshell deployment ongoing. Post-patch IOC sweep required — update alone does not remove attacker artifacts. Original brief.
- CVE-2026-20262 (Cisco SD-WAN Manager): Zero-day file write, CISA KEV deadline June 29. WAR webshell deployment confirmed. 8th SD-WAN CVE of 2026. Original brief.
- FortiBleed (73K+ credential dump): CISA urged Fortinet customers June 19 to rotate all credentials on exposed devices. 86,644 compromised devices as of June 19. Original brief.