Cyber Threat Brief — July 29 2026

1. Arista VeloCloud Orchestrator Zero-Day Command Injection — CVE-2026-16812

TL;DR: CVSS 10.0 unauthenticated OS command injection in VeloCloud Orchestrator on-prem is actively exploited; CISA KEV federal deadline is tomorrow July 30.

What’s New:

CISA KEV added July 27 with July 30 federal deadline (tomorrow)
Arista published three attacker IPs and confirmed external discovery with active exploitation
Unauthenticated — requires only network access to VCO web interface
Exploits privileged internal functionality exposed to external callers
Post-exploitation: persistence establishment, config manipulation, full SD-WAN management compromise

Actionable Intel

Artifact	Type	ATT&CK	Log Source	Action
`8.19.75.217`	Attacker IP	T1190	VCO web access logs	Block
`206.72.242.124`	Attacker IP	T1190	VCO web access logs	Block
`206.72.242.162`	Attacker IP	T1190	VCO web access logs	Block
HTTP POST/GET to VCO privileged internal endpoints	Exploitation	T1190	VCO web access logs, WAF	Hunt
Unauthorized SD-WAN config changes	Post-exploitation	T1565.001	VCO backend application logs	Hunt
Anomalous outbound connections from VCO host	Persistence	T1071.001	Firewall/proxy logs	Hunt

Detection

Source	Rule	Gap
Splunk ESCU	None	No VeloCloud-specific detections; need web access log correlation for VCO internal endpoint abuse
Elastic	None	No VeloCloud-specific detections
Sigma	None	No VeloCloud-specific detections

Sources: Arista Advisory SA-0144, CISA KEV July 27, SecurityAffairs, The Hacker News

2. NGINX 15-Year Heap Overflow Gets Full RCE PoC — CVE-2026-42533

TL;DR: DepthFirst released a full-chain RCE exploit on July 28 for a 15-year-old NGINX heap buffer overflow in map directive regex handling (CVSS 9.2), bypassing ASLR.

What’s New:

DepthFirst published full exploit chain (GitHub: DepthFirstDisclosures/Nginx-Rift) on July 28
Exploit chains stream-module memory leak for ASLR bypass with heap overflow for code execution via fake ngx_pool_cleanup_s records redirected to system()
Vulnerable configs use map directive regex captures referenced by unnamed capture variables before the map output variable
Affects NGINX Open Source < 1.31.3 (mainline) / < 1.30.4 (stable) and NGINX Plus < 37.0.3.1 / < R36 P7
Static config scanner available to identify vulnerable configurations without exploitation

Actionable Intel

Artifact	Type	ATT&CK	Log Source	Action
NGINX version < 1.31.3/1.30.4 with regex map directives	Vulnerable config	T1190	Asset inventory	Patch
Worker process crashes (segfaults)	DoS indicator	T1499.004	NGINX error log, syslog	Alert
Anomalous child processes from NGINX worker	Post-exploitation	T1059	EDR, process logs	Hunt
`ngx_pool_cleanup_s` heap spray via HTTP request bodies	Exploitation	T1190	WAF (deep inspection)	Hunt

Detection

Source	Rule	Gap
Splunk ESCU	None	No NGINX-specific heap overflow or worker crash detection
Elastic	None	No NGINX worker exploitation detection
Sigma	None	No NGINX map directive abuse detection

Sources: DepthFirst PoC, The Hacker News, SOCPrime Analysis, SecurityAffairs

3. JetBrains TeamCity Unauth RCE via Agent Polling Deserialization — CVE-2026-63077

TL;DR: CVSS 9.8 unauthenticated RCE in all TeamCity On-Premises versions via insecure deserialization in the agent polling protocol; patch released July 27, no ITW exploitation yet.

What’s New:

Disclosed July 27 by JetBrains via coordinated disclosure (reported July 10 by Antoni Tremblay)
Insecure deserialization (CWE-502) in agent polling protocol — unauthenticated, no user interaction
Compromises CI/CD pipeline: build artifacts, credentials, downstream deployments
Fixed in TeamCity 2025.11.7 and 2026.1.3; security patch plugin available for 2017.1+
TeamCity Cloud not affected; no ITW exploitation confirmed yet

Actionable Intel

Artifact	Type	ATT&CK	Log Source	Action
TeamCity On-Premises < 2026.1.3 / 2025.11.7	Vulnerable software	T1190	Asset inventory	Patch
Agent polling port accessible from untrusted networks	Attack surface	T1190	Firewall rules	Restrict
Unexpected agent registrations	Exploitation indicator	T1190	TeamCity server logs	Hunt
Java deserialization payloads on agent polling port	Exploitation	T1190	Network IDS	Hunt

Detection

Source	Rule	Gap
Splunk ESCU	None	No TeamCity agent polling deserialization detection
Elastic	None	No TeamCity-specific detection
Sigma	`Suspicious Java Process Spawning Shell` (generic, partial)	No specific TeamCity agent polling rule

Sources: JetBrains Blog, The Hacker News, Help Net Security

4. vBulletin Pre-Auth RCE via Template eval() — CVE-2026-61511

TL;DR: Public PoC released July 27 for a pre-auth RCE in vBulletin’s runMaths() template handler that passes visitor-controlled input to eval(); patched in 6.2.2 since July 1.

What’s New:

SSD Secure Disclosure published advisory and interactive PoC on July 27
vB5_Template_Runtime::runMaths() strips characters via regex but allows XOR operator ^, enabling PHP code injection reaching eval()
Pre-auth: exploitable by any visitor, no account needed
Affects vBulletin 6.2.1 and earlier, 6.1.6 and earlier
PoC contains intentional one-character error (letter where digit belongs) preventing copy-paste execution — expect corrections within days
No ITW exploitation confirmed yet; not on CISA KEV

Actionable Intel

Artifact	Type	ATT&CK	Log Source	Action
vBulletin < 6.2.2	Vulnerable software	T1190	Asset inventory	Patch
POST requests to template rendering endpoints with `{vb:math}` payloads	Exploitation	T1190	WAF, web access logs	Block/Hunt
PHP `eval()` execution from `runtime.php`	Code execution	T1059.004	EDR, PHP error logs	Alert
Unexpected webshells in vBulletin directories	Post-exploitation	T1505.003	File integrity monitoring	Hunt

Detection

Source	Rule	Gap
Splunk ESCU	None	No vBulletin-specific detection
Elastic	None	No vBulletin template injection detection
Sigma	None	No vBulletin `runMaths()` exploitation detection

Sources: BleepingComputer, The Hacker News, SecurityOnline

Status Updates

CVE-2025-68686 (FortiOS Symlink Bypass): Added to CISA KEV July 27 alongside VeloCloud; CVSS 5.3 info disclosure bypasses symlink cleanup from prior compromises; federal deadline August 10. Requires prior compromise. CISA KEV.
CVE-2026-53264 (Linux Kernel TC UAF): STAR Labs published LPE exploit July 28; AI-assisted discovery; local-only, requires unprivileged user namespaces; upstream fix since June 1; no ITW exploitation. The Hacker News.