Cyber Threat Brief — August 6 2026
⚠️ This report is AI-generated. Always validate findings.
1. N-able N-central RMM Auth Bypass → Endpoint Pivot — CVE-2026-18556 / CVE-2026-18577
TL;DR: Incomplete patch for N-central auth bypass (CVE-2026-18556) left a second exploitation vector (CVE-2026-18577). Attackers gain unauthenticated admin access to the RMM console, abuse Take Control to pivot into managed endpoints, and install Cloudflare Tunnel services for reboot-persistent access. CISA KEV federal deadline is TODAY.
What’s New:
- CVE-2026-18577 (CVSS 8.2) — alternate-path auth bypass (CWE-288) on all N-central versions through 2026.3.1
- Zero-day exploitation detected July 31 by Adlumin MDR; N-able advisory August 2; CISA KEV additions August 3-4
- Post-exploitation: Take Control feature opens remote sessions on all managed endpoints; Cloudflared registered as Windows service survives reboots and bypasses firewalls
- Six attacker IPs published by N-able;
svchost.exerenamed binary in user Documents folder - Federal deadline August 6 (TODAY) for CVE-2026-18577; August 7 for CVE-2026-18556
Actionable Intel
| Artifact | Type | ATT&CK | Log Source | Action |
|---|---|---|---|---|
| 173.249.252.200, 87.249.138.34, 37.19.210.32, 37.153.90.88, 92.118.112.181, 68.235.46.214 | Attacker IPs | T1190 | Firewall, N-central access logs | Block |
Windows service named Cloudflared | Persistence | T1543.003 | Windows System event log, EDR | Hunt — service should not exist on managed endpoints |
svchost.exe in C:\Users\*\Documents\ | Masquerading | T1036.005 | Sysmon EID 1, EDR | Hunt — legitimate svchost.exe lives in System32 only |
BASupSrvc_*.log.gz in C:\ProgramData\GetSupportService_N-Central\Logs\ | Take Control abuse | T1219 | File system, EDR | Hunt — unexpected Take Control sessions |
| Outbound connections to Cloudflare edge (no inbound rule needed) | C2 tunnel | T1572 | Netflow, DNS, proxy | Hunt — cloudflared tunnels from endpoint fleet |
Detection
| Source | Rule | Gap |
|---|---|---|
| Splunk ESCU | None | No N-central auth bypass or Take Control abuse detection |
| Elastic | None | No detection for Cloudflared service registration as persistence |
| Sigma | proc_creation_win_svchost_susp_parent_directory.yml (partial) | Missing Cloudflared tunnel-as-service persistence rule |
Sources: Huntress · Rapid7 · CISA KEV · N-able Advisory · Arctic Wolf
2. Cisco August Security Hardening — 12 Critical IOS XE & SD-WAN CVEs
TL;DR: Cisco published 12 critical CVEs across IOS XE (CVSS 9.8) and Catalyst SD-WAN (CVSS 9.9) on August 5. Found via internal security review assisted by AI models. No ITW exploitation or workarounds — patch is the only mitigation.
What’s New:
- IOS XE: 7 CVEs (CVE-2026-20267 through CVE-2026-20273) including command/OS/argument injection (CVE-2026-20272, CVSS 9.8) and access control bypass (CVE-2026-20267, CVSS 9.0)
- SD-WAN: 5 CVEs (CVE-2026-20303, 20304, 20310, 20312, 20313) including input validation bypass and access control failures, both rated CVSS 9.9
- Affects IOS XE 17.9/17.12/17.15/17.18/26.1 in autonomous and controller mode regardless of device configuration
- No workarounds available — software upgrade required
- SD-WAN context: these are the 13th-17th SD-WAN CVEs of 2026, with prior CVEs (CVE-2026-20127, CVE-2026-20182, CVE-2026-20245, CVE-2026-20262) actively exploited by UAT-8616
Actionable Intel
| Artifact | Type | ATT&CK | Log Source | Action |
|---|---|---|---|---|
| IOS XE versions 17.9/17.12/17.15/17.18/26.1 unpatched | Vulnerable asset | T1190 | Asset inventory | Patch — no workaround |
| SD-WAN Controller/Manager/Validator on pre-August builds | Vulnerable asset | T1190 | Asset inventory | Patch — 9th+ SD-WAN CVE of 2026 |
| Unexpected CLI commands or config changes on IOS XE devices | Post-exploitation indicator | T1059 | IOS XE syslog, AAA logs | Hunt — given prior SD-WAN exploitation history |
vManage /var/log/scripts.log anomalies | Post-exploitation | T1059 | SD-WAN Manager logs | Hunt — known post-exploitation artifact from CVE-2026-20245 |
Detection
| Source | Rule | Gap |
|---|---|---|
| Splunk ESCU | None | No IOS XE command injection or SD-WAN hardening detection |
| Elastic | None | No network device command injection detection |
| Sigma | None | No IOS XE or SD-WAN-specific rules |
Sources: Cisco IOS XE Advisory · Cisco SD-WAN Advisory · GBHackers · CyberPress
Status Updates
- CVE-2026-9198 (Langflow): CISA KEV federal deadline TODAY August 7. Exploitation via auto_login + exec() chain ongoing. No new artifacts since yesterday’s brief.
- CVE-2026-34486 (Apache Tomcat): CISA KEV federal deadline TODAY August 7. EncryptInterceptor fail-open deserialization exploitation ongoing. No new artifacts since yesterday’s brief.
- CVE-2026-15409/15410 (SonicWall SMA1000): UTA0533 exploitation ongoing since June 22. INC ransomware wave continues. No new artifacts. Original brief.
- CVE-2026-6875 (ServiceNow): Active exploitation entering fifth week. Two sandbox-escape gadget chains. Fortune 500 victims. Still not on CISA KEV. Original brief.
- CVE-2026-50522 (SharePoint): CISA KEV July 22. BinaryFormatter exploitation via /_trust/default.aspx ongoing. Machine key theft for persistence. Original brief.