Cyber Threat Brief — August 7 2026
⚠️ This report is AI-generated. Always validate findings.
1. Zapscape KVM Guest-to-Host Escape — CVE-2026-64561
TL;DR: Public PoC for a use-after-free in KVM/x86 shadow MMU allows an L1 guest with root to escape to the host kernel. Multi-tenant cloud hosts exposing nested virtualization are at immediate risk of cross-tenant compromise.
What’s New:
- CVE-2026-64561 publicly disclosed August 6 after 5-day linux-distros embargo; PoC on GitHub (V4bel/Zapscape)
- Use-after-free in recursive shadow page zap path — guest-side actions alone corrupt host shadow pages
- AMD SVM hosts: exploitable with no extra CPU feature prerequisite; Intel: requires Ice Lake-SP or newer with 4-/5-level EPT passthrough
- Upstream fix merged July 21 (commit
2abd5287f083); vulnerable code path present since Linux 5.9 (July 2020) - Attack scenarios: host kernel panic (DoS all co-tenant VMs) or full host RCE from a single rented instance
Actionable Intel
| Artifact | Type | ATT&CK | Log Source | Action |
|---|---|---|---|---|
Kernel builds between f95eec9bed76 (2020-07-08) and 2abd5287f083 (2026-07-21) | Vulnerable asset | T1611 | Asset inventory, uname -r | Patch — update to stable kernel with fix |
KVM hosts with nested=1 module parameter | Attack surface | T1611 | /sys/module/kvm_intel/parameters/nested | Audit — disable nested virt for untrusted guests if not required |
| Unexpected guest-initiated host kernel panics | Exploitation indicator | T1499.004 | Host dmesg, kdump | Hunt — repeated KVM-related panics on multi-tenant hosts |
| Shadow MMU reclaim events + guest page table manipulation | Exploitation chain | T1611 | KVM tracepoints (kvm_mmu_zap_page) | Hunt — anomalous zap frequency from single guest |
Detection
| Source | Rule | Gap |
|---|---|---|
| Splunk ESCU | None | No KVM escape or nested virtualization abuse detection |
| Elastic | None | No Linux kernel VM escape detection |
| Sigma | None | No KVM shadow MMU exploitation rules |
Sources: GitHub PoC · The Hacker News · TuxCare · Proxmox Forum
2. OVSwrap Linux Kernel LPE via Open vSwitch — CVE-2026-64531
TL;DR: A 13-year-old integer wraparound in the Open vSwitch kernel module lets any unprivileged local user escalate to root. Public PoC ships pre-built payloads for ~800 kernel builds — no OVS configuration or privileges needed.
What’s New:
- Disclosed July 28 by Asim Manizada; upstream fix shipped in stable trees July 24; public PoC now available with ~800 pre-built kernel records
- 16-bit
nla_lenfield wraps when building oversized nested OVS actions; parser resumes inside attacker-controlled bytes processed as legitimate actions - Exploitation chain: leak kernel pointers → read kernel memory → targeted credential corruption → write sudoers entry → root shell
- Requires only a local account — no OVS configuration, no running ovs-vswitchd, no bridge, no CAP_NET_ADMIN
- Affects EL9/EL10 family, Debian, Ubuntu — any distro with
openvswitchkernel module loadable
Actionable Intel
| Artifact | Type | ATT&CK | Log Source | Action |
|---|---|---|---|---|
Unpatched kernels with openvswitch.ko module available | Vulnerable asset | T1068 | Asset inventory, modinfo openvswitch | Patch kernel or blacklist openvswitch module if unused |
openvswitch module loaded on hosts not running OVS | Unnecessary attack surface | T1068 | lsmod, auditd | Remediate — blacklist module via /etc/modprobe.d/ |
| Anomalous Netlink messages to OVS generic netlink family | Exploitation indicator | T1068 | auditd, kernel tracepoints | Hunt — non-root users sending OVS_FLOW_CMD_NEW |
Unexpected /etc/sudoers modifications | Post-exploitation | T1548.003 | auditd (watch /etc/sudoers), FIM | Hunt — credential corruption payload writes sudoers |
Detection
| Source | Rule | Gap |
|---|---|---|
| Splunk ESCU | Linux Auditd Add User Account (adjacent) | No OVS kernel module exploitation or Netlink abuse detection |
| Elastic | Sudoers File Modification (post-exploitation) | No kernel module exploit or credential corruption detection |
| Sigma | lnx_auditd_susp_modprobe.yml (partial) | No OVS-specific exploitation rule |
Sources: CyberPress · GBHackers · TuxCare · SecurityOnline · CloudLinux
3. TeamCity Deserialization RCE Now on CISA KEV — CVE-2026-63077
TL;DR: CISA added TeamCity pre-auth deserialization RCE to KEV on August 5 after confirming active exploitation. Federal deadline is TOMORROW August 8. Exploitation is automatable with total technical impact — CI/CD pipeline and credential theft at stake.
What’s New:
- CISA KEV addition August 5 with unusually short August 8 federal deadline (3 days)
- Exploitation status upgraded from “none” to “active” — rated automatable with total technical impact
- Unauth attacker sends crafted serialized objects to agent polling protocol; no credentials, no user interaction required
- Successful exploitation exposes stored credentials, build artifacts, and enables downstream CI/CD supply chain compromise
- Affects all TeamCity On-Premises versions; fixed in 2026.1.3 / 2025.11.7; security patch plugin available for 2017.1+
Actionable Intel
| Artifact | Type | ATT&CK | Log Source | Action |
|---|---|---|---|---|
| TeamCity On-Premises < 2026.1.3 or < 2025.11.7 | Vulnerable asset | T1190 | Asset inventory | Patch — federal deadline TOMORROW |
| Agent polling protocol traffic (port 9090/default) from non-agent IPs | Exploitation indicator | T1190 | Network flow, TeamCity access logs | Hunt — unexpected polling connections |
| New build agents registered without admin action | Post-exploitation | T1525 | TeamCity audit log | Hunt — rogue agent registration |
TeamCity process spawning shells (cmd.exe, bash, powershell) | Post-exploitation | T1059 | Sysmon EID 1, EDR | Hunt — java.exe parent with unexpected children |
Detection
| Source | Rule | Gap |
|---|---|---|
| Splunk ESCU | None | No TeamCity agent polling protocol deserialization detection |
| Elastic | None | No TeamCity-specific exploitation detection |
| Sigma | Suspicious Java Process Spawning Shell (generic, partial) | No TeamCity polling protocol or rogue agent registration rule |
Sources: Rapid7 · The Hacker News · JetBrains Advisory · SecurityWeek · BleepingComputer
Status Updates
- CVE-2026-18577/18556 (N-able N-central): Hotfix 2 (build 2026.3.1.10) released August 6, supersedes Hotfix 1. Threat actors evolving attack techniques against initial fix. Federal KEV deadline passed yesterday. Upgrade to Hotfix 2 even if Hotfix 1 was applied. Original brief.
- CVE-2026-9198 (Langflow): Federal CISA KEV deadline TODAY August 7. auto_login + exec() exploitation ongoing. No new artifacts. Original brief.
- CVE-2026-34486 (Apache Tomcat): Federal CISA KEV deadline TODAY August 7. EncryptInterceptor fail-open deserialization exploitation ongoing. No new artifacts. Original brief.
- CVE-2026-15409/15410 (SonicWall SMA1000): INC ransomware exploitation continues. 885+ victims. No new artifacts. Original brief.
- CVE-2026-6875 (ServiceNow): Active exploitation entering sixth week. Still not on CISA KEV. Original brief.