Cyber Threat Brief — August 13 2026
⚠️ This report is AI-generated. Always validate findings.
1. VMware vCenter Mass Exploitation — CVE-2026-59310
TL;DR: QUIRSO confirmed active exploitation of the vCenter Syslog directory-traversal RCE (CVSS 9.8) with 361 victim IPs across 47 countries since August 3 — five days after disclosure. Attackers deploy reverse_ssh for persistent backdoor access via cron jobs.
What’s New:
- QUIRSO published August 12 findings: 343 of 361 victims compromised by August 5, rapid acceleration from August 3 start
- Top affected countries: Germany, US, Turkey, Iran, France (185 IPs, ~51% of victims)
- Post-exploitation: malicious cron job deploys
reverse_ssh(open-source SSH reverse-shell framework) for connect-back persistence - Suspected APT-level actor; outbound SSH tunnels bypass perimeter firewalls
- Previously covered July 30 as “no ITW exploitation” — now mass-exploited
Actionable Intel
| Artifact | Type | ATT&CK | Log Source | Action |
|---|---|---|---|---|
reverse_ssh binary on vCenter appliance | Tool | T1219 | EDR / file integrity | Hunt for unauthorized binaries in /usr/bin, /tmp, /var/tmp |
| Malicious cron job entry | Persistence | T1053.003 | /var/log/cron, auditd | Review all crontab entries on vCenter appliances |
| Outbound SSH to unknown external IPs | C2 | T1572 | Firewall/NSM (Zeek ssh.log) | Alert on vCenter → external SSH connections |
| Path traversal in Syslog server | Initial Access | T1190 | vCenter vpxd.log, reverse proxy | Inspect for ../ sequences in Syslog-related HTTP requests |
| vCenter versions < 9.1.0.0300 / 9.0.2.0100 / 8.0 U3k | Vuln | — | Asset inventory | Patch to VMSA-2026-0006.1 fixed versions immediately |
Detection
| Source | Rule | Gap |
|---|---|---|
| Splunk ESCU | None | No vCenter Syslog traversal or reverse_ssh detection rule |
| Elastic | None | No vCenter-specific exploitation detection |
| Sigma | None | Need: unauthorized binary on vCenter appliance, anomalous outbound SSH from vCenter management IP |
Sources: QUIRSO GmbH — Active exploitation of CVE-2026-59310 · GBHackers · The Hacker News · Rapid7 ETR
2. ShieldBreak Defender Patch Bypass — CVE-2026-50656
TL;DR: Chaotic Eclipse released ShieldBreak on August 12, a full bypass of the July 2026 RoguePlanet patch (CVE-2026-50656), restoring SYSTEM-level privilege escalation on fully patched Windows 11 25H2 and Server 2025. No patch available.
What’s New:
- ShieldBreak uses Cloud Filter API (
cfapi) user-mode callback hooks during Defender cloud-hydration scans — entirely different technique from original RoguePlanet filesystem race condition - 100% success rate on Windows 11 25H2, Canary channel, and Server 2025; Windows 10 vulnerable but PoC not yet adapted
- Will Dormann (Tharros) confirmed exploit works; requires Defender enabled
- Kevin Beaumont published KQL detection queries for Defender for Endpoint
- This is the 9th Defender/Windows zero-day from Nightmare Eclipse since April 2026
Actionable Intel
| Artifact | Type | ATT&CK | Log Source | Action |
|---|---|---|---|---|
CfCreatePlaceholders / CfConnectSyncRoot API calls from non-OneDrive processes | Exploitation | T1068 | Sysmon EID 1 (process creation), ETW | Hunt for Cloud Filter API abuse outside legitimate sync providers |
Suspicious MsMpEng.exe child processes | Post-exploit | T1068 | Sysmon EID 1 | Alert on Defender engine spawning cmd/powershell/conhost |
| Integrity level jump (Medium → System) in MsMpEng context | Privesc | T1068 | Windows Security EID 4688 | Correlate token elevation events with Defender process tree |
PoC repo: git.projectnightcrawler.dev/NightmareEclipse/ShieldBreak | Intel | — | — | Block/monitor access in proxy logs |
Detection
| Source | Rule | Gap |
|---|---|---|
| Splunk ESCU | Analytics Story: RoguePlanet (partial — ADS :WDFOO, MsMpEng child proc) | Does not detect cfapi callback vector; needs Cloud Filter API abuse rule |
| Elastic | UAC Bypass via Fodhelper (adjacent) | No ShieldBreak-specific cfapi detection |
| Sigma | technoherder BlueHammer suite (7 rules, partial) | Missing: CfCreatePlaceholders from non-sync process, Defender cloud-hydration hook |
| MDE KQL | GossiTheDog ShieldBreak.kql | Best current coverage — deploy immediately |
Sources: BleepingComputer · The Hacker News · Arctic Wolf · Security Affairs
Status Updates
- CVE-2026-20349 (Cisco ASA/FTD VPN DoS): CISA KEV federal deadline TOMORROW August 14. Active exploitation via crafted HTTP to RAVPN causing device reload. August 12 brief.
- CVE-2026-68820 (Windows AFD.sys / Lazarus): Patched August 11 Patch Tuesday. CISA KEV. Lazarus FudModule v3.1 rootkit deployment ongoing. No new IOCs. August 12 brief.
- CVE-2026-72898 (Metabase SQLi): CISA KEV added August 11. Framework, n8n, Tally, Kilo Code confirmed breached. Security Arsenal Sigma rules available. August 12 brief.
- CVE-2026-18577 (N-able N-central): Storm-1175 deploying StormEncryptor ransomware via Take Control pivot. Hotfix 2 (2026.3.1.10) released August 10. Federal deadline passed August 6. August 11 brief.
- CVE-2026-6875 (Confluence Data Center): Active exploitation entering eighth week. Fortune 500 and critical infrastructure victims. Still not on CISA KEV.