Cyber Threat Brief — August 14 2026
⚠️ This report is AI-generated. Always validate findings.
1. SharePoint Pre-Auth RCE Chain Exploited After PoC Release — CVE-2026-55040 / CVE-2026-63520
TL;DR: Rapid7 published a PoC for the SharePoint JWT auth bypass (CVE-2026-55040, CVSS 9.1) on August 11, and Defused confirmed exploitation against honeypots within 24 hours. The companion RCE (CVE-2026-63520, CVSS 8.1) was patched the same day, completing an unauthenticated RCE chain against on-prem SharePoint.
What’s New:
- Rapid7 released full PoC script August 11 for CVE-2026-55040 (JWT token validation bypass in SharePoint Subscription Edition/2019/2016)
- Defused honeypots recorded exploitation attempts starting August 12 using the Rapid7 PoC
- CVE-2026-63520 (unsafe .NET type instantiation in Business Connectivity Services) disclosed and patched August 11 — completes the chain from unauth to RCE
- Chain developed using AI-assisted agentic workflow for Pwn2Own Berlin (120 agent-hours, 80K tool calls)
- Code runs as the SharePoint Windows service account; SharePoint Online not affected
Actionable Intel
| Artifact | Type | ATT&CK | Log Source | Action |
|---|---|---|---|---|
| Forged JWT tokens against SharePoint auth endpoints | Exploit | T1190 | IIS W3SVC logs, SharePoint ULS logs | Alert on anomalous JWT claims or auth bypass patterns |
| POST requests to Business Connectivity Services endpoints | Exploit | T1190 | IIS logs, WAF | Block/alert on BCS endpoint requests from external IPs |
| w3wp.exe spawning cmd.exe/powershell.exe | Post-exploit | T1059 | Sysmon EID 1, EDR | Hunt for shell children of SharePoint app pools |
Webshell drops under _layouts/ or _vti_bin/ | Persistence | T1505.003 | File integrity, Sysmon EID 11 | Monitor SharePoint virtual dirs for new .aspx/.asmx files |
| Unpatched SharePoint SE/2019/2016 on-prem | Vuln | — | Asset inventory | Apply July 2026 CU (CVE-2026-55040) + August 2026 CU (CVE-2026-63520) |
Detection
| Source | Rule | Gap |
|---|---|---|
| Splunk ESCU | W3WP Spawning Shell, SharePoint Server Spawning Shell | No rule for JWT token forgery or BCS-specific type instantiation exploit |
| Elastic | Webshell Detection: Script Process Child of Common Web Processes | No SharePoint JWT auth bypass detection |
| Sigma | webshell_detection_file_creation.yml, proc_creation_win_iis_w3wp_susp_child_processes.yml | No rule for SharePoint JWT validation bypass or BCS unsafe deserialization |
Sources: Rapid7 CVE-2026-55040 PoC, Rapid7 CVE-2026-63520 disclosure, Defused exploitation confirmation, The Hacker News
2. GeoServer jsonArrayContains Zero-Day SQL Injection — No CVE Assigned
TL;DR: An unpatched SQL injection in GeoServer’s jsonArrayContains filter was disclosed August 12 with no CVE, no patch, and active probing already underway. On MSSQL with sa privileges, this is unauthenticated RCE.
What’s New:
- Researcher @q1uf3ng disclosed on X (August 12, 10:46 UTC) that
jsonArrayContainsallows unauthorized SQL injection - Affects PostGIS and Oracle JDBC data stores; MSSQL with
saaccount escalates to full RCE viaxp_cmdshell - watchTowr recorded hundreds of probing attempts within hours from a small pool of IPs — currently fingerprinting, not full payload delivery
- No CVE assigned, no patch available, no vendor timeline published
- Root cause: user-supplied arguments to
jsonArrayContainsnot sanitized before encoding into database queries
Actionable Intel
| Artifact | Type | ATT&CK | Log Source | Action |
|---|---|---|---|---|
SQL injection payloads in jsonArrayContains filter parameter | Exploit | T1190 | WAF, reverse proxy, GeoServer access logs | Block/alert on jsonArrayContains in OGC filter requests from external IPs |
xp_cmdshell execution on MSSQL backing GeoServer | Post-exploit | T1059.001 | MSSQL audit logs, Sysmon | Alert on xp_cmdshell invocation from GeoServer DB connection |
| Probing requests triggering GeoServer SQL errors | Recon | T1595.002 | GeoServer logs, WAF | Monitor for 500 errors on OGC filter endpoints |
| Internet-exposed GeoServer instances | Vuln | — | Asset inventory, Shodan | Restrict public access or disable jsonArrayContains function |
Detection
| Source | Rule | Gap |
|---|---|---|
| Splunk ESCU | None | No GeoServer-specific detection; need WAF rule on jsonArrayContains payloads |
| Elastic | None | No GeoServer SQL injection detection |
| Sigma | None | No rule exists; custom WAF/proxy signature needed for jsonArrayContains filter injection |
Sources: The Hacker News, SecurityWeek, CSO Online
3. Gunra Ransomware — CISA #StopRansomware AA26-222A
TL;DR: CISA, FBI, DC3, NSA, USSS, and Korean NPA issued a joint advisory (AA26-222A) on Gunra, a Conti-derived RaaS targeting healthcare, finance, and government via FortiOS VPN exploitation (CVE-2024-55591, CVE-2025-24472). Full IOC set and YARA rules in the advisory.
What’s New:
- Joint advisory published August 10; Gunra active since April 2025, shifted to full RaaS in January 2026
- Initial access: CVE-2024-55591 (FortiOS Node.js WebSocket super-admin) and CVE-2025-24472 (CSF proxy auth bypass)
- Also targets Schneider Electric PowerLogic P5 relays (CVE-2024-5559) for IT/OT pivot
- Double-extortion model with Tor negotiation portal and 5-7 day payment deadline
- Comprehensive IOC set in advisory: file hashes, C2 infrastructure, YARA rules, behavioral TTPs
Actionable Intel
| Artifact | Type | ATT&CK | Log Source | Action |
|---|---|---|---|---|
| CVE-2024-55591 exploitation against FortiOS Node.js websocket | Initial Access | T1190 | FortiGate logs, WAF | Ensure FortiOS patched; hunt for unauthorized super-admin accounts |
| CVE-2025-24472 CSF proxy abuse | Initial Access | T1190 | FortiGate logs | Patch and audit admin account creation events |
| Gunra ransomware file hashes (see AA26-222A) | Malware | T1486 | EDR, AV | Import IOCs from CISA advisory into detection stack |
| Tor-based negotiation portal infrastructure | C2 | T1090.003 | Firewall, proxy | Block Tor exit node traffic; monitor for .onion DNS queries |
| Schneider PowerLogic P5 relay targeting (CVE-2024-5559) | Lateral Movement | T1210 | OT network monitoring | Segment PowerLogic relays; audit firmware versions |
Detection
| Source | Rule | Gap |
|---|---|---|
| Splunk ESCU | Ransomware analytic stories (Conti-derived patterns), FortiGate Admin Activity | No Gunra-specific analytic story; import AA26-222A IOCs as custom lookup |
| Elastic | Ransomware Detection rules (behavioral) | No Gunra-specific rule; import advisory hashes |
| Sigma | win_proc_creation_conti_indicators.yml (partial, Conti-derived) | No Gunra-specific rule; advisory YARA rules should be deployed to EDR |
Sources: CISA AA26-222A, SafeBreach Coverage, GBHackers
Status Updates
- CVE-2026-20349 (Cisco ASA/FTD): Federal CISA KEV deadline TODAY August 14. Active exploitation via crafted HTTP causing VPN device reload. Original brief.
- CVE-2026-68820 (Windows AFD.sys/Lazarus): Lazarus FudModule v3.1 campaign ongoing. No new IOCs since August 12 coverage. Patch via August Patch Tuesday. Original brief.
- CVE-2026-72898 (Metabase SQLi): Active exploitation ongoing. ~2,500 internet-exposed instances. No new artifacts since August 12. Original brief.
- CVE-2026-50656/ShieldBreak (Windows Defender): Unpatched bypass of RoguePlanet fix. No new artifacts since August 13 coverage. Original brief.
- CVE-2026-59310 (VMware vCenter): 361 victims across 47 countries. Mass exploitation ongoing. No new artifacts since August 13 coverage. Original brief.