Cyber Threat Brief — August 24 2026
⚠️ This report is AI-generated. Always validate findings.
1. Zimbra SNMP Command Injection — CVE-2026-73570
TL;DR: Unauthenticated RCE in Zimbra Collaboration via SNMP notification processing, exploited ITW per CERT Polska. CISA KEV federal deadline is TODAY (August 24).
What’s New:
- CISA added to KEV August 21; CERT Polska confirmed active exploitation August 17
- CWE-78 OS command injection in SNMP notification handler — attacker sends crafted SMTP requests, gets code execution as
zimbrauser - Affects ZCS versions before 10.1.20 when
zimbra-snmppackage is installed and SNMP notifications enabled - CVSS 8.9; no authentication required, no user interaction
- Patched in ZCS 10.1.20 (released July 20 2026)
Actionable Intel
| Artifact | Type | ATT&CK | Log Source | Action |
|---|---|---|---|---|
| Crafted SMTP payloads triggering SNMP notification path | Initial Access | T1190 | Zimbra MTA logs, /var/log/zimbra.log | Hunt for anomalous service-status messages (unknown payloads changing state) |
Unexpected processes spawned as zimbra user | Execution | T1059.004 | Sysmon (Linux), auditd | Alert on shell/child processes from Zimbra service accounts |
| Web shells in Zimbra webroot | Persistence | T1505.003 | File integrity monitoring | Sweep /opt/zimbra/jetty/webapps/ and /opt/zimbra/httpd/ for new .jsp/.php files |
Cron jobs or systemd units created by zimbra user | Persistence | T1053.003 | auditd, cron logs | Hunt for new scheduled tasks under zimbra context |
| Outbound C2 from Zimbra server | C2 | T1071.001 | Firewall/proxy logs | Baseline and alert on outbound connections from mail infrastructure |
Detection
| Source | Rule | Gap |
|---|---|---|
| Splunk ESCU | None | No coverage for Zimbra SNMP injection; need custom rule on zimbra.log anomalous service-status patterns |
| Elastic | None | No Zimbra-specific rules; gap for SMTP-triggered command injection |
| Sigma | Generic web shell detection rules apply | Missing Zimbra-specific SNMP notification abuse detection |
Sources: CISA KEV · The Hacker News · Security Arsenal · SOCRadar
2. GitLab GraphQL Code Injection — CVE-2026-19478
TL;DR: Critical code injection (CVSS 9.4) in self-managed GitLab via GraphQL directive lets unauthenticated attackers modify/delete public projects. Exploited ITW within 2 days of disclosure.
What’s New:
- Disclosed August 17, out-of-band patches released same day; WatchTowr confirmed exploitation by August 20
- Unauthenticated attacker abuses GraphQL directive to inject code — can delete repositories, forge merge records, ban maintainers
- Affects GitLab CE/EE across multiple 18.x and 19.x branches
- Horizon3.ai published detailed attack research with exploitation methodology
- Fixed in 19.2.4, 19.1.6, 19.0.8, 18.11.11
Actionable Intel
| Artifact | Type | ATT&CK | Log Source | Action |
|---|---|---|---|---|
GraphQL requests containing @gl_introduced directive | Exploitation | T1190 | GitLab web/API logs, WAF | Hunt/block requests with @gl_introduced in GraphQL queries |
| Unauthorized project deletions or merge record modifications | Impact | T1485 | GitLab audit logs (audit_events table) | Alert on project deletions or merges by unauthenticated sessions |
| Mass repository enumeration via GraphQL | Recon | T1526 | GitLab API rate-limit logs | Alert on high-volume GraphQL project queries from single source |
| Maintainer account bans from non-admin sessions | Privilege abuse | T1531 | GitLab admin audit log | Alert on account status changes outside admin context |
Detection
| Source | Rule | Gap |
|---|---|---|
| Splunk ESCU | None | No GitLab-specific coverage; need custom search on GitLab audit/API logs for @gl_introduced |
| Elastic | None | No GitLab GraphQL injection rules |
| Sigma | None | No coverage; custom rule needed for GraphQL directive injection patterns in web logs |
Sources: SecurityWeek · The Hacker News · Horizon3.ai · Security Affairs
3. Metabase Password-Reset SQL Injection — CVE-2026-72898
TL;DR: CVSS 10.0 unauthenticated SQLi in Metabase /reset_password endpoint grants admin access to all connected data warehouses (Snowflake, BigQuery, Redshift, etc.). Five companies breached before disclosure; CISA KEV since August 11.
What’s New:
- Unauthenticated SQL injection via
/reset_passwordendpoint — attacker gains admin access to Metabase instance - Admin access exposes connection strings and credentials for every connected database/warehouse
- Five companies confirmed breached before Metabase disclosed August 6; KEV added August 11
- Downstream risk is extreme: a single Metabase compromise pivots to Databricks, MongoDB, Oracle, Snowflake, Redshift, BigQuery
- Federal remediation deadline was August 14 (passed)
Actionable Intel
| Artifact | Type | ATT&CK | Log Source | Action |
|---|---|---|---|---|
Anomalous requests to /api/session/reset_password | Initial Access | T1190 | Metabase application logs, WAF/reverse proxy logs | Hunt for SQLi payloads in password reset requests |
| New admin accounts created without corresponding user registration | Persistence | T1136.001 | Metabase audit log, database core_user table | Alert on admin account creation outside normal workflows |
| Bulk database credential access from Metabase admin panel | Credential Access | T1552.001 | Metabase application logs | Alert on mass connection-string reads |
| Unexpected queries to connected warehouses from Metabase service account | Lateral Movement | T1021 | Snowflake/BigQuery/Redshift audit logs | Baseline Metabase query patterns; alert on anomalies |
Detection
| Source | Rule | Gap |
|---|---|---|
| Splunk ESCU | None | No Metabase-specific coverage; need custom rule on WAF/proxy logs for SQLi in /reset_password |
| Elastic | None | Generic SQLi detection may partially catch; no Metabase-specific rule |
| Sigma | Generic SQL injection web rules | Missing Metabase endpoint-specific detection |
Sources: The Hacker News · GBHackers · TechTimes · runZero
Status Updates
- CVE-2026-72529/72530 (TrueConf Server): Kaspersky published full IOC dump — 20+ MD5 hashes (PhantomCore, PhantomGraph DLLs, web shells, ELF backdoors, rootkit), 5 C2 IPs, 10 domains, YARA rules, and Windows service names (
SysExcSvc,SysReadSvc). Federal deadline passed August 23. Original brief. Kaspersky Securelist. - CVE-2026-33824 (Windows IKE): Public PoC exploit code now on GitHub (
kaleth4/CVE-2026-33824); claims reliable execution across patch table. Prioritize patching any remaining unpatched IKE/VPN endpoints. Original brief. - CVE-2026-69836 (Microsoft Entra ID): Microsoft corrected advisory — vulnerability was not exploited ITW; mistakenly flagged. Fully mitigated server-side, no customer action needed. Downgrade priority. Original brief.