Cyber Threat Brief — August 26 2026
⚠️ This report is AI-generated. Always validate findings.
1. Oracle WebLogic Proxy Plug-in Auth Bypass — CVE-2026-21962 (CISA KEV)
TL;DR: CISA added CVE-2026-21962 (CVSS 10.0) to KEV on August 24 with a federal deadline of August 27. URI normalization inconsistency between Oracle HTTP Server and backend WebLogic allows unauthenticated compromise; 140K+ exploitation attempts observed since January.
What’s New:
- CISA KEV addition August 24; federal remediation deadline August 27 (tomorrow)
- Affects Oracle HTTP Server / WebLogic Proxy Plug-in versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0
- Public PoC on GitHub within 48h of January disclosure; CloudSEK honeypots recorded first exploitation January 22
- China-linked actor leveraging this for SNOWLIGHT downloader delivery across 100+ countries
- GreyNoise, CloudSEK, and SOCRadar independently confirm active exploitation at scale
Actionable Intel
| Artifact | Type | ATT&CK | Log Source | Action |
|---|---|---|---|---|
Malformed traversal sequences in URI (..;/, %2e%2e/) targeting WebLogic proxy paths | Initial Access | T1190 | OHS access logs, WAF | Alert on path traversal patterns in requests to /weblogic/, /_wl_proxy/ |
| Injected headers in proxy requests | Initial Access | T1190 | OHS access logs | Hunt for unusual WL-Proxy-Client-* or X-WebLogic-* headers from external IPs |
| SNOWLIGHT downloader (China-nexus) | C2 | T1105 | EDR, proxy logs | Block known SNOWLIGHT C2 infrastructure; hunt for new beaconing from WebLogic hosts |
Probing of /console/, /wls-wsat/, /_async/ paths | Reconnaissance | T1595.002 | WAF, access logs | Alert on sequential probing of known WebLogic admin endpoints |
Detection
| Source | Rule | Gap |
|---|---|---|
| Splunk ESCU | None specific to CVE-2026-21962 | Need custom rule for OHS access logs: URI normalization anomalies + traversal sequences |
| Elastic | None | No WebLogic proxy-layer detection; need rule for proxy header injection |
| Sigma | web_application_attack.yml (generic path traversal) | Missing Oracle-specific URI normalization mismatch patterns |
Sources: CISA KEV · The Hacker News · SecurityWeek · Field Effect PoC Analysis
2. E4del & PINHOLE RATs — FTP Banner Dead Drop Resolvers
TL;DR: Two novel RATs use FTP server banners as dead drop resolvers to fetch C2 commands, bypassing traditional URL-based detection. E4del hides inside signed Discord binaries; PINHOLE uses Halo’s Gate syscalls and Pinterest/SurveyMonkey for C2 resolution.
What’s New:
- SOCRadar STRU disclosed two previously undocumented RAT families active since early July 2026
- FTP banner DDR technique: malware connects to attacker-controlled FTP servers and parses the welcome banner for encoded C2 instructions — no file transfer occurs
- E4del: Electron-based RAT packaged as signed Discord.exe; replaces
app.asarwith malicious Node.js payload; 8 commands including live desktop streaming via WebSocket - PINHOLE: Multi-stage RAT with 14 commands; uses Halo’s Gate for direct syscalls bypassing EDR hooks; Early Bird APC injection into
ApplicationFrameHost.exe; NTFS ADS for config storage - PINHOLE resolves C2 via Pinterest pins and SurveyMonkey survey questions with custom base-41 encoding, proxied through Cloudflare Workers
Actionable Intel
| Artifact | Type | ATT&CK | Log Source | Action |
|---|---|---|---|---|
157.254.194[.]31, 167.148.41[.]164, 209.99.185[.]38, 69.48.228[.]126, 45.61.136[.]50, 45.87.41[.]133, 185.14.92[.]162, 64.95.13[.]65, 72.5.43[.]81 | C2 IPs | T1071.002 | Firewall, proxy | Block; alert on any outbound FTP (port 21) to these IPs |
nokierojotiarmx[.]com | C2 Domain | T1071.001 | DNS, proxy | Block domain |
worker-1785198984-xsekhi.api-62c3cac6.workers[.]dev | C2 Proxy | T1090 | Proxy logs | Block; hunt for Cloudflare Worker domains in endpoint traffic |
117b2b7e7c0d...731c (d.zip), e0c41dc4...0ddb (index.js), 391a6058...e172 (u.cmd), 27587e07...42a5 (calc.exe) | File Hashes | T1204.002 | EDR | Block SHA256 hashes |
| Outbound FTP connections from user workstations or Office processes | Initial Delivery | T1071.002 | Firewall, Sysmon Event 3 | Alert on FTP connections from non-server endpoints |
Discord.exe with --init argument from non-standard path | Execution | T1036.005 | Sysmon Event 1 | Alert on Discord.exe running outside %LOCALAPPDATA%\Discord\ |
NTFS ADS on desktop.ini (:bt, :ek, :1, :2, :3) | Persistence | T1564.004 | Sysmon Event 15 | Hunt for ADS creation on desktop.ini files |
Registry HKCU\...\Windows\Load value | Persistence | T1547.001 | Sysmon Event 13 | Alert on modification of legacy Load autorun key |
ApplicationFrameHost.exe spawned suspended | Defense Evasion | T1055.004 | EDR, Sysmon Event 1+8 | Alert on ApplicationFrameHost.exe with suspicious parent or suspended creation |
Detection
| Source | Rule | Gap |
|---|---|---|
| Splunk ESCU | None | No FTP DDR detection; no E4del/PINHOLE signatures. Need: outbound FTP from workstations, Discord.exe from non-standard paths, ADS on desktop.ini |
| Elastic | Suspicious Browser Child Process (partial for Discord abuse) | Missing FTP DDR technique, ADS config storage, ApplicationFrameHost.exe injection |
| Sigma | proc_creation_win_susp_electron_app.yml (partial) | Missing FTP banner abuse detection, PINHOLE persistence via HKCU\Windows\Load |
Sources: SOCRadar STRU · The Hacker News · BleepingComputer
3. miniOrange SAML SSO Auth Bypass — CVE-2026-61979 / CVE-2026-15981
TL;DR: Two chained auth bypass flaws in the miniOrange SAML 2.0 SSO WordPress plugin (CVSS 9.8) allow unauthenticated admin account takeover. Exploitation confirmed ITW with opportunistic scanning from multiple cloud/VPN sources.
What’s New:
- CVE-2026-61979 (CVSS 8.1): Signature algorithm confusion — attacker switches RSA verification to HMAC-SHA1, using the known IdP public key as shared secret to forge valid signatures
- CVE-2026-15981 (CVSS 9.8): OpenSSL verification error (-1) treated as success, allowing malformed signatures to pass validation
- Chained together: forge SAML assertion → bypass signature verification → log in as any user including admin
- DigitalOcean detected and blocked exploitation attempts; scanning from multiple cloud, hosting, VPN, and mobile-network IPs suggests opportunistic campaign
- Seven editions of the plugin affected; six paid editions were never tracked in any vulnerability database
- Patched in Standard edition v17.0.5 (CVE-2026-61979) and v17.0.6 (CVE-2026-15981)
Actionable Intel
| Artifact | Type | ATT&CK | Log Source | Action |
|---|---|---|---|---|
SAML AuthnResponse with SignatureMethod set to HMAC-SHA1 against an RSA-configured IdP | Initial Access | T1078.004 | WAF, WordPress access logs | Alert on SAML responses using unexpected signature algorithms |
| WordPress admin login from unusual IP/geo after SAML auth | Privilege Escalation | T1078.004 | WordPress auth logs, wp_login action | Hunt for new admin sessions from untrusted sources |
POST to /wp-login.php?saml_sso or /wp-admin/admin-ajax.php?action=saml_login | Initial Access | T1190 | Web server access logs | Baseline SAML SSO endpoint usage; alert on spikes or new source IPs |
| New admin user creation or role changes post-SAML auth | Persistence | T1136.001 | WordPress user_register hook, DB audit | Alert on admin role assignments following SAML authentication |
| Plugin version < 17.0.6 (Standard edition) | Vulnerability | — | Asset inventory | Patch immediately; check all seven edition variants |
Detection
| Source | Rule | Gap |
|---|---|---|
| Splunk ESCU | None | No WordPress SAML-specific rules; need detection for HMAC algorithm downgrade in SAML responses |
| Elastic | None | No coverage for WordPress SSO plugin exploitation |
| Sigma | None specific | Missing WordPress SAML auth bypass detection; generic web app rules may catch POST volume anomalies |
Sources: The Hacker News · Patchstack Analysis · BleepingComputer · SecurityWeek
Status Updates
- CVE-2026-18963 (Keycloak): CVSS 9.1 reset-credentials auth bypass; PoC on GitHub, patched in 26.4.15/26.6.12/26.7.2. Hunt for
UPDATE_PASSWORDevents without precedingVERIFY_EMAILin Keycloak audit logs. Kudelski Research - Mirage2FA (PhaaS): ANY.RUN reports 4,532 companies compromised via AiTM session theft targeting Microsoft 365; 63.7% US victims. Hunt for impossible-travel on Entra ID sign-ins and session cookie reuse from new IPs. The Hacker News
- CVE-2026-69836 (Microsoft Entra ID): No new artifacts since August 24 coverage. Original brief.