Cyber Threat Brief — August 28 2026
⚠️ This report is AI-generated. Always validate findings.
1. SharePoint Unauth RCE Chain Now Exploited ITW — CVE-2026-63520
TL;DR: Chaining CVE-2026-55040 (auth bypass, July patch) with CVE-2026-63520 (BDC unsafe type instantiation, August patch) gives unauthenticated RCE on SharePoint Server. VulnCheck PoC dropped August 24; honeypot exploitation observed August 25.
What’s New:
- VulnCheck published full chain PoC on August 24 exploiting BDC
DbTypeReflectorunsafe .NET type instantiation - Honeypot exploitation observed August 25 — attackers chaining both CVEs for unauth RCE
- Requires both July (CVE-2026-55040) AND August (CVE-2026-63520) patches to remediate
- Affects SharePoint Server Subscription Edition, 2019, Enterprise 2016, Project Server 2013 SP1, Office Web Apps 2013 SP1
- Code execution runs as SharePoint service account — typically high-privilege domain user
Actionable Intel
| Artifact | Type | ATT&CK | Log Source | Action |
|---|---|---|---|---|
POST requests with crafted JWT to /_api/ endpoints | Auth bypass (CVE-2026-55040) | T1190 | IIS W3C logs | Alert on anonymous requests to authenticated SharePoint API endpoints |
.bdcm model file upload with assembly-qualified type names | RCE payload (CVE-2026-63520) | T1190 | SharePoint ULS logs, IIS | Hunt for BDC model imports with uncommon .NET types in DbTypeReflector |
w3wp.exe spawning cmd.exe, powershell.exe | Post-exploitation | T1059.001 | Sysmon 1, EDR | Alert on SharePoint app pool process spawning shells |
| Outbound connections from SharePoint service account | C2/exfil | T1071 | Firewall, proxy | Baseline SharePoint server egress; alert on anomalous outbound |
Detection
| Source | Rule | Gap |
|---|---|---|
| Splunk ESCU | ”SharePoint Server Suspicious Process Spawn” (generic) | No rule specific to BDC model abuse or CVE-2026-63520 payload pattern |
| Elastic | ”Microsoft SharePoint Server Suspicious Process” | Missing BDC-specific detection; auth bypass (CVE-2026-55040) JWT pattern not covered |
| Sigma | proc_creation_win_iis_webserver_suspicious_child_process.yml | Generic; needs SharePoint BDC model upload + unsafe type instantiation correlation |
Sources: VulnCheck PoC Analysis · Rapid7 Technical Analysis · BleepingComputer · Rapid7 Disclosure
2. Ubiquiti UniFi Triple CVSS 10.0 — CVE-2026-77537 / 77550 / 77554
TL;DR: Ubiquiti disclosed 22 vulnerabilities on August 26 including three CVSS 10.0 flaws affecting UniFi Protect, UniFi OS, and UniFi Talk. No exploitation yet, but Ubiquiti’s May 2026 CVSS 10.0 vulns were weaponized within days of PoC — patch now.
What’s New:
- CVE-2026-77537 (CVSS 10.0): Improper input validation in UniFi Protect ≤7.1.87 — unauth RCE on camera management
- CVE-2026-77550 (CVSS 10.0): CRLF injection in UniFi OS — unauth authentication bypass on all UniFi OS devices
- CVE-2026-77554 (CVSS 10.0): UniFi Talk ≤5.3.1 — unauth remote compromise
- All three: no authentication required, no user interaction, network-accessible
- Patches: Protect 7.2.105, Talk 5.3.2, UniFi OS 5.x — released August 26
Actionable Intel
| Artifact | Type | ATT&CK | Log Source | Action |
|---|---|---|---|---|
| Unauth requests to UniFi Protect API (port 7443) | Initial Access | T1190 | Network flow, UniFi logs | Patch to 7.2.105; restrict management port access to admin VLANs |
CRLF sequences (%0d%0a) in HTTP headers to UniFi OS | Auth bypass (CVE-2026-77550) | T1190 | WAF, reverse proxy logs | Alert on CRLF injection patterns in requests to UniFi management interfaces |
| Anomalous admin sessions on UniFi controllers | Persistence | T1078 | UniFi controller audit logs | Review active admin sessions; rotate credentials post-patch |
| External access to UniFi management ports (443, 8443, 7443) | Exposure | T1190 | Firewall | Audit and restrict; no UniFi management interface should face the internet |
Detection
| Source | Rule | Gap |
|---|---|---|
| Splunk ESCU | None | No UniFi-specific detections; need network-based rule for management port probing |
| Elastic | None | No coverage for UniFi appliance exploitation |
| Sigma | None | No UniFi rules; need CRLF injection pattern detection for HTTP header manipulation |
Sources: BleepingComputer · CyberScoop · Field Effect · NHS England Advisory
3. Next.js Windows Path Traversal RCE — CVE-2026-75604
TL;DR: CVSS 9.0 unauth RCE on Windows-hosted Next.js servers via path traversal (CWE-22). PoC on GitHub, 45M weekly downloads exposed, but only Windows deployments using Pages Router + App Router without Cache Components are affected. No exploitation reported yet.
What’s New:
- Patched August 25 in Next.js 15.5.24 and 16.3.3
- PoC published on GitHub — lowers exploitation barrier
- Separate AVIF vuln (GHSA-2xp9-vwfh-vxw4, CVSS 9.5) in upstream libheif also patched; AVIF optimization disabled until upstream fix
- Fastly deployed WAF virtual patch; available as templated rule
- Linux/macOS deployments NOT affected by CVE-2026-75604
Actionable Intel
| Artifact | Type | ATT&CK | Log Source | Action |
|---|---|---|---|---|
Path traversal sequences (..\\, ..%5c) in Next.js route requests | Exploit attempt | T1190 | WAF, web server access logs | Alert on directory traversal patterns targeting /_next/ paths on Windows |
| Crafted AVIF uploads to image optimization endpoint | Exploit attempt (GHSA-2xp9) | T1190 | Web server logs | Block AVIF uploads or upgrade to patched version with AVIF disabled |
node.exe spawning unexpected child processes post-exploitation | Post-exploitation | T1059 | Sysmon 1, EDR | Alert on Node.js process tree anomalies on Windows servers |
Detection
| Source | Rule | Gap |
|---|---|---|
| Splunk ESCU | None | No Next.js-specific rules; generic web server path traversal may partially detect |
| Elastic | ”Potential Path Traversal via HTTP Request” (generic) | May catch basic traversal patterns but not Next.js-specific route abuse |
| Sigma | web_cve_generic_path_traversal.yml | Generic; needs Next.js /_next/ path context for precision |
Sources: Next.js Security Release · The Hacker News · SecurityOnline · Fastly Virtual Patch
Status Updates
- CVE-2026-8452 (Citrix NetScaler): Federal deadline TOMORROW (Aug 29). Exploitation ongoing with web shells ITW. Yesterday’s brief.
- UAT-10147/SPECTRE: Five legacy CVEs added to CISA KEV (Aug 26) remain active; CVE-2019-1068 deadline Aug 29, others Sep 9. Yesterday’s brief.