Cyber Threat Brief — September 3 2026

1. SonicWall SMA1000 Zero-Day SSRF+RCE Chain — CVE-2026-83548 / CVE-2026-83549

TL;DR: Pre-auth SSRF (CVSS 10.0) chains with authenticated OS command injection to give unauthenticated RCE on SMA1000 edge appliances. Actively exploited zero-day; CISA KEV deadline September 5.

What’s New:

• CVE-2026-83548: pre-auth SSRF in Work Place interface allows access to internal AMC functionality via alternate access path
• CVE-2026-83549: OS command injection in Appliance Management Console (AMC) — chained via SSRF to bypass auth requirement
• Affected models: SMA1000 6210, 7210, 8200v on versions ≤12.4.3-03453 and ≤12.5.0-02835
• SonicWall confirmed active exploitation before public disclosure; no vendor IOCs released
• MFA seeds stolen in prior July compromise may outlast September patches (TechTimes reporting)

Actionable Intel

Artifact	Type	ATT&CK	Log Source	Action
Unauthenticated requests to Work Place /cgi-bin/ or internal SSRF relay paths	Exploit attempt	T1190	SMA1000 access logs, WAF	Alert on unauthenticated POST to AMC endpoints via Work Place interface
Outbound connections from SMA1000 to cloud metadata endpoints (169.254.169.254)	SSRF exploitation	T1557	Network flow	Block/alert on SMA appliance connecting to link-local metadata IPs
New admin sessions or config changes not correlated to admin activity	Post-exploitation	T1078	SMA1000 audit logs	Hunt for admin session creation outside change windows
Unexpected outbound connections from SMA1000 appliance	C2/exfil	T1071	Network flow, firewall logs	Alert on SMA appliance egress to non-baseline destinations

Detection

Source	Rule	Gap
Splunk ESCU	None	No SonicWall SMA1000 content; need custom SPL for access log anomalies
Elastic	None	No dedicated SMA1000 rules
Sigma	None	No SMA1000-specific rules; generic web exploit rules may partial-match

Sources: Rapid7 ETR, Sophos Blog, CISA KEV, BleepingComputer

2. Sangoma Switchvox Unauth SQLi-to-RCE — CVE-2026-9586

TL;DR: Unauthenticated SQL injection in Switchvox VoIP runs as PostgreSQL superuser — attackers dropping reverse shells since August 30. CISA KEV added September 2; patch to 8.4.0.2.

What’s New:

• Untrusted PhoneIP XML value injected directly into PostgreSQL query executed with superuser privileges
• Horizon3 + SRA Labs independent discovery; patched in version 8.4.0.2 (July 14)
• Honeypot exploitation started August 30 from single IP; reverse shells deployed, process enumeration observed
• CISA KEV added September 2 with September 5 federal deadline

Actionable Intel

Artifact	Type	ATT&CK	Log Source	Action
176.65.148.184	Attacker IP	T1190	Firewall, IDS/IPS	Block and hunt in historical logs
HTTP POST with crafted XML PhoneIP to unauthenticated endpoint	Exploit attempt	T1190	WAF, Switchvox access logs	Alert on POST requests with SQL metacharacters in XML body
/var/log/switchvox/db-quirks.log anomalous entries	SQLi evidence	T1190	Switchvox logs (syslog forward)	Hunt for unexpected SQL statements in db-quirks.log
Outbound connections from Switchvox on port 39323	Reverse shell	T1059.004	Network flow	Alert on non-baseline egress from VoIP servers
PostgreSQL spawning shell processes	Post-exploitation	T1059	EDR, Sysmon	Hunt for postgres → sh/bash process chains

Detection

Source	Rule	Gap
Splunk ESCU	None	No Switchvox-specific content; “Linux Reverse Shell” analytic covers post-exploitation
Elastic	None	No Switchvox rules
Sigma	proc_creation_lnx_reverse_shell_indicators	Partial post-exploit coverage; no SQLi detection for Switchvox

Sources: Horizon3 Disclosure, Help Net Security, BleepingComputer, TheHackerNews

3. Elementor Pro Unauth File Upload to RCE — CVE-2026-32475

TL;DR: Empty-filename bypass in Elementor Pro Forms lets unauthenticated attackers upload PHP webshells to WordPress. 190K+ exploit attempts blocked; 5 public PoCs weaponized. Patch to 4.2.2.

What’s New:

• File Upload module validates extensions and moves files in separate loops with different empty-filename handling
• Two-part multipart upload: empty filename passes validation, malicious .php payload lands in public uploads directory
• Affects Elementor Pro ≤4.2.1; fixed in 4.2.2 (August 19)
• Wordfence blocked 190K+ attempts; active mass exploitation confirmed
• 5 public GitHub PoC repos, 2 marked weaponized

Actionable Intel

Artifact	Type	ATT&CK	Log Source	Action
Multipart POST to /wp-json/elementor-pro/v1/ form endpoints with empty filename=""	Exploit attempt	T1190	WAF, WordPress access logs	Alert on multipart uploads to Elementor form endpoints
.php files created in wp-content/uploads/elementor/forms/	Webshell drop	T1505.003	File integrity monitoring, EDR	Alert on new PHP files in Elementor upload directories
PHP execution from wp-content/uploads/	Webshell execution	T1059.004	EDR, web server logs	Block PHP execution in WordPress upload directories

Detection

Source	Rule	Gap
Splunk ESCU	Web Shell Creation Via PHP (generic)	Covers webshell indicators; no Elementor-specific multipart bypass detection
Elastic	Webshell Detection: Script Process Child of Common Web Processes	Generic webshell; no upload-bypass detection
Sigma	webshell_detection_web_shell_keyword	Generic; need rule for PHP file creation in WordPress upload paths

Sources: TheHackerNews, BleepingComputer, SecurityOnline

4. Kestra OSS Auth Bypass to Root RCE — CVE-2026-49869

TL;DR: Suffix-match auth filter bypass (CVSS 10.0) lets unauthenticated attackers create and execute arbitrary workflows as root in Kestra worker containers. CISA KEV September 2.

What’s New:

• AuthenticationFilter checks request.getPath().endsWith("/configs") — any API path ending in configs bypasses Basic Auth
• Script execution plugins (plugin-script-shell, plugin-script-python) enabled by default = direct RCE as root
• Attacker creates flow at e.g. /api/v1/namespaces/evil/flows/configs to bypass auth, then executes arbitrary commands
• Fixed in versions 1.0.45 and 1.3.21
• CISA KEV added September 2 with September 5 deadline

Actionable Intel

Artifact	Type	ATT&CK	Log Source	Action
API requests to paths matching /api/v1/.*/configs that aren’t /api/v1/configs	Auth bypass	T1190	WAF, Kestra access logs	Alert on API requests to non-canonical /configs paths
New flow creation via unauthenticated API calls	Workflow injection	T1059	Kestra audit logs	Alert on flow creation without valid auth headers
Container processes spawned by Kestra worker executing shell/Python scripts	RCE	T1059.004	Container runtime logs, EDR	Hunt for unexpected script execution in Kestra worker containers

Detection

Source	Rule	Gap
Splunk ESCU	None	No Kestra content
Elastic	None	No Kestra content
Sigma	None	No Kestra-specific rules; generic container escape rules may partial-match

Sources: CISA KEV, TheHackerNews, Kestra Advisory

5. Proxmox VE 7.x Auth Bypass — CVE-2023-54391

TL;DR: Arbitrary tfa-challenge value bypasses password verification on Proxmox VE 7.0–8.0 (EOL). PoC public, exploited in the wild. Restrict TCP 8006 immediately.

What’s New:

• libpve-access-control < 8.0.4 accepts any tfa-challenge value for accounts without 2FA configured, bypassing password check entirely
• Attacker POST to /api2/json/access/ticket with arbitrary tfa-challenge = instant root@pam access
• Proxmox advisory PSA-2026-00043-1 published September 1; all affected versions are EOL
• Public PoC available; multiple independent reports confirm active exploitation
• Users with any second factor configured are NOT affected

Actionable Intel

Artifact	Type	ATT&CK	Log Source	Action
POST to /api2/json/access/ticket with tfa-challenge parameter from non-admin IPs	Auth bypass	T1078	Proxmox API logs, WAF	Alert on login attempts with tfa-challenge from unexpected sources
TCP 8006 exposed to internet	Attack surface	T1190	External scan, firewall rules	Block external access to Proxmox management port
New user sessions as root@pam without corresponding SSH/console login	Unauthorized access	T1078.001	Proxmox auth logs	Hunt for root sessions not correlated to admin activity

Detection

Source	Rule	Gap
Splunk ESCU	None	No Proxmox content
Elastic	None	No Proxmox content
Sigma	None	No Proxmox-specific rules; need custom rule for tfa-challenge abuse

Sources: Proxmox Advisory PSA-2026-00043-1, SecurityOnline, CloudNews

---

Status Updates

• CVE-2026-82329 (JFrog Artifactory): CISA KEV added September 2 with September 5 deadline; exploitation ongoing per CISA confirmation. Original brief.
• CVE-2026-82078/81578 (PaperCut NG/MF): watchTowr actively working with PaperCut on patch bypasses; situation evolving. Original brief.