Cyber Threat Brief — September 4 2026
⚠️ This report is AI-generated. Always validate findings.
1. Cisco Nexus 9000 Silicon One Unauth Root RCE — CVE-2026-20212
TL;DR: CVSS 9.8 unauth RCE on 10 Nexus 9000 switch models with Silicon One ASICs — TCP ports 43210/43211 are bound to the default L3 VRF and accept crafted input as root. No exploitation ITW yet; patch or iACL immediately.
What’s New:
- Cisco PSIRT disclosed September 2; found internally during TAC support case, not externally reported
- CWE-1327: ports 43210/43211 exposed in default Layer 3 VRF accept unauthenticated connections; crafted data executes as root
- Exploitation also crashes S1HAL process causing switch reload (DoS + RCE)
- Affected models include N9336C-SE1, N9K-C9804, N9K-C9808 and 7 others with Silicon One ASICs; ACI mode and Nexus 3000/7000 not affected
- No public PoC yet; no exploitation ITW per Cisco PSIRT as of September 3
Actionable Intel
| Artifact | Type | ATT&CK | Log Source | Action |
|---|---|---|---|---|
| TCP connections to ports 43210/43211 on Nexus 9000 management IPs | Exploit attempt | T1190 | NetFlow, firewall logs | Block TCP 43210/43211 inbound except from authorized management hosts |
| S1HAL process crash / unexpected switch reload | Exploitation indicator | T1499.004 | NX-OS syslog (%SYSMGR-2-SERVICE_CRASHED) | Alert on S1HAL crash events across Nexus 9000 fleet |
Run show module to check for affected Silicon One PIDs | Asset inventory | N/A | NX-OS CLI | Identify and prioritize patching for 10 affected PIDs |
| Unexpected root-level processes on Nexus 9000 | Post-exploitation | T1059 | NX-OS syslog, show processes | Hunt for anomalous processes running as root |
Detection
| Source | Rule | Gap |
|---|---|---|
| Splunk ESCU | None | No Nexus 9000/NX-OS content for port 43210/43211 exposure |
| Elastic | None | No NX-OS syslog parsing or S1HAL crash detection |
| Sigma | None | No NX-OS rules; need custom syslog rule for SYSMGR-2-SERVICE_CRASHED + S1HAL |
Sources: Cisco Advisory, The Hacker News, SecurityAffairs, xhack.io
2. Jenkins Deserialization RCE via config.xml — CVE-2026-84645
TL;DR: Deserialization bypass in Jenkins ≤2.579/LTS ≤2.568.2 allows authenticated users to achieve RCE by nesting PersistenceRoot-typed objects in config.xml submissions. No exploitation ITW; update to 2.580/LTS 2.568.3.
What’s New:
- Advisory September 2; part of 30+ CVE advisory batch
- JEP-200 deserialization filter bypassed: types marked as
PersistenceRoot(top-level config objects) can be injected as nested field values in user-submitted config.xml - Requires authentication but any user with job config permission can exploit
- Affects all Jenkins instances ≤2.579 and LTS ≤2.568.2
- 30+ additional CVEs in same advisory including stored XSS (CVE-2026-84677) and unencrypted token storage (CVE-2026-84676)
Actionable Intel
| Artifact | Type | ATT&CK | Log Source | Action |
|---|---|---|---|---|
config.xml submissions containing nested PersistenceRoot or top-level config type references | Exploit attempt | T1059.007 | Jenkins audit log | Monitor config.xml PUT/POST requests for anomalous nested type declarations |
| Unusual child processes spawned by Jenkins controller JVM | Post-exploitation | T1059 | EDR, process monitoring | Alert on non-Java child processes of Jenkins master PID |
| Jenkins version ≤2.579 or LTS ≤2.568.2 | Vulnerable asset | N/A | Asset inventory | Prioritize upgrade to 2.580/LTS 2.568.3 |
| Anomalous job creation or configuration changes by low-privilege users | Reconnaissance | T1087 | Jenkins audit log | Baseline normal config change patterns and alert on deviations |
Detection
| Source | Rule | Gap |
|---|---|---|
| Splunk ESCU | None | No Jenkins deserialization detection content |
| Elastic | None | No Jenkins-specific rules; generic Java deserialization rules may partial-match |
| Sigma | proc_creation_win_java_susp_child_process (partial) | Needs Jenkins-specific context; existing rule catches generic Java child process spawning |
Sources: Jenkins Advisory 2026-09-02, SecurityOnline, CyberSecurityNews, HKCERT
Status Updates:
- CVE-2026-83548/83549 (SonicWall SMA1000): Federal deadline TOMORROW September 5. Zero-day exploitation ongoing. No new IOCs since September 3 coverage. Original brief.
- CVE-2026-82329 (JFrog Artifactory): Federal deadline TOMORROW September 5. Exploitation ongoing — attackers minting admin tokens for enumeration. Original brief.
- CVE-2026-82078/81578 (PaperCut NG/MF): watchTowr actively working with PaperCut on patch bypass research; situation still evolving. Original brief.
- CVE-2026-0768 (Langflow): 360+ exploitation attempts ongoing from ~20 IPs; no new attacker infrastructure identified. Original brief.