Cyber Threat Brief — September 12 2026
1. GitLab Unauth Path Traversal — CVE-2026-85706
TL;DR: Self-managed GitLab CE/EE CVE-2026-85706 (CVSS 10.0) lets an unauthenticated attacker read arbitrary server files via the repository commits API when ≥1 public project exists. watchTowr saw ITW probes from 06:00 UTC 2026-09-11; CISA KEV due 2026-09-14. Patch to 19.1.8 / 19.2.6 / 19.3.2.
What’s New:
- GitLab critical patch 2026-09-10; SecurityWeek / THN / watchTowr amplify 2026-09-11; CISA KEV added 2026-09-11
- Root cause: improper path confinement + missing auth on Workhorse-buffered
file.pathforPOST /api/v4/projects/{id}/repository/commits/ - High-value reads:
/var/opt/gitlab/gitlab-rails/etc/gitlab.yml,/etc/gitlab/gitlab-secrets.json, DB creds, CI secrets - Also ship CVE-2026-87719 (EE GraphQL Duo Chat deserialization, CVSS 9.9) in same builds — patch covers both
- Public PoCs on GitHub (e.g. mhtsec / solivaquaant) — mass exploitation expected imminently
Actionable Intel
| Artifact | Type | ATT&CK | Log Source | Action |
|---|---|---|---|---|
| GitLab CE/EE versions from 18.7 before 19.1.8, 19.2 before 19.2.6, 19.3 before 19.3.2 (CVE-2026-85706) | Vulnerable app | T1190 | CMDB / gitlab-rake gitlab:env:info | Upgrade self-managed to 19.1.8 / 19.2.6 / 19.3.2 before KEV due 2026-09-14; GitLab.com / Dedicated already patched |
HTTP POST URI containing /api/v4/projects/ + /repository/commits/ with parameter file.path (esp. values with ../ or absolute paths like /etc/passwd, /var/opt/gitlab/) | Exploit probe | T1190 | nginx/Workhorse / GitLab access log / WAF | Hunt + alert unauthenticated POSTs; isolate host; rotate secrets if any hit succeeded |
Target files /var/opt/gitlab/gitlab-rails/etc/gitlab.yml, /etc/gitlab/gitlab-secrets.json, database.yml | Secret exposure | T1552.001 | Host FS / IR | If exploit confirmed, rotate GitLab secrets, DB passwords, CI/CD tokens, runner tokens immediately |
Public project ID used as {id} in commits API (any real public project enables CVE-2026-85706) | Exposure gate | N/A | GitLab project visibility | Inventory internet-facing instances with public projects; restrict public exposure until patched |
Detection
| Source | Rule | Gap |
|---|---|---|
| Splunk ESCU | None — verified search | 0 CVE-2026-85706 / GitLab commits file.path detections |
| Elastic | None — verified search | 0 mapped GitLab repository-commits path-traversal rules |
| Sigma | None — verified search | Generic Path Traversal Exploitation Attempts looks for ../etc/ in cs-uri-query — misses multipart/Workhorse file.path POST body to /repository/commits/ |
Hunt hint: Search GitLab/nginx/Workhorse logs for POST to /api/v4/projects/*/repository/commits/ where request includes file.path (absolute path or ../). Correlate HTTP 400/500 oracle responses. Patch CVE-2026-85706 to 19.1.8/19.2.6/19.3.2.
Sources: GitLab 19.3.2 patch, watchTowr Rapid Reaction, The Hacker News, SecurityWeek, CISA KEV
2. JFrog Artifactory Token Chain — CVE-2026-42016 / CVE-2026-42018
TL;DR: Wiz: actors chain CVE-2026-42018 (unauth anonymous JWT via POST /access/api/v1/aws/token/) + CVE-2026-42016 (scope swap to admin via POST /access/api/v1/tokens) on self-hosted Artifactory (2026-08-15 → 2026-09-08), then plant admin accounts, Groovy plugins, and a Rust backdoor. CISA KEV added both 2026-09-11 (due 2026-09-25). Related solo bypass CVE-2026-82329 still ITW via POST /access/api/v1/registry/join.
What’s New:
- Wiz primary 2026-09-10/11; THN secondary 2026-09-11; CISA KEV for CVE-2026-42016/42018
- Escalated token keeps username
anonymous/ actortoken:anonymouswhile holding admin scope — under five minutes to new admin in some cases - Post-exploit: Groovy via
/api/plugins/execute/; dropper to/tmp/.z(SHA1513a907b69edffc3cb77a494da395178d21ef9bd); C264.207.232.6:8443; payload hostslog.gitclone.org:45678,3.88.162.79:36789 - Fake admin names:
Nxploited_*,labadmin_*,svc_*,0xterror,jfrog-distribution,jfrog-insight,repo-service - Patch: CVE-2026-42018 → 7.111.20 / 7.117.27 / 7.125.19 / 7.133.28 / 7.146.8; CVE-2026-42016 → ≥7.133.11; also ensure CVE-2026-82329 fixed builds (7.111.21 / 7.117.28 / 7.125.20 / 7.133.29 / 7.146.38 / 7.161.20)
Actionable Intel
| Artifact | Type | ATT&CK | Log Source | Action |
|---|---|---|---|---|
Unauth POST /access/api/v1/aws/token/ (trailing slash) → HTTP 200 anonymous JWT (CVE-2026-42018) | Auth bypass | T1190 | Artifactory access / reverse proxy | Alert; treat as exploit start; patch branch-matched fixed build before KEV due 2026-09-25 |
POST /access/api/v1/tokens minting admin-scope token while actor is token:anonymous (CVE-2026-42016) | Priv-esc | T1078 | Artifactory access audit | Alert anonymous→admin token mint; revoke all tokens minted since 2026-08-15; rotate join key |
Unauth POST /access/api/v1/registry/join → HTTP 200/201 admin token (CVE-2026-82329) | Auth bypass | T1190 | Artifactory access | Same IR; if unpatchable short-term apply JFrog extra join-key workaround in system.yaml |
Admin accounts jfrog-distribution, jfrog-insight, repo-service, 0xterror, or regex Nxploited_* / labadmin_* / svc_* | Persistence | T1136 | Artifactory user admin API | Delete unknown admins; assume compromise if pre-patch internet exposure |
File /tmp/.z SHA1 513a907b69edffc3cb77a494da395178d21ef9bd or egress to 64.207.232.6:8443 / log.gitclone.org:45678 / 3.88.162.79:36789 | Backdoor / C2 | T1105 / T1071 | Sysmon 11 / EDR / firewall | Quarantine host; block IOCs; hunt Groovy plugins + /api/plugins/execute/ |
Actor IPs 149.102.229.150, 186.247.79.240, 182.62.201.69 (42018/42016) and 146.19.216.120, 45.61.176.88, 185.190.58.172 (82329 sample) | Attacker infra | T1190 | Firewall / WAF | Block + historical Artifactory hits |
Detection
| Source | Rule | Gap |
|---|---|---|
| Splunk ESCU | None — verified search | 0 Artifactory /access/api/v1/aws/token / /registry/join / token:anonymous detections |
| Elastic | None — verified search | 0 JFrog Artifactory token-chain mappings |
| Sigma | None — verified search | 0 ET-2026 Artifactory CVE-2026-42016/42018/82329 rules |
Hunt hint: Alert POST /access/api/v1/aws/token/ 200 then POST /access/api/v1/tokens as token:anonymous; alert POST /access/api/v1/registry/join 200/201. Enumerate admins matching Wiz name patterns. Patch CVE-2026-42016/42018/82329; revoke tokens + rotate join key even after upgrade.
Sources: Wiz Artifactory Under Attack, The Hacker News, CISA KEV alert 2026-09-11
3. ScreenConnect Client Unauthorized File Exec — CVE-2026-84869
TL;DR: ConnectWise CVE-2026-84869 (CVSS 9.9): ScreenConnect client (not server) may allow file transfer + execution through an active Support/Access session without Host confirmation. CISA KEV added 2026-09-11, due 2026-09-14. Upgrade clients/agents to 26.6.5+; interim: remove TransferFiles from all roles.
What’s New:
- Vendor bulletin 2026-09-08; Computerworld / Armis amplify; CISA KEV 2026-09-11
- Cloud ScreenConnect servers already on 26.6.5 — still reinstall host clients and update access agents
- On-prem: upgrade path requires ScreenConnect ≥25.4 → 26.6.5; Automate-integrated via Product Updates
- No rich public exploit IOCs yet — detection leans on ScreenConnect Application Event 201 file-transfer + client child-process execution
Actionable Intel
| Artifact | Type | ATT&CK | Log Source | Action |
|---|---|---|---|---|
| ScreenConnect client/agent version prior to 26.6.5 (CVE-2026-84869) | Vulnerable client | T1219 | ScreenConnect Admin → Overview / endpoint inventory | Upgrade on-prem to 26.6.5; reinstall host clients + update access agents; cloud: verify Overview shows 26.6.5 then reinstall clients |
Role permission TransferFiles (aka TransferFilesInSession) enabled | Exposure gate | N/A | Administration → Security → Roles | Until patched, deselect TransferFiles on every role/session group (temporary only) |
ScreenConnect Application EventID 201 Data contains Transferred files with action | File transfer | T1105 | Windows Application log (Provider ScreenConnect) | Hunt transfers during Support/Access sessions; correlate to unexpected binaries on Host |
ParentImage ends with \ScreenConnect.ClientService.exe or \ScreenConnect.WindowsClient.exe or \ScreenConnect.WindowsFileManager.exe spawning cmd.exe/powershell.exe/msiexec.exe | Post-transfer exec | T1059 / T1219 | Sysmon 1 / EDR | Alert; isolate endpoint; review session audit for unauthorized TransferFiles under CVE-2026-84869 |
Detection
| Source | Rule | Gap |
|---|---|---|
| Splunk ESCU | None — verified search for CVE-2026-84869 | Existing ConnectWise ScreenConnect Authentication Bypass / Path Traversal map CVE-2024-1708/1709 (SetupWizard.aspx, App_Extensions) — wrong bug; will not catch unauthorized TransferFiles |
| Elastic | PARTIAL — Suspicious ScreenConnect Client Child Process | Catches ScreenConnect client parents spawning encoded PowerShell/cmd /c/net/schtasks. Misses TransferFiles-without-confirmation itself and version inventory for CVE-2026-84869 |
| Sigma | PARTIAL — Remote Access Tool - ScreenConnect File Transfer + ScreenConnect Remote Command Execution | EventID 201 transfer + ParentImage \ScreenConnect.ClientService.exe → cmd.exe under \TEMP\ScreenConnect\. Misses distinguishing unauthorized vs Host-approved transfers |
Hunt hint: Inventory ScreenConnect client/agent builds vs 26.6.5. Remove TransferFiles until patched. Hunt Application EventID 201 + Sysmon parent ScreenConnect.ClientService.exe/ScreenConnect.WindowsClient.exe → shell. Patch CVE-2026-84869 before KEV due 2026-09-14.
Sources: ConnectWise bulletin, CISA KEV alert 2026-09-11, Computerworld
Status Updates
- CVE-2026-20079 (Cisco FMC): KEV due TODAY 2026-09-12. Talos/THN: UAT-11988 used FMC LotL → SOCKS5/
socks5.py+ reverse-SSH (ports 389/636/88/445/135/5985) → Qilin; UAT-11823 Cyclops Blink; UAT-12197 JSP webshells. Apply Cisco hotfixes now. Sep 10 - CVE-2025-25249 (Fortinet PivotC2) / CVE-2026-19490 (Citrix): Same KEV due TODAY — complete FG-IR-25-084 / CTX696939 remediation + exposure triage. Sep 10
- MikroTrick CVE-2026-67277 / CVE-2026-86060: KEV due tomorrow 2026-09-13 — RouterOS 7.24.2 / 7.23.4 / 6.49.21; hunt SSH user
-2/ privilegedops. Sep 6 · Sep 11 - StyleSmuggler CVE-2026-75650 / N-central CVE-2026-86218: KEV due was 2026-09-11 — confirm VULN-39341 / HF4 2026.3.1.14 still applied; continue post-deadline hunts if any late patchers. Sep 8 · Sep 7
- PaperCut CVE-2026-81578/82078: KEV due 2026-09-14 — continue AI-campaign hunts (
45.142.193.132,pc-*.hiv,Administrator17). Sep 11 - BlueMoon / CVE-2026-85046 / CVE-2026-87491 / CVE-2026-85880 / CVE-2026-81963: Chrome ≥153 + Sep LCU; KEV dues Sep 18/23/22 unchanged. Sep 11 · Sep 9
- Check Point CVE-2026-85102/85103 / PoisonedRefresh / FalconFlank: No material change — keep prior hunts/patches. Sep 11 · Sep 9 · Sep 5