Cyber Threat Brief — September 19 2026
1. Orkes Conductor Unauth GraalVM RCE ITW — CVE-2026-58138
TL;DR: THN (2026-09-19) + SecurityWeek/Fortinet outbreak: CVE-2026-58138 (CVSS 9.8) in Orkes / conductor-oss Conductor 3.21.21 before 3.30.2 — unauthenticated attacker POSTs an inline workflow with malicious JavaScript/Python to the workflow API; unsandboxed GraalVM evaluators (HostAccess.ALL / allowAllAccess(true)) on INLINE / LAMBDA / DO_WHILE / SWITCH reflect to Runtime/ProcessBuilder and run OS commands as the Conductor process (often root in the default image). OSS API has no auth by default. Fortinet blocked 1,290 attempts in 24h (as of Sep 9) and 6,696 over seven days; Empirical ITW as recent as 2026-08-21. Fix: ≥ 3.30.2 (do not stop at 3.30.0/3.30.1 — partial blocklist). Not in KEV.
What’s New:
- Fortinet outbreak + THN/SW amplify this window; source geos DE/HK/ID/AE/IN; Previdian honeypots also saw attempts from FR/US since Jul 24
- Public exploit: Exploit-DB 52633 + Nuclei
CVE-2026-58138; Empirical notes no Tenable/Qualys plugin — a clean scan ≠ not exposed - Discovery gap: hunt UI title Conductor UI, default :8080,
/swagger-ui,conductoross/conductorimages — not the name “Conductor” in CMDB - Isolation lever until patched: auth in front of API; restrict
/api/metadata/workflowand/api/workflow
Actionable Intel
| Artifact | Type | ATT&CK | Log Source | Action |
|---|---|---|---|---|
Conductor / Orkes 3.21.21–3.30.1 (incl. conductoross/conductor images) — CVE-2026-58138 | Vulnerable workflow orchestrator | T1190 / T1059 | Container/K8s inventory / Helm / image SBOM / http.title:"Conductor UI" | Upgrade every instance to ≥ 3.30.2; 3.30.0/3.30.1 are incomplete; prioritize Internet-exposed :8080 |
Unauth POST /api/metadata/workflow then POST /api/workflow/{name} with INLINE/LAMBDA/DO_WHILE/SWITCH + evaluatorType javascript/graaljs/python | Exploit registration / start | T1190 / T1059.007 | Reverse proxy / API gateway / Conductor access logs | Alert unauth workflow create+start; isolate host; treat as RCE |
Workflow expression containing getClass / forName / Runtime / ProcessBuilder / array reflection | Hostile evaluator payload | T1059 / T1106 | Conductor workflow metadata store | Review all stored definitions; delete unknown workflows; rotate secrets the engine can reach |
Conductor JVM spawning sh -c / cmd.exe / unexpected child | Post-exploit command exec | T1059.004 / T1106 | EDR / container runtime / syscall audit on Conductor node | Hunt children of the Conductor PID; snapshot + rebuild if unexpected |
Detection
| Source | Rule | Gap |
|---|---|---|
| Splunk ESCU | None — verified search for CVE-2026-58138 / Orkes Conductor / GraalVM INLINE evaluator / /api/metadata/workflow | No Conductor workflow-API analytic; generic Java/Runtime.exec rules would not name this unauth POST path |
| Elastic | None — verified search for Conductor / CVE-2026-58138 / GraalVM HostAccess | No workflow-orchestrator script-escape rule |
| Sigma | None — verified search for CVE-2026-58138 / Conductor GraalVM | Nuclei template exists for scan/validation — not a SIEM emerging-threat rule |
Hunt hint: (1) Shodan/Censys/http.title:"Conductor UI" + internal :8080 + /swagger-ui + conductoross/conductor. (2) Proxy: unauth POST to /api/metadata/workflow or /api/workflow. (3) Workflow store: INLINE/LAMBDA expressions with reflection tokens. (4) EDR: Conductor → shell. (5) If exposed and unpatched: assume compromise; rebuild; rotate everything the workflows touch.
Sources: The Hacker News, SecurityWeek, FortiGuard TSR-6527, Empirical Sep 2026 CVE, NVD CVE-2026-58138, conductor-oss v3.30.2
2. CISA KEV — Three Linux Kernel LPEs Due Sep 21
TL;DR: CISA (2026-09-18, catalogVersion 2026.09.18) + THN (2026-09-19): three Linux kernel bugs added to KEV with evidence of active exploitation — CVE-2025-39682 (TLS rx_list zero-length record / UAF, CVSS 9.8), CVE-2026-53266 (ebtables SNAT ARP SHA rewrite OOB write, CVSS 8.8), CVE-2025-39964 (AF_ALG concurrent-write race, CVSS 7.8). Federal due 2026-09-21; forensic triage Yes. Red Hat advisories updated 2026-09-19 ~02:00 UTC (“known public exploits… address with high priority”). No public detail on the exploit chain or whether the three are used together. Patch vendor kernels; do not wait for a named campaign.
What’s New:
- KEV count 1716; these three are the only new additions vs prior 2026.09.16 window
- CVE-2025-39682 (
net/tls/tls_sw.c): local auth user → memory disclosure / DoS / LPE; fixed trains include 6.1.149 / 6.6.103 / 6.12.44 / 6.16.4 / 6.17 - CVE-2026-53266 (
ebt_snatARP): needs bridge + ebtables SNAT ARP rewrite; writes into splice-imported pages; fixed 5.10.259 / 5.15.210 / 6.1.176 / 6.6.143 / 6.12.94 / 6.18.36 / 7.0.13 / 7.1; workaround: remove--snat-arp - CVE-2025-39964 (
crypto/af_alg.c): concurrentsendmsgon same AF_ALG socket; fixed 5.10.245 / 5.15.194 / 6.1.154 / 6.6.108 / 6.12.49 / 6.16.9 / 6.17 - Adjacent researcher LPEs (DirtyAH6 / TUNderflow / PPPoEject / DiagSpill) are distinct — do not conflate with this KEV trio
Actionable Intel
| Artifact | Type | ATT&CK | Log Source | Action |
|---|---|---|---|---|
| Linux kernels below vendor fixed trains for CVE-2025-39682 / CVE-2026-53266 / CVE-2025-39964 | Vulnerable kernel | T1068 | uname -r / package facts / vuln mgmt | Patch to distro kernel that includes the stable commits; KEV due 2026-09-21; complete forensic triage Yes before closing |
Hosts with bridge + ebtables SNAT --snat-arp — CVE-2026-53266 path | Exploit precondition | T1068 / T1205 | ebtables-save / netfilter policy / config mgmt | If you cannot patch today, remove ARP SHA rewrite rules; then still patch |
Local AF_ALG socket concurrent writers / kTLS recvmsg crashes around disclosure | Possible exploit / crash primitive | T1068 | dmesg / journal / kdump / audit | Hunt oops/UAF traces in tls_sw_recvmsg / af_alg_sendmsg / ebt_snat; isolate + collect vmcore |
| CISA KEV catalogVersion 2026.09.18 dateAdded 2026-09-18 | Compliance SLA | N/A | KEV tracker / BOD 26-04 | Treat all three as one patch wave; RH “public exploits” language raises priority for Internet-adjacent and multi-tenant Linux |
Detection
| Source | Rule | Gap |
|---|---|---|
| Splunk ESCU | None — verified search for CVE-2025-39682 / CVE-2026-53266 / CVE-2025-39964 / tls_sw_recvmsg / ebt_snat / af_alg_sendmsg | Generic Linux kernel-exploit / LPE stories do not name these functions or KEV IDs |
| Elastic | None — verified search for the three CVEs / kTLS rx_list / ebtables SNAT ARP | No kernel-specific analytic for this trio |
| Sigma | None — verified search for CVE-2025-39682 / CVE-2026-53266 / CVE-2025-39964 | No emerging-threat rule; dmesg oops hunts are manual |
Hunt hint: (1) Inventory uname -r vs distro fixed versions above. (2) Find bridges with --snat-arp. (3) Review kernel logs since mid-Sep for tls/af_alg/ebt_snat oops. (4) Multi-tenant / container hosts: assume local-to-root is in play once an unpriv foothold exists. (5) Close KEV only after patch and forensic triage.
Sources: The Hacker News, CISA KEV, NVD CVE-2025-39682, CVE-2026-53266, CVE-2025-39964, STAR Labs 39682
3. SolarWinds ARM Hardcoded-Key Unauth RCE — CVE-2026-28326
TL;DR: SolarWinds advisory 2026-09-17: CVE-2026-28326 (CVSS 8.8, AV:A, CWE-321) — Access Rights Manager 2026.2 and all previous use a hardcoded static cryptographic key, enabling unauthenticated RCE for an attacker on the adjacent / same-segment network (no creds, no user interaction). Fix: ARM 2026.2.1. Reporter: Kai Huang (Armadin). No public ITW claim; not in KEV. Isolate ARM management hosts and patch.
What’s New:
- Vendor + NVD published this window; vector is adjacent-network, not arbitrary Internet — segmentation still matters, but do not treat “internal-only” as safe
- Same product family has a long RCE history; this bug is the static-key primitive, not the 2024 ZDI deserialization batch — do not close those older tickets as this CVE
- Compensating control while patching: follow SolarWinds secure ARM deployment (no extra-subnet exposure of the ARM console)
Actionable Intel
| Artifact | Type | ATT&CK | Log Source | Action |
|---|---|---|---|---|
| SolarWinds Access Rights Manager ≤ 2026.2 — CVE-2026-28326 | Vulnerable identity-governance server | T1190 / T1210 | CMDB / ARM about/version / vuln scanner | Upgrade to 2026.2.1; confirm build on every ARM collector/console |
| ARM console / services reachable beyond the admin VLAN (even if not Internet-facing) | Adjacent-network exploit path | T1190 | Firewall / microseg / attack-surface | Restrict ARM to named admin jump hosts; block extra-subnet clients until patched |
| Unauth sessions / unexpected process spawn on ARM host after 2026-09-17 | Possible exploit / post-exploit | T1059 / T1068 | ARM application logs / EDR on ARM server | Hunt new local accounts, child processes of ARM services, unexpected outbound from the ARM host |
Detection
| Source | Rule | Gap |
|---|---|---|
| Splunk ESCU | None — verified search for CVE-2026-28326 / SolarWinds ARM hardcoded key / Access Rights Manager RCE | Older SolarWinds Orion/Serv-U analytics are wrong product |
| Elastic | None — verified search for ARM / CVE-2026-28326 | No Access Rights Manager static-key rule |
| Sigma | None — verified search for CVE-2026-28326 / SolarWinds ARM | No emerging-threat rule for this advisory |
Hunt hint: (1) Inventory every ARM console/collector; force 2026.2.1. (2) Confirm no extra-subnet or VPN-wide reach to ARM ports. (3) Review ARM host EDR from 2026-09-17 for unauth access + unexpected children. (4) After patch, rotate any secrets ARM stored / used for AD provisioning.
Sources: SolarWinds CVE-2026-28326, ARM 2026.2.1 release notes, NVD CVE-2026-28326, CVE.org
Status Updates
- CVE-2026-76460 (Cisco ISE) / CVE-2026-87886 (Acronis Backup) / CVE-2026-58704 (Pixel): CISA KEV due TODAY 2026-09-19 (forensic triage Yes) — finish ISE patches +
dummyuserise-kong hunt; Acronis builds ≥1.9.3.1021 / ≥1.8.11.638; Pixel patch level 2026-09-05+. Sep 17 · Sep 16 - CVE-2026-85046 (Chrome V8 type confusion): KEV due was 2026-09-18 — confirm Chrome/Edge/Chromium ≥152.0.7977.82 (Win/Mac .82/.83; Linux .82); keep BlueMoon/GRIMWEDGE hunts (
cloud.shinewrist.net,ocr.opusaccel.top,206.166.251.164,%TEMP%\\msgbox.exe, task Windows Scheduled System). Original brief · Sep 11 · Sep 15 - CVE-2026-76461 (Cisco ESA): KEV due was 2026-09-17 — confirm AsyncOS fixed trains + forensic triage complete; keep
COPY.*TO PROGRAMmail_logs + Snort 67109/67110. Sep 15 - CVE-2026-42016/CVE-2026-42018 (JFrog Artifactory): KEV due 2026-09-25 — continue
POST /access/api/v1/aws/token/+token:anonymoushunts. Sep 12 - Windows CVE-2026-81963 + CVE-2026-85880: KEV due 2026-09-22 — keep ALPC/Update Stack LPE hunts from Sep 9 rewrite. Sep 9
- Chrome CVE-2026-87491: KEV due 2026-09-23 — Chromium ≥153.0.8010.36 class trains. Sep 10
- CVE-2026-27540 (WWLC) / CVE-2026-90894 (Parallels ParaShells) / CVE-2026-39987 (Marimo): No material change — keep prior hunts (
wwlc_file_upload_handler,prl_disp_service→tar --use-compress-program,/terminal/ws+GetSecretValue). Sep 16 - CVE-2026-51990 / GRAYRABBIT + Storm-3121 Passkey + SGLang CVE-2026-86793: No material change — keep prior hunts. Sep 14 · Sep 13
- CVE-2026-85706 (GitLab) / CVE-2026-84869 (ScreenConnect) / PaperCut CVE-2026-81578/CVE-2026-82078 / MikroTrick CVE-2026-67277/CVE-2026-86060: Post-KEV-deadline — confirm remediation. Sep 12 · Sep 14 · Sep 6 · Sep 13
- Check Point VPN CVE-2026-85102/CVE-2026-85103: Dutch NCSC still imminent — distinct from CVE-2026-91843 management LivePatch; keep VPN Jumbo/LivePatch trains. Sep 11 · Sep 18