Critical Vulnerabilities Patched: SonicWall, VMware, Metabase, and Cisco Flaws Addressed

Following the initial advisory, security researchers have observed widespread scanning activity targeting VMware vCenter Server instances for CVE-2026-59309, indicating imminent mass exploitation. More critically, CVE-2026-59310 is now confirmed to be actively exploited in the wild. Attackers are leveraging this flaw to write malicious cron jobs that establish persistent reverse SSH tunnels using the `reverse_ssh` tool, compromising over 360 unique IP addresses globally. Organizations must prioritize patching and hunt for compromise using the newly identified IOCs, including `reverse_ssh` file presence and outbound SSH traffic from vCenter.

The updated advisory from CISA, FBI, NSA, DC3, USSS, and KNPA provides critical new details on Gunra ransomware. It specifically identifies vulnerabilities in Fortinet FortiOS/FortiProxy and Schneider Electric PowerLogic (CVE-2024-5559) as initial access vectors. New TTPs include session hijacking via SSL-VPN manipulation, MFA bypass through VDI portal tampering, and lateral movement using PsExec/WMIC. The group also employs defense evasion by deleting logs and demands multi-million dollar ransoms. New hunting hints include specific URL patterns, process names, and log analysis for these advanced tactics.

New intelligence indicates that the critical SonicWall SMA 1000 series zero-day vulnerabilities, CVE-2026-15409 and CVE-2026-15410, are now being actively leveraged by ransomware groups. Previously, exploitation focused on stealthy persistence and credential theft for potential espionage. However, CISA's latest update highlights that these flaws are now a primary vector for initial access, allowing ransomware operators to bypass perimeter defenses and deploy their payloads. This escalation significantly increases the immediate threat level, making urgent patching and post-compromise hunting critical for all organizations using affected devices. The shift to ransomware groups underscores a more destructive and widespread impact than initially reported.

The critical Metabase SQL injection vulnerability, previously tracked as GHSA-vwf4-m7j8-wcjf, has now been officially assigned CVE-2026-72898, enhancing its visibility and tracking. Exploitation continues to be widespread, with LexisNexis publicly confirming an incident related to the flaw, adding to previously reported victims like Framework and Tally. For improved detection, a detailed Sigma rule has been provided to help organizations identify exploitation attempts by monitoring specific log patterns for POST requests to /api/session/reset_password followed by GET requests to /api/user/current.

Microsoft has released its August 2026 Patch Tuesday, fixing over 400 vulnerabilities across its products, with 42 rated critical. This comprehensive update includes the patch for CVE-2026-68820, the Windows privilege escalation zero-day actively exploited by the Lazarus Group. Other notable fixes include CVE-2026-62832 (Windows User Profile Service privilege escalation) and CVE-2026-62878 (potentially wormable RCE in Windows DNS Server). Organizations are strongly advised to apply these updates immediately to mitigate widespread risks.

The attack, attributed to Team PCP, utilized a sophisticated secondary exfiltration technique. If direct outbound connections were blocked, the malware would leverage the victim's own GitHub credentials to create a new public repository. Stolen secrets were then uploaded as release assets to this repository, making the exfiltrated data appear as legitimate activity and publicly exposing sensitive information. This method highlights the advanced nature of the threat and the critical need for auditing source control activity.