Inferlume

The window is an exploitation surge against trusted control planes. Email gateways, remote support clients, firewall managers, and browser stacks are being used as first access, not as side stories.

[+] Cisco Secure Email Gateway CVE-2026-76461: Insufficient validation in AsyncOS email parsing allows an unauthenticated sender to place SQL statements in a crafted message. Consulted vendor guidance states that successful SQL execution can become operating system command execution as root. Physical and virtual appliances are in scope in any configuration. Cloud customers with detected malicious activity were contacted directly. Secure Email and Web Manager and Secure Web Appliance are not affected. On box logs can be destroyed after root, so the practical hunt is mail_logs plus off box firewall and netflow. Actor, payload, persistence, and victim count are unknown.

[+] ConnectWise ScreenConnect CVE-2026-84869: The failure is authorization inside an already active remote session, not a pre auth internet worm. An operator with the required session conditions may transfer and execute files without the expected host confirmation. Clients before 26.6.5 are affected. Patching only the central server does not clear installed clients. MSP, contractor, and unmanaged administrator workstations are the high value path. Actor unknown.

[+] Cisco Secure Firewall Management Center CVE-2026-20079 and CVE-2026-20316: CVE-2026-20079 is an unauthenticated authentication bypass and script execution path to root. CVE-2026-20316 enables remote login through a low privileged account and supports escalation when chained. Observed follow on activity includes a JSP web shell in the CSM Tomcat webroot, a JAR executor cmd.jar that queried internal authentication data, Netcat reverse shells, SOCKS and reverse SSH tunnels, configuration theft, a Cyclops Blink variant, AV killer use, and Qilin consistent ransomware staging. Firewall Device Manager, ASA, and Threat Defense are reported as not affected.

[+] Citrix NetScaler CVE-2026-19490: Authentication bypass through an alternate path against management or Gateway VIP. Consulted sources describe exploitation after public proof of concept material around 3 September 2026 and catalog listing on 9 September 2026. CVE-2026-19489 is related. Older NetScaler names such as ShinyHunters must not be copied onto this CVE without new evidence.

[+] Chrome and Windows chain: Spear phishing to a legitimate US university page with reflected XSS, then a filtered exploit page that proceeds only for Chrome on Windows. Stage one CVE-2026-85046 gives arbitrary read and write inside V8. Stage two CVE-2026-87491 escapes the V8 sandbox through WebAssembly. Stage three CVE-2026-85880 uses a Windows ALPC kernel issue to inject into the browser process. Consulted research found byte identical shellcode across two China nexus operators and URL parameters that look like an exploit development framework. UTA0560 delivered GRIMWEDGE, a short in memory JScript backdoor inside msiexec.exe that polls ocr.opusaccel[.]top. JungleBamboo delivered SUPERSTOMP then LONGTALE, a fake Gemini extension that steals cookies, sessions, history, keystrokes, and screenshots on a short timer.

[+] Google Pixel CVE-2026-58704: Logic error in the cellular modem permission check. Adjacent or proximal privilege escalation, no user interaction, no extra privileges required. Google describes limited targeted exploitation. This is not an internet wide enterprise remote code execution.

[+] WSO2 CVE-2026-5430: JWTs signed with an unsupported algorithm are accepted, producing authentication bypass and admin takeover on API Manager 4.1.0 to 4.6.0 and adjacent Control Plane, Traffic Manager, and Universal Gateway 4.5.0 to 4.6.0 branches. Honeypots captured forged admin tokens on 13 September 2026.

[+] Issabel CVE-2026-89026: A hardcoded HS256 key named pbxsigkey in pbxapi/index.php is shared across installations, allowing forged bearer tokens and unauthenticated remote code execution on exposed APIs. Exploitation reported from 9 September 2026.

[+] Vite CVE-2026-39364: Query string handling bypasses server.fs.deny and exposes files such as .env, cloud credential paths, Terraform state, and process environment. Consulted telemetry described hundreds of unique scanners and tens of thousands of August 2026 events.

[+] VMware vCenter CVE-2026-59310: Unauthenticated directory traversal in the syslog service leading to code execution. Catalogued 18 August 2026. A later ransomware campaign use claim is retained as under corroboration.

[+] Acronis CVE-2026-87886: Linux local privilege escalation in cPanel WHM and Plesk backup plugins. Vendor language is limited targeted, tied to one customer report.

[+] Admin Menu Editor Pro: Vendor site compromise on 14 September 2026 placed a web shell at includes/wp-user-consent.php, a hidden wp_ user, and object-cache residue in builds 2.35 and 2.36. Free edition and 2.34 are believed clean. Customer site counts in secondary reporting are telemetry, not a regulator figure.

[+] CenterPoint Energy: Company confirmed unauthorized third party access to personal information of a portion of customers through an external facing system. Actor alias 4d722e4d656f77 claimed about 7.49 million records including partial SSNs. Those counts and an unauthenticated API narrative are not in the company confirmation text. Service delivery was reported as not impacted.

[+] CHOSEN BRICK: Iranian linked Windows surveillance malware delivered after rapport building on messaging platforms. Capabilities include screen and microphone capture, messaging and email theft, Run key persistence, Defender exclusions, Telegram command and control, cloud storage exfiltration, and destruction functions. Targeting includes dissidents, activists, and journalists, including personal devices.

[+] Middle East ransomware trend reporting describes a sharp rise in recorded activity. Those figures are indicators, not a verified successful attack census, and are not technically linked to the Cisco or ScreenConnect CVEs.