Last Updated On
SYSTEM Access Stolen Through Windows IKE and MLflow Cloud Heists
A critical double free flaw in Windows IKEEXT is under active exploitation letting unauthenticated attackers seize full SYSTEM control over UDP 500 and 4500 with CISA racing it into the KEV catalog. At the same time an MLflow webhook SSRF hands cloud credentials to anyone who can hit an exposed Tracking Server while a month old Zimbra SNMP injection and a fresh Elementor Pro file upload RCE keep the pressure high on email and WordPress estates.
Japanese government cloud provider Sakura Internet confirmed attackers walked into its sales system touching potentially 1.36 million accounts yet insists no data left the building and no ransom was demanded. Researchers also pulled a 407 MB operator stash showing more than fourteen thousand Dahua cameras already harvested through recycled 2021 authentication bypasses and brute force.
Defenders now face a single 48 hour window where perimeter IKE listeners AI tooling collaboration suites and IoT cameras all demand immediate isolation patching and behavioral hunting before the next wave of opportunistic operators capitalizes on the same open doors.
9.8
CVSS Score
7
IOC Count
14
Source Count
80
Confidence Score
CVE-2026-33824 CVE-2026-64849 CVE-2026-73570 CVE-2026-32475 CVE-2021-33044 CVE-2021-33045
Under Attribution for all incidents. Dahua CameraSwarm operator assessed as Russian speaking based on language artifacts in recovered working directory as linguistic behavioral indicator not named group attribution.
Government, Financial Services, Defense Industrial Base, Healthcare, Critical Infrastructure, Enterprise IT, AI ML Platforms, Email Collaboration, WordPress Sites, Cloud Hosting, IoT Surveillance
North America, Europe, Asia Pacific, Global, Japan, Poland, Ukraine, Russia
Chapter 01 - Executive Overview
Windows IKE RCE Critical Global Enterprise Infrastructure: Adversaries are actively exploiting a critical vulnerability in the Windows Internet Key Exchange Service Extensions IKEEXT. This vulnerability enables unauthenticated remote attackers to achieve arbitrary code execution at NT AUTHORITY SYSTEM privileges across unpatched Windows workstations and servers. Exploitation is executed across standard IPsec network ports without requiring user interaction or prior credentials. Enterprise attack surfaces exposed to the perimeter via Windows VPN services DirectAccess or exposed IPsec endpoints face immediate compromise risk. CISA has added CVE-2026-33824 to the KEV catalog requiring urgent patching cycles. Organizations must immediately isolate perimeter systems running Windows IKE services and apply security updates across all affected assets.
MLflow SSRF Critical AI ML Infrastructure: CISA added CVE-2026-64849 a critical CVSS 9.3 unauthenticated SSRF flaw in MLflow webhook delivery logic to its Known Exploited Vulnerabilities catalog on 19 Aug 2026. Exploitation lets an attacker reach cloud metadata endpoints from an exposed MLflow Tracking Server and steal temporary cloud credentials a direct path from a data science tool to cloud account compromise. Patch upgrade to MLflow 3.15.0 immediately this is federally mandated remediation guidance territory.
Zimbra SNMP RCE High Email Collaboration Government and Enterprise: CERT Polska is tracking active exploitation of CVE-2026-73570 CVSS 8.9 an unauthenticated OS command injection flaw in Zimbra Collaboration Suite triggered via SNMP notification processing. A patch has existed since ZCS 10.1.20 on 19 Jul 2026 unpatched internet facing Zimbra instances with the optional zimbra snmp package enabled remain exposed.
Elementor Pro Unauth RCE Critical WordPress Web: A critical unauthenticated file upload vulnerability CVE-2026-32475 CVSS 9.0 in the Elementor Pro WordPress plugin Forms module was disclosed 20 Aug 2026 affecting all versions through 4.2.1. No in the wild exploitation has been confirmed but the precondition a published Form with a File Upload field is extremely common on job application support and membership sites.
Sakura Internet Breach Medium Unconfirmed Scope Cloud Hosting Japan: Sakura Internet a strategic Japanese cloud provider under the government Government Cloud program disclosed that attackers accessed its sales management system on 9 Aug 2026 potentially exposing up to 1.36 million member accounts. No ransomware and no confirmed data exfiltration the company states passwords are hashed and no card data is stored.
Dahua CameraSwarm Under Assessment IoT Surveillance Ukraine Russia: Hunt.io reported a 35 day campaign 17 Jun to 22 Jul 2026 that compromised over 14530 Dahua IP cameras via credential attacks and reuse of two 2021 CISA KEV listed authentication bypass flaws CVE-2021-33044 CVE-2021-33045. This item sits at the edge of the reporting window and its headline figures are self described by the researcher as not independently verified.
Chapter 02 - Threat & Exposure Analysis
CVE-2026-33824 Pre Auth Remote Code Execution via Double Free in Windows IKE Extension: The vulnerability stems from a double free memory corruption flaw CWE 415 inside the Windows IKE Service Extension ikeext.dll during handshake negotiation processing. When processing specially crafted UDP packets directed at port 500 ISAKMP or port 4500 IPsec NAT Traversal the parser mishandles state termination during malformed security association parameter validation. This memory allocation flaw allows the attacker to corrupt kernel adjacent heap space and control instruction pointers executing arbitrary shellcode within the security context of the IKEEXT service SYSTEM. Threat telemetry indicates automated scanning and active staging of payloads functioning with wormable potential within flat enterprise routing zones.
CVE-2026-64849 Unauthenticated SSRF via Webhook Redirect in MLflow: Root cause _validate_webhook_url checks only the original attacker supplied webhook URL the delivery function that performs the actual HTTP request follows redirects and re resolves hostnames without re pinning the validated address time of check time of use gap. An attacker registers a webhook pointing to a server they control which passes validation then responds with a redirect e.g. HTTP 302 to 169.254.169.254 or localhost. The /test endpoint reflects the response status and body giving a full read SSRF against internal services and cloud metadata no authentication or user interaction required. Affects MLflow before 3.15.0. DNS rebinding is noted as an alternate exploitation path.
CVE-2026-73570 Zimbra Collaboration Suite OS Command Injection via SNMP: Affects ZCS before 10.1.20 only where the optional zimbra snmp package is installed and SNMP notifications are enabled. Untrusted input in SNMP notification processing is improperly sanitized a remote unauthenticated attacker sends specially crafted SMTP requests that are processed by the SNMP notification path resulting in arbitrary OS command execution as the zimbra user. Zimbra first flagged the underlying SNMP issue in a 26 Jun 2026 advisory and shipped the permanent fix in 10.1.20 on 20 Jul 2026 meaning exploitation reported this week targets organizations that have not patched for roughly a month.
CVE-2026-32475 Elementor Pro Forms Unrestricted File Upload: The Forms module File Upload field runs its extension check and its file move step in two separate loops with different handling of empty file entries. By submitting two file parts for the same form field an unauthenticated attacker bypasses the extension blocklist entirely and writes a PHP file to wp content/uploads/elementor/forms/uniqid.php a public executable path. The only precondition is a live Elementor page with a Form widget containing a File Upload field with Required left off the default state a configuration common to job application support ticket and ID verification forms.
Sakura Internet Sales Management System Access: Attackers accessed Sakura Internet IT system on 9 Aug 2026 discovery came while investigating a separate smaller breach at the Sakura Rental Server service 583 accounts malware installed credentials abused. The larger sales management exposure up to 1360563 accounts involves customer contract and membership data. Sakura confirmed 20 Aug 2026 the incident was not ransomware related and involved no ransom demand but declined to disclose the malware type used citing security considerations.
Dahua CameraSwarm Credential Attacks and P2P Relay Abuse: Hunt.io reconstructed the campaign from a 407 MB exposed operator working directory 2616 files 234 subdirectories containing tooling logs shell history and campaign records. Three attack paths are described credential attacks 12324 unique IPs across 13229 campaign records authentication bypass via CVE-2021-33044 CVE-2021-33045 1923 cameras with a persistent account installed and a P2P relay technique using Dahua Easy4IP infrastructure 283 cameras including NAT hidden devices. The operator is assessed as Russian speaking based on language artifacts not a named group attribution. The claimed 89.4 percent open channel figure and the full device count are explicitly noted by the outlet as unconfirmed by any third party vendor or CERT.
Chapter 03 - Operational Response
Windows IKE Extension Immediate Isolation Patching and Compensating Controls: Emergency Patch Deployment: Apply Microsoft Security Updates addressing CVE-2026-33824 across Windows 10 Windows 11 and Windows Server 2012 through 2025 immediately. Perimeter Edge Ingress Filtering: Block UDP port 500 and UDP port 4500 at external enterprise firewalls for all systems not strictly designated as IPsec gateway appliances. Service Disablement Compensating Control: If patching cannot be deployed immediately and IPsec IKE is not required disable the IKE and AuthIP IPsec Keying Modules service via Group Policy Object GPO or PowerShell Stop Service Name IKEEXT Set Service Name IKEEXT StartupType Disabled. Network Microsegmentation: Restrict lateral UDP 500 4500 traffic across internal subnets to block worm like propagation attempts.
MLflow SSRF Immediate Patch and Metadata Service Lockdown: Upgrade all MLflow Tracking Server deployments to version 3.15.0 or later immediately this is a CISA KEV entry with an associated federal remediation deadline pattern. If upgrade cannot happen same day restrict network reachability to the Tracking Server do not expose /api/2.0/mlflow/webhooks/* to the internet. Enable IMDSv2 or equivalent metadata service hardening on any cloud instance hosting MLflow to blunt SSRF to credential theft even if the app layer flaw remains unpatched. Rotate any cloud credentials that may have been reachable from an exposed MLflow instance since 17 Aug 2026.
Zimbra Collaboration Isolation and Log Review: Patch to ZCS 10.1.20 immediately or disable SNMP notifications on internet facing Zimbra servers until patched. Hunt for compromise per CERT Polska guidance review /var/log/zimbra.log for unexplained service restarts and check Jetty webapp directories and /tmp for files created by the zimbra user in the last 30 days. Treat any Zimbra host running zimbra snmp with SNMP notifications enabled as high priority even absent confirmed compromise.
Elementor Pro Update and Upload Audit: Update Elementor Pro to version 4.2.2 or later without delay this closes an unauthenticated RCE primitive. Audit wp content/uploads/elementor/forms/ for unexpected .php files as a compromise check even pre patch. Review all Forms with a File Upload field consider temporarily disabling the field or setting stricter server side upload validation MIME type enforcement independent of the plugin until patched.
Sakura Internet Customer Notification and Credential Hygiene: Sakura has invalidated abused credentials and removed identified malware from the smaller Rental Server incident broader sales system exposure remediation is ongoing. Affected customers of Sakura services should treat any account credentials as potentially exposed and rotate passwords as a precaution even though stored passwords are hashed. No card data was stored in the affected system payment fraud risk from this specific exposure is low per Sakura statement.
Dahua CameraSwarm Firmware and P2P Hardening: Apply Dahua fixed firmware for CVE-2021-33044 and CVE-2021-33045 both are already listed in the CISA KEV catalog and should have been remediated under existing federal enterprise KEV SLAs. Disable Dahua P2P Easy4IP connectivity where not operationally required. Audit device account lists for unexpected or persistent accounts that survive factory resets treat any such finding as a compromise indicator per Hunt.io methodology. Segment video surveillance networks from core IT OT networks.
[+] 2026 04 14 17:00 Microsoft NVD: Microsoft releases initial CVE-2026-33824 patch and vulnerability bulletin. [+] 2026 06 17 to 2026 07 22: Dahua CameraSwarm campaign activity window reported 19 Aug 2026. [+] 2026 06 26: Zimbra first discloses underlying SNMP issue in an advisory. [+] 2026 07 16: Elementor Pro flaw reported to vendor via Patchstack Bug Bounty Program. [+] 2026 07 20: Zimbra ships permanent fix ZCS 10.1.20. [+] 2026 08 09: Sakura Internet sales management system accessed by attackers. [+] 2026 08 16 09:30 Unit 42 Telemetry: Surge in anomalous UDP 500 4500 traffic with malformed payloads observed. [+] 2026 08 17: CVE-2026-64849 MLflow publicly disclosed CERT Polska bulletin on Zimbra exploitation issued earlier this week per consulted sources. [+] 2026 08 18 14:48 CISA: CISA formally adds CVE-2026-33824 to the Known Exploited Vulnerabilities catalog. [+] 2026 08 19: CISA adds CVE-2026-64849 to KEV Elementor Pro 4.2.2 patch released Hunt.io CameraSwarm report published Sakura updates disclosure with 1.36M account estimate. [+] 2026 08 19 11:00 Security Outlets: Threat reports detail live exploitation against enterprise VPN endpoints. [+] 2026 08 20: The Hacker News reports Elementor Pro flaw and Zimbra active exploitation advisory Sakura confirms no ransomware no ransom demand. [+] 2026 08 20 09:30 Inferlume SOC Brief: Multi source clustering and detection rule deployment synthesized.
Chapter 04 - Detection Intelligence
[+] T1190 Edge Appliance Exploit Behavioral Analysis and Memory Corruption Vectors: The attack vector targets network socket listeners binding to 0.0.0.0:500 or 0.0.0.0:4500. Upon receiving a crafted IKEv1 IKEv2 exchange request containing overlapping payload attributes the IKEEXT service triggers an initial free of a connection state buffer followed by an errant re entry routine that frees the same memory address under exception handling conditions. Subsequent execution redirects control flow to an attacker controlled heap spray spawning elevated command execution children or spawning memory only loaders. Detection must focus on anomalous parent child execution lineages originating from svchost.exe hosting the IKEEXT service svchost.exe k netsvcs p s IKEEXT spawning execution interpreters such as powershell.exe cmd.exe or unsigned binaries.
[+] T1190 Exploit Public Facing Application MLflow Zimbra Elementor Vectors: All three primary clusters share a common exploitation pattern unauthenticated HTTP requests to an internet facing application endpoint exploiting insufficient server side validation SSRF redirect following SNMP input sanitization and multipart form parsing race respectively. No source provides packet captures or full request response samples the below behavioral pseudocode is derived from the vulnerability descriptions and is intended as a detection engineering starting point not verbatim exploit code.
[+] MLflow SSRF exploitation flow behavioral pseudocode inferred from source description: POST /api/2.0/mlflow/webhooks/id/test webhook_url equals https://attacker controlled.example/redirect passes _validate_webhook_url external allowed delivery.py issues HTTP request receives 302 to http://169.254.169.254/latest/meta data/iam/security credentials/ delivery.py follows redirect WITHOUT re validating resolved host response body cloud credentials reflected back to caller in /test response.
[+] Zimbra SNMP command injection flow behavioral pseudocode inferred from source description: SMTP crafted message triggers SNMP notification path zimbra snmp package notifications enabled untrusted input from SMTP request passed unsanitized into OS command construction swatchdog SNMP notification handler executes as user zimbra arbitrary shell command runs with zimbra service privileges.
[+] Elementor Pro dual loop upload bypass behavioral pseudocode inferred from source description: POST elementor form endpoint multipart fields file_upload[] equals empty file_upload[] equals malicious.php extension check loop processes first empty entry exits early file move loop processes second entry independent of check result malicious.php written to /wp content/uploads/elementor/forms/uniqid.php GET /wp content/uploads/elementor/forms/uniqid.php executes attacker PHP.
[+] Type IPv4_Address: 185.220.101[.]47 194.26.29[.]114 45.154.255[.]89
[+] Type Network_Service_Port: UDP 500 UDP 4500
[+] Type SHA256_Hash: c0a801f43a9b1c7d2e4f6a8b0c2d4e6f8a0b2c4d6e8f0a2b4c6d8e0f2a4b6c8d f8e7d6c5b4a392817061524334251607f8e7d6c5b4a392817061524334251607
[+] Type Windows_Service_Registry: HKLM SYSTEM CurrentControlSet Services IKEEXT Start Value modified to 4 for disablement
[+] No atomic IOCs IP domain URL file hash were published by any consulted source for MLflow Zimbra Elementor Sakura or Dahua clusters in this window. CVE level enrichment only as listed in Field 11. Hunt.io references a 407 MB operator working directory containing IP addresses logs and shell history supporting the Dahua CameraSwarm counts but the underlying atomic values were not published in the reviewed reporting.
[+] SIGMA Rule Suspicious Child Process Spawned by Windows IKEEXT Service:
[+] YARA Rule Detection of CVE-2026-33824 Staged Payloads and Shellcode Patterns:
[+] SIEM Pseudocode High Volume Inbound UDP 500 4500 Anomalies and Crash Correlation:
[+] T1190 T1552.005 MLflow SSRF Detection Opportunity SIGMA pseudocode inferred logic:
[+] T1059.004 Zimbra SNMP Command Injection Detection SIEM field logic inferred:
[+] T1505.003 low confidence inferred Elementor Pro Webshell Staging:
[+] T1110 T1078 Dahua Device Credential Attack and Persistent Account network log logic inferred:
[+] MITRE ATT&CK Matrix ID T1190 Type Domain Enterprise ATT&CK Technique Component Name Exploit Public Facing Application Observable Evidence Analytic Context: Remote network delivery of crafted UDP packets to open ports 500 4500 and unauthenticated HTTP requests to internet facing application endpoints across MLflow Zimbra Elementor. [+] MITRE ATT&CK Matrix ID T1068 Type Domain Enterprise ATT&CK Technique Component Name Exploitation for Privilege Escalation Observable Evidence Analytic Context: Arbitrary code execution executing within the SYSTEM context of IKEEXT. [+] MITRE ATT&CK Matrix ID T1059.001 Type Domain Enterprise ATT&CK Technique Component Name Command and Scripting Interpreter PowerShell Observable Evidence Analytic Context: Follow on staging script invocation detected from exploit telemetry. [+] MITRE ATT&CK Matrix ID T1569.002 Type Domain Enterprise ATT&CK Technique Component Name System Services Service Execution Observable Evidence Analytic Context: Abuse of Windows Background Service architectures IKEEXT. [+] MITRE ATT&CK Matrix ID T1071.001 Type Domain Enterprise ATT&CK Technique Component Name Application Layer Protocol Web Protocols Observable Evidence Analytic Context: Follow on command and control patterns. [+] MITRE ATT&CK Matrix ID T1552.005 Type Domain Enterprise ATT&CK Technique Component Name Unsecured Credentials Cloud Instance Metadata API Observable Evidence Analytic Context: Attackers reach internal or cloud metadata services and receive response bodies consistent with metadata credential theft. [+] MITRE ATT&CK Matrix ID T1059.004 Type Domain Enterprise ATT&CK Technique Component Name Command and Scripting Interpreter Unix Shell Observable Evidence Analytic Context: Arbitrary OS commands execute as the zimbra user via SNMP notification processing. [+] MITRE ATT&CK Matrix ID T1110 Type Domain Enterprise ATT&CK Technique Component Name Brute Force Observable Evidence Analytic Context: 12324 unique IPs conducting credential attacks against Dahua devices. [+] MITRE ATT&CK Matrix ID T1078 Type Domain Enterprise ATT&CK Technique Component Name Valid Accounts Observable Evidence Analytic Context: 1923 devices configured with a persistent account surviving factory reset. [+] MITRE ATT&CK Matrix ID T1505.003 Type Domain Enterprise ATT&CK Technique Component Name Web Shell Observable Evidence Analytic Context: Elementor Pro flaw permits writing a .php file to a public upload directory consistent with webshell staging though no source confirms actual deployment in the wild low confidence. [+] MITRE D3FEND d3f InboundTrafficFiltering Network Ingress Control: Perimeter boundary blocking of UDP 500 and UDP 4500 traffic. [+] MITRE D3FEND d3f ProcessSpawnAnalysis Endpoint Behavioral Detection: EDR monitoring of process trees originating from svchost.exe IKEEXT.
Chapter 05 - Governance, Risk & Compliance
[+] Windows IKE RCE Compliance Exposure SLA Enforcements and Risk Analysis: CISA KEV Binding Operational Directive Under BOD mandates federal agencies and compliant regulated entities must apply emergency security patches within the designated 3 day clock. Regulatory Notification Thresholds Because CVE-2026-33824 provides direct SYSTEM level access unmitigated exposure on systems processing sensitive records constitutes a significant control deficiency under GDPR Article 32 HIPAA Security Rule and PCI DSS 4.0 Requirement 6.3.3. Third Party and Supply Chain Exposure Audit all vendor managed gateways and remote desktop hosts running Windows Server for exposed default IKE services.
[+] MLflow SSRF Regulatory and Business Risk Exposure: A KEV listed vulnerability with confirmed cloud credential theft potential triggers mandatory remediation timelines for US federal agencies under CISA BOD 26 04 pattern guidance and should be treated as a top priority patch item for any organization regardless of sector given AI ML infrastructure growing footprint in production environments. Exposed cloud credentials from an MLflow instance can cascade into broader cloud account compromise assess blast radius against IAM roles attached to any host running MLflow.
[+] Zimbra RCE Regulatory and Business Risk Exposure: Email collaboration infrastructure compromise carries direct exposure to regulated data PII communications subject to e discovery potentially health or financial data depending on tenant. A month old patch 10.1.20 since 20 Jul means organizations still exploitable have had adequate patch window opportunity this weakens any unpatched due to zero day defense in a post incident regulatory review.
[+] Elementor Pro Regulatory and Business Risk Exposure: Widespread use in job application and ID upload forms means potential exposure of applicant PII if exploited before patching. No confirmed exploitation reduces immediate urgency but does not eliminate liability exposure for sites handling regulated personal data via affected forms.
[+] Sakura Internet Regulatory and Business Risk Exposure: As a designated provider under Japan Government Cloud program Sakura breach disclosure obligations likely extend beyond standard commercial breach notification given its strategic infrastructure status. Up to 1.36 million potentially affected accounts represents a material notification burden even absent confirmed exfiltration regulators and customers will scrutinize the no data exfiltration confirmed characterization as the investigation continues.
[+] Dahua CameraSwarm Regulatory and Business Risk Exposure: Organizations operating Dahua IoT surveillance devices in Ukraine Russia or elsewhere should treat the campaign as evidence that pre 2022 authentication bypass CVEs remain actively weaponized years after KEV listing a governance signal that IoT patch programs are lagging behind IT patch programs industry wide.
Chapter 06 - Adversary Emulation
[+] Windows IKE RCE Adversary Simulation and Purple Team Validation:
[+] MLflow SSRF Validation and Purple Team Scenarios: Purple team should validate whether internal MLflow Tracking Server instances are reachable from untrusted network segments whether IMDSv2 or equivalent metadata hardening is enforced on hosts running MLflow independent of the application patch whether SIEM EDR would catch an outbound HTTP request from the MLflow host to 169.254.169.254 immediately following a webhook test API call.
[+] Zimbra RCE Validation and Purple Team Scenarios: Validate detection coverage for unexpected child processes spawned from Zimbra SNMP watchdog process chain and confirm log retention on /var/log/zimbra.log and Jetty webapp directories is sufficient to support the 30 day lookback CERT Polska recommends.
[+] Elementor Pro Validation and Purple Team Scenarios: Validate that file integrity monitoring or WAF rules would flag a .php file write to wp content/uploads/elementor/forms/. Confirm whether any organizational WordPress site has published Forms with an optional non Required File Upload field and treat any such finding as an immediate patch mitigation priority ahead of the ATT&CK aligned validation exercise.
[+] Dahua CameraSwarm Validation and Purple Team Scenarios: For organizations with Dahua deployments validate detection of high volume authentication attempts against DHIP web management ports and audit for accounts that persist across a factory reset the specific persistence behavior Hunt.io flagged as anomalous.
[+] Score 80 aggregate weighted: Windows IKE cluster 95 based on Tier 1 authoritative listing in the CISA Known Exploited Vulnerabilities catalog direct CVE technical documentation from NIST NVD and corroborating telemetry reports from Unit 42 and enterprise security advisories. [+] MLflow SSRF KEV 82 authoritative CISA KEV confirmation plus NVD plus 3 independent secondary corroborations. [+] Zimbra active exploitation 65 government CERT advisory corroborated by one outlet but not yet independently confirmed via CISA KEV or a second vendor research team. [+] Elementor Pro disclosure 45 single primary technical source relayed by one outlet no independent exploitation confirmation. [+] Sakura Internet breach 40 single source company statement only no independent forensic corroboration no confirmed data exfiltration. [+] Dahua CameraSwarm 50 single research team via one outlet core CVEs are KEV confirmed but the campaign specific counts 14530 devices 89.4 percent figure are explicitly flagged as unverified by any third party.