Inferlume

How it Works
Pricing
About
Get Free Access →

Get Free Access

Last Updated On

CCTTII--22002266--00772222
IInnffoorrmmaattiioonnaall
AAccttiivvee  EExxppllooiittaattiioonn  CCoonnffiirrmmeedd

Three Unauthenticated RCEs and a Windows LPE Defenders Cannot Ignore

Unauthenticated path to your network just got three wide open doors. SharePoint CVE-2026-50522, GlobalProtect CVE-2026-0257, and WordPress wp2shell are under active attack, with CISA KEV backing on the VPN and CMS chains and machine key theft keeping SharePoint access alive after weak patching.

Meanwhile LegacyHive still elevates standard users on fully July patched Windows, Zimbra 10.1.20 and a critical Serv U update demand edge mail and file transfer attention, and Nichirei’s Japan logistics outage shows how a single food shipper disruption rattles partners.

Patch the edge tonight, rotate SharePoint keys, kill risky GlobalProtect cookie configs, verify WordPress really moved to 6.8.6 or newer, lock multi user Windows, and hunt logs like the foothold is already there.

9.8

CVSS Score

0

IOC Count

12

Source Count

72

Confidence Score

CVEs

CVE-2026-50522, CVE-2026-58644, CVE-2026-0257, CVE-2026-60137, CVE-2026-63030, CVE-2026-56164, CVE-2026-45659, CVE-2026-50055, CVE-2026-10631, CVE-2026-50054, CVE-2026-0770 [NOT CONFIRMED], LegacyHive [NO CVE ASSIGNED IN SOURCES], Serv U [INSUFFICIENT SOURCE DATA]

Actors

Under Attribution, RansomHouse self claim Under Attribution

Sectors

Financial Services, Government, Technology, Managed Service Providers, Food and Logistics, Collaboration and Email Infrastructure, Enterprise Windows Endpoints

Regions

Global, Asia Pacific Japan

Chapter 01 - Executive Overview

Today’s brief is anchored on three high impact initial access vectors under active exploitation against widely deployed internet facing services, plus a parallel set of high urgency patch and disruption items from the same reporting window.

Active exploitation cluster (highest confidence):

  • Critical deserialization RCE in Microsoft SharePoint Server (CVE-2026-50522 and related CVE-2026-58644, CVE-2026-56164, CVE-2026-45659) enabling unauthenticated code execution on on premises SharePoint Enterprise Server 2016, SharePoint Server 2019, and SharePoint Server Subscription Edition. Attackers steal IIS machine keys and plant web shells so access can survive patching until keys rotate. Peak CVSS 9.8. SharePoint Online is not affected.

  • Authentication bypass in Palo Alto Networks PAN OS GlobalProtect (CVE-2026-0257) allowing remote attackers to forge authentication override cookies and establish VPN sessions without credentials when override cookies are enabled and the cookie certificate is reused for HTTPS service. CISA KEV listed; fixed releases include branches such as 10.2.10 h36, 11.1.4 h33, 11.2.4 h17, and 12.1.4 h6.

  • WordPress core wp2shell pre auth RCE chain (CVE-2026-63030 REST API batch route confusion plus CVE-2026-60137 SQL injection in WP_Query author__not_in) achieving unauthenticated remote code execution on default installs. Fixed in 6.8.6, 6.9.5, 7.0.2 (and 7.1 beta2). CISA KEV confirms in the wild exploitation. Forced auto updates may silently fail.

Parallel high urgency items (same window):

  • LegacyHive: public Windows local privilege escalation proof of concept abusing User Profile Service hive loading so a standard user can mount another user’s registry hive (including administrator class data) into their own classes root. Effective on systems that already have July 2026 Patch Tuesday applied. No Microsoft CVE or official patch at report time; Microsoft investigating; unofficial 0patch micropatches reported. Highest risk on VDI, RDS, helpdesk, RDP, and shared kiosk hosts rather than as an internet worm.

  • Zimbra Collaboration Suite 10.1.20 (released 20 July 2026): High severity bundle closing critical SNMP command injection when SNMP notifications and Swatchdog are enabled, Classic UI XSS, mail forwarding restriction bypass CVE-2026-50055, EWS access control CVE-2026-10631, mailbox delegation authorization CVE-2026-50054, and Nextcloud SSRF.

  • Serv U: critical update flagged by SANS Internet Storm Center Stormcast on 22 July 2026; full CVE and CVSS detail remain insufficient in retrieved content and need primary advisory follow up.

  • Nichirei (Japan, food and logistics): operational disruption to frozen food shipping after a cyberattack disclosed around 13 July 2026, with an in window RansomHouse self claim of responsibility that remains under attribution without independent vendor corroboration.

Strategic message for leadership:

  • Exploitation has moved past theoretical risk for SharePoint, GlobalProtect, and WordPress. Patching and hardening are emergency change work, not backlog.

  • Priority order for most enterprises: internet exposed SharePoint farms and GlobalProtect portals first, then self hosted WordPress, then Zimbra and Serv U internet facing instances, then multi user Windows estates for LegacyHive, with supply chain attention if you share logistics or EDI links with affected Japanese food operators.

  • After SharePoint patches, rotate IIS machine keys and related secrets. After GlobalProtect changes, terminate sessions and re authenticate under hardened cookie and certificate configuration. For WordPress, verify forced updates actually landed and block anonymous REST batch access until verified.

  • No public IP, domain, URL, or hash IOC packs are available; hunt on versions, builds, and behavioral telemetry.

  • Overall confidence for this combined daily record is 72. Record status is Draft pending human CTI review.

Chapter 02 - Threat & Exposure Analysis

SharePoint deserialization RCE (CVE-2026-50522 and related CVEs)

  • CVE-2026-50522 is a critical deserialization of untrusted data vulnerability in Microsoft SharePoint Enterprise Server 2016, SharePoint Server 2019, and SharePoint Server Subscription Edition

  • Enables remote unauthenticated code execution via crafted serialized objects that reach vulnerable token handling code paths

  • CVSS v3.1 peak 9.8 per NVD and vendor advisories in consulted sources

  • Affects on premises x64 deployments prior to patched builds:

    • 16.0.5561.1001 (SharePoint Enterprise Server 2016)

    • 16.0.10417.20175 (SharePoint Server 2019)

    • 16.0.19725.20434 (SharePoint Server Subscription Edition)

  • SharePoint Online is not affected

  • Observed post exploitation: web shell deployment, arbitrary .NET payloads in w3wp.exe, theft of IIS machine keys that remain valid after patching unless rotated

  • Related expanders of on premises attack surface:

    • CVE-2026-58644 additional deserialization path

    • CVE-2026-56164 deserialization and privilege escalation path

    • CVE-2026-45659 further privilege escalation / surface expansion

  • CISA warns actors chain these flaws to harvest machine keys for long term unauthorized access

  • Compensating guidance from consulted sources: rotate IIS machine keys, enable AMSI integrations on SharePoint servers, apply July 2026 security updates across every farm member

  • Internet scanning referenced in consulted sources shows thousands of unpatched SharePoint instances still exposed, supporting opportunistic mass exploitation risk

PAN OS GlobalProtect authentication bypass (CVE-2026-0257)

  • Authentication bypass in GlobalProtect portal and gateway components of Palo Alto Networks PAN OS

  • Attackers forge authentication override cookies and establish unauthorized VPN sessions without credentials

  • Root condition: GlobalProtect configured with authentication override cookies enabled AND the certificate used to encrypt those cookies is reused for portal or gateway HTTPS service, allowing derivation of the public key and crafting of valid cookies

  • Affected branches span PAN OS 10.2, 11.1, 11.2, and 12.1, plus Prisma Access deployments on those versions

  • Fixed release examples from consulted sources: 10.2.10 h36, 11.1.4 h33, 11.2.4 h17, 12.1.4 h6

  • Limited but real in the wild exploitation reported; CISA added CVE-2026-0257 to the Known Exploited Vulnerabilities catalog with federal remediation pressure

  • Detection challenge: successful abuse looks like legitimate VPN sessions (cookie only access) rather than brute force or credential stuffing

WordPress core wp2shell pre auth RCE (CVE-2026-63030 and CVE-2026-60137)

  • Chain of two core flaws achieving unauthenticated remote code execution on default WordPress installs without plugins or non default configuration

  • CVE-2026-63030: REST API batch route confusion abusing /wp-json/batch/v1 (and rest_route=/batch/v1) to reach internal routes unexpectedly via WP_REST_Server::serve_batch_request_v1

  • CVE-2026-60137: SQL injection in WP_Query author__not_in parameter; untrusted input flows into SQL queries

  • Together they enable pre auth arbitrary PHP code execution

  • Affected versions:

    • Full RCE chain: WordPress 6.9.0 to 6.9.4 and 7.0.0 to 7.0.1

    • Standalone SQL injection: WordPress 6.8.0 to 6.8.5

  • Fixed branches: 6.8.6, 6.9.5, 7.0.2, 7.1 beta2

  • Patches released 17 July 2026 with forced automatic updates for supported installs; forced updates may silently fail (permissions, disabled auto update, failed background jobs)

  • CISA KEV listing confirms in the wild exploitation; interim WAF controls on REST batch endpoints recommended until upgrade verification

LegacyHive Windows local privilege escalation

  • Public proof of concept name LegacyHive abuses Windows User Profile Service (ProfSvc) hive loading

  • Standard user can mount another user’s registry hive (including administrator class data) into their own classes root

  • Researchers state it remains effective on systems with July 2026 Patch Tuesday already applied

  • No Microsoft CVE and no official patch confirmed in consulted sources at report time; Microsoft stated it is investigating

  • Unofficial 0patch micropatches reported around 20 July 2026

  • Strategic risk profile: insider, helpdesk, RDP, VDI, RDS, shared kiosk, and jump box paths matter far more than internet worm risk

  • Cross user registry access can enable secret theft or login time execution changes

Zimbra Collaboration Suite 10.1.20 bundle

  • Release date 20 July 2026; vendor severity High per consulted sources

  • Critical path: SNMP command injection when SNMP notifications and Swatchdog are enabled

  • Additional fixes in the same bundle:

    • Classic UI XSS issues

    • Mail forwarding restriction bypass CVE-2026-50055

    • EWS access control CVE-2026-10631

    • Mailbox delegation authorization CVE-2026-50054

    • Nextcloud SSRF

  • Highest exposure on internet facing mail and collaboration hosts still on pre 10.1.20 builds, especially where SNMP notification features are turned on

Serv U critical update

  • Flagged as critical by SANS Internet Storm Center Stormcast on 22 July 2026

  • Full CVE identifiers, CVSS, and affected version matrix were insufficient in retrieved content

  • Treat internet facing managed file transfer instances as high priority inventory and patch candidates until primary advisory text is pulled

Nichirei food and logistics disruption (Japan)

  • Major frozen food operator; shipments disrupted after system failure later attributed to a cyberattack

  • Initial disruption disclosure around 13 July 2026 per reporting

  • In window media carry a RansomHouse self claim of responsibility; company indicates awareness and ongoing investigation aimed at restoring normal shipping

  • Independent vendor corroboration of the self claim is not present in consulted sources

  • Regional supply chain concern for partners sharing cold chain, logistics, or EDI links

Chapter 03 - Operational Response

Immediate priorities (0 to 24 hours)

  1. Inventory and exposure mapping

  • Enumerate all internet facing SharePoint, GlobalProtect, WordPress, Zimbra, and Serv U instances, including staging and legacy

  • Verify on premises SharePoint versus SaaS (SharePoint Online not affected by CVE-2026-50522)

  • Record exact WordPress core versions and whether forced automatic updates to 6.8.6, 6.9.5, or 7.0.2 succeeded

  • Inventory multi user Windows hosts (VDI, RDS, RDP jump boxes, helpdesk, kiosks) for LegacyHive exposure

  • Map any business dependency on Nichirei or similar Japanese food logistics partners for continuity planning

  1. Emergency patching and configuration changes

  • Apply Microsoft July 2026 cumulative updates for CVE-2026-50522 and related SharePoint flaws on every farm member; confirm build numbers match patched baselines

  • Upgrade PAN OS to fixed GlobalProtect versions per vendor guidance; if immediate patching is not feasible, disable authentication override cookies or reconfigure them to use a dedicated certificate not shared with HTTPS services

  • Update all affected WordPress sites to 6.8.6, 6.9.5, or 7.0.2 (or later) and verify in the admin dashboard; treat 6.9.x and 7.0.x as highest priority for the pre auth RCE chain

  • Upgrade Zimbra Collaboration Suite to 10.1.20; disable SNMP notifications and Swatchdog where the critical injection path is not required

  • Apply the Serv U critical update as soon as primary advisory packages are confirmed

  • For LegacyHive until an official Microsoft fix exists: prefer 0patch or equivalent vendor approved micropatch only after change control review; reduce shared multi user exposure; enforce least privilege on interactive logons

  1. Access restriction and compensating controls

  • Place unpatched on premises SharePoint and GlobalProtect portals behind VPN, reverse proxy, or geo/IP restricted fronts; avoid direct public exposure of administrative interfaces

  • For WordPress, implement temporary WAF rules blocking unauthenticated access to /wp-json/batch/v1 and ?rest_route=/batch/v1 (both path and query string forms)

  • Restrict Zimbra admin and SNMP related management planes to trusted networks

  • For multi user Windows: limit local interactive logons, separate admin and user sessions, harden profile service related audit policies

Short term investigation and containment (1 to 7 days)

  1. Compromise assessment for SharePoint

  • Review IIS and SharePoint logs for anomalous POST requests to authentication and token related endpoints resembling deserialization probe patterns

  • Hunt for unexpected child processes of w3wp.exe (cmd.exe, powershell.exe, wscript.exe, cscript.exe, certutil.exe, msbuild.exe)

  • Hunt newly created .aspx files under SharePoint layouts directories and unexplained application pool changes

  1. Compromise assessment for GlobalProtect

  • Analyze GlobalProtect VPN logs for new or unusual client IPs, sudden connection pattern changes, and sessions established without corresponding authentication events (possible forged cookie use)

  • Correlate suspicious VPN sessions with internal lateral movement or privilege escalation

  • Treat unexplained high privilege sessions as potential incidents

  1. Compromise assessment for WordPress

  • Examine web and application logs for suspicious REST API batch requests, unusual SQL behavior, or traffic spikes to /wp-json/batch/v1 around disclosure dates

  • Inspect for newly added or modified PHP files under wp-content, wp-includes, uploads, and must use plugin directories

  • Verify administrator accounts against a known good inventory; watch for new or renamed privileged users

  1. Compromise assessment for Zimbra, Serv U, and LegacyHive

  • Zimbra: review mail and proxy logs around SNMP, EWS, delegation, and Classic UI paths; confirm 10.1.20 build everywhere

  • Serv U: after advisory confirmation, review MFT auth and file transfer logs for pre patch anomalies

  • LegacyHive: hunt for unexpected registry hive load operations, cross user profile mount activity, and secrets access from low privilege sessions on multi user hosts

  1. Credential and key rotation

  • For any SharePoint deployment that may have been exposed: rotate IIS machine keys, ASP.NET keys, and associated service account credentials (attackers steal keys for durable post patch access)

  • For GlobalProtect: rotate certificates and administrative passwords, enforce MFA on privileged accounts, terminate all active VPN sessions, then re authenticate under the new configuration

  • For WordPress: rotate admin and application secrets if compromise indicators appear; invalidate sessions

  • For Zimbra and Serv U: rotate admin and service credentials after upgrade if pre patch exposure existed

  • For LegacyHive suspected abuse: reset secrets found in exposed hives; review scheduled tasks and Run keys that may have been altered via classes root abuse

  • 2026-05-12 to 2026-05-27: Palo Alto Networks publishes advisory for CVE-2026-0257; NVD records the PAN OS authentication bypass issue

  • 2026-05-28 to 2026-06-01: CISA adds CVE-2026-0257 to the Known Exploited Vulnerabilities catalog and mandates federal remediation by early June; multiple vendors observe active exploitation of GlobalProtect portals using forged cookies

  • 2026-07-13: Nichirei initial system failure / cyberattack disclosure window begins per reporting (Japan food and logistics shipping disruption)

  • 2026-07-13 to 2026-07-14: Microsoft July 2026 Patch Tuesday includes fixes for SharePoint CVE-2026-50522 and related deserialization flaws; NVD publishes vulnerability details

  • 2026-07-14 to 2026-07-20: LegacyHive public proof of concept discourse; researchers state the primitive still works after July 2026 Patch Tuesday

  • 2026-07-17: WordPress core team releases 6.8.6, 6.9.5, and 7.0.2 addressing wp2shell CVE-2026-63030 and CVE-2026-60137; forced automatic updates begin rolling out

  • 2026-07-20: Zimbra Collaboration Suite 10.1.20 released (SNMP command injection path, XSS, CVE-2026-50055, CVE-2026-10631, CVE-2026-50054, Nextcloud SSRF)

  • 2026-07-20: Security researchers and blogs report active exploitation of SharePoint CVE-2026-50522 with IIS machine key theft and web shell planting; write ups describe techniques and affected build numbers

  • 2026-07-20: Unofficial 0patch micropatches for LegacyHive reported; Microsoft spokesperson states investigation is ongoing

  • 2026-07-20 to 2026-07-21: CISA KEV update adds WordPress wp2shell CVEs (and other exploited vulnerabilities in the same window), confirming in the wild exploitation and setting operational patch deadlines for U.S. federal agencies

  • 2026-07-21 to 2026-07-22: In window media coverage of RansomHouse self claim against Nichirei; company indicates awareness and ongoing restoration effort

  • 2026-07-22: SANS Internet Storm Center Stormcast flags critical Serv U update alongside Zimbra practitioner guidance; this daily combined record published as Draft

Chapter 04 - Detection Intelligence

SharePoint deserialization attack surface

  • Technical analyses of CVE-2026-50522 describe attacker supplied serialized objects processed by SharePoint’s token handling pipeline, specifically within classes derived from Windows Identity Foundation SessionSecurityTokenHandler, without sufficient validation

  • Gadget chains execute arbitrary .NET code inside the w3wp.exe worker process

  • Network reachable, no authentication, no user interaction required

  • Attacker crafts a malicious security token, embeds a serialized payload, and sends it to vulnerable SharePoint endpoints for full control of the underlying Windows server

  • Common outcomes: web shells in SharePoint layouts directories; machine key theft enabling forged authentication tokens that survive software patches until keys rotate

  • CVE-2026-58644 and CVE-2026-56164 widen the surface with additional deserialization and privilege escalation paths, simplifying chains and providing fallbacks when specific gadgets are mitigated

  • Defenders must validate every server in a farm reaches the correct cumulative update and isolate or decommission unsupported versions

PAN OS GlobalProtect cookie forgery mechanics

  • GlobalProtect authentication override issues encrypted cookies so subsequent portal or gateway requests can skip re authentication

  • CVE-2026-0257 abuses cases where the same X.509 certificate is used for both cookie encryption and the HTTPS service

  • Attacker with network access captures the public key and forges arbitrary cookies

  • PAN OS trusts any cookie it can decrypt with the configured certificate and fails to verify that the cookie was signed by the device itself

  • Remote attacker generates a valid authentication override cookie for any username and presents it to the gateway to establish a VPN session without credentials

  • Exploit scripts in public research automate portal testing and forged cookie issuance, lowering skill barriers

  • Preconditions (common in convenience oriented enterprise configs): GlobalProtect enabled, authentication override cookies configured, certificate reuse

  • Rotating certificates without disabling or correctly reconfiguring authentication override can leave gaps; restrict portals to trusted IP ranges and monitor anomalous session patterns until patched

WordPress wp2shell exploit chain behavior

  • Targets REST API batch endpoint /wp-json/batch/v1

  • CVE-2026-63030: route confusion bug in WP_REST_Server::serve_batch_request_v1 lets attackers direct batch requests to internal routes outside the intended security model

  • CVE-2026-60137: author__not_in in WP_Query not properly sanitized, enabling SQL injection from untrusted input

  • Combined: unauthenticated attacker crafts REST batch requests that trigger SQL injection and ultimately write or execute arbitrary PHP, even on default core with no plugins

  • Fully pre auth; does not rely on non core components; high danger for lightly administered sites that auto update infrequently

  • Vulnerable branches span widely used 6.8.x, 6.9.x, 7.0.x lines

  • Forced auto updates help many sites but fail silently where auto updates are disabled, file permissions block writes, or background updates error

  • Interim mitigations: WAF block of unauthenticated REST batch access; monitor /wp-json/batch/v1 and rest_route=/batch/v1; full upgrade plus compromise investigation remain mandatory

LegacyHive ProfSvc hive load behavior

  • Abuses Windows User Profile Service hive loading so a standard user mounts another user’s registry hive into their own classes root

  • Enables reading administrator class hive data and potentially influencing login time execution configuration through classes root control

  • Not an internet facing worm primitive; requires local code execution context as a standard user (interactive, RDP, VDI, shared workstation, malicious insider, or prior foothold)

  • Survives July 2026 Patch Tuesday per researcher statements in consulted sources

  • No official CVE or Microsoft patch at report time; unofficial micropatches exist from third parties

  • Highest value targets: privileged users’ hives on shared admin jump hosts and VDI pools

Zimbra 10.1.20 technical themes

  • Critical SNMP command injection when SNMP notifications and Swatchdog are enabled turns a management feature into an OS command execution path under vulnerable builds

  • Classic UI XSS enables script execution in authenticated administrator or user browser contexts

  • CVE-2026-50055 mail forwarding restriction bypass can undermine outbound mail governance

  • CVE-2026-10631 EWS access control and CVE-2026-50054 delegation authorization flaws weaken mailbox boundary enforcement

  • Nextcloud SSRF expands server side request risk toward internal resources

  • Combined bundle is a collaboration edge hardening event, not a single CVE story

Serv U and Nichirei technical notes

  • Serv U: practitioner telemetry marks a critical update; mechanism detail insufficient until full advisory is ingested

  • Nichirei: public facts center on operational disruption of shipping systems; technical entry vector, ransomware family, and infrastructure indicators are not established in consulted sources beyond the unverified self claim

Current reporting focuses on vulnerabilities, exploit techniques, version baselines, and post exploitation behaviors rather than specific attacker infrastructure.

Atomic IOC status

  • IP addresses published for these incidents in window: none

  • Domains published: none

  • URLs (attacker infrastructure) published: none

  • File hashes published: none

  • Total block list ready IOC count: 0

What consulted sources do mention (not shareable IOC packs)

  • Proof of concept exploit material hosted on public code repositories for several of the vulnerability classes

  • Scanning activity observed against SharePoint and GlobalProtect endpoints

  • Behavioral post exploitation patterns (machine key theft, web shells, forged VPN cookies, REST batch abuse, ProfSvc hive load)

Defender substitute indicators (environment local)

Indicator class

What to collect

Why it matters

CVE and KEV membership

CVE-2026-50522 family, CVE-2026-0257, CVE-2026-60137 / CVE-2026-63030, Zimbra CVE-2026-50055 / CVE-2026-10631 / CVE-2026-50054

Patch and exposure prioritization

Product builds

SharePoint patched builds listed in field CVEs context; PAN OS fixed hotfixes; WordPress 6.8.6+ / 6.9.5+ / 7.0.2+; Zimbra 10.1.20; Serv U latest critical

Version gate = primary exposure IOC

SharePoint telemetry

POST anomalies to token/trust/layouts; w3wp.exe child shells; new .aspx under layouts; machine key change events

Detect pre and post patch compromise

GlobalProtect telemetry

Gateway login without recent interactive auth; unusual source IPs; session without matching auth success

Forged cookie sessions

WordPress telemetry

Unauthenticated /wp-json/batch/v1 and rest_route=/batch/v1; new PHP under wp-content / wp-includes / uploads / mu-plugins; admin account drift

wp2shell chain and persistence

Windows multi user telemetry

Unexpected hive load / profile service events; cross user registry access from low privilege processes

LegacyHive style abuse

Zimbra / Serv U telemetry

Pre upgrade SNMP, EWS, delegation, MFT auth anomalies

Edge collaboration and file transfer abuse

Nichirei partner risk

EDI, logistics API, and email trust paths to disrupted shipper

Business continuity, not network IOC

Infrastructure intelligence conclusion

  • Do not wait for global IOC feeds; none are published for these clusters in the covered window

  • Rely on environment local telemetry, version inventories, and the behavioral patterns above

  • When vendors or ISACs later publish infrastructure indicators, treat them as supplements to the behavioral view, not replacements

  • IOC Enrichment remains Pending until recoverable payloads, C2 hosts, or hashes appear for sandbox, passive DNS, WHOIS, and reputation processing

PAN OS GlobalProtect authentication override cookie abuse

Goal: detect VPN sessions that may have been established with forged authentication override cookies.

SIEM logic (pseudo KQL):

text// Identify GlobalProtect logins without preceding interactive auth
let gp_logins =
  GlobalProtectLogs
  | where EventSubtype == "globalprotect-gateway-login"
  | project TimeGenerated, SrcIpAddr, Username, ComputerName;

let gp_auth =
  GlobalProtectLogs
  | where EventSubtype in ("globalprotect-auth-success", "globalprotect-portal-login")
  | project AuthTime = TimeGenerated, SrcIpAddr, Username;

gp_logins
| join kind=leftouter (
    gp_auth
    | summarize AuthTime = max(AuthTime) by SrcIpAddr, Username
) on SrcIpAddr, Username
| extend MinutesSinceAuth = datetime_diff("minute", TimeGenerated, AuthTime)
| where isnull(AuthTime) or MinutesSinceAuth > 120
| summarize count() by SrcIpAddr, Username

This surfaces GlobalProtect gateway logins that lack a recent interactive authentication event, which may indicate cookie only access via forged authentication override tokens.

Additional GlobalProtect hunts:

  • Sudden first seen source IPs establishing gateway sessions for privileged usernames

  • Session volume spikes outside business baselines without matching portal auth success

  • Administrative or service accounts appearing in gateway login events without MFA evidence where MFA is expected

SharePoint deserialization RCE and web shell deployment

Windows event and process telemetry (pseudo Sigma):

texttitle: Suspicious Process Spawned by SharePoint Worker Process (w3wp)
id: sharepoint-suspicious-child-processes
status: experimental
description: Detects potential exploitation of SharePoint deserialization RCE leading to web shell execution or OS command invocation.
logsource:
  category: process_creation
  product: windows

selection:
  ParentImage|endswith: '\\w3wp.exe'
  Image|endswith:
    - '\\cmd.exe'
    - '\\powershell.exe'
    - '\\wscript.exe'
    - '\\cscript.exe'
    - '\\certutil.exe'
    - '\\msbuild.exe'

condition: selection

fields:
  - Image
  - ParentImage
  - CommandLine
  - ParentCommandLine
  - User

Abuse of CVE-2026-50522 typically results in SharePoint’s w3wp.exe spawning scripting engines or shell processes to establish persistence or download second stage payloads. This detector focuses on those child processes as high signal events.

IIS log hunting snippet (pseudo Kusto):

textW3CIISLog
| where cs_uri_stem has "_trust" or cs_uri_stem has "_layouts"
| where cs_method == "POST"
| where sc_status between (400 .. 599)
| summarize count() by cs_uri_stem, c_ip
| order by count_ desc

This hunts unusual POST traffic to auth and token endpoints that may reflect probe or exploit attempts using malformed serialized tokens.

SharePoint file system and config hunts:

  • Newly created or modified .aspx files under layouts and related SharePoint content roots outside change windows

  • Unexplained application pool recycles correlated with suspicious POSTs

  • Machine key or web.config changes without approved change tickets

  • AMSI bypass patterns or disabled AMSI where AMSI integration was expected on SharePoint servers

WordPress wp2shell REST batch exploitation

Web and WAF log logic (pseudo KQL):

textHttpLogs
| where Url has "/wp-json/batch/v1" or Url has "rest_route=/batch/v1"
| summarize cnt = count(),
            distinct_ips = dcount(ClientIp)
          by Site, bin(TimeGenerated, 1h)
| where cnt > 50 or distinct_ips > 10

High volumes of REST batch requests to the batch endpoint, especially from diverse IPs or shortly after public exploit releases, may indicate scanning or active exploitation of the wp2shell chain.

App level log or custom middleware check (pseudocode):


pythonif request.path == '/wp-json/batch/v1' or request.GET.get('rest_route') == '/batch/v1':
    if not request.user.is_authenticated:
        log_security_event('AnonBatchAccess', ip=request.ip, ua=request.user_agent)

This pattern allows application level logging of unauthenticated access to batch routes where WAF coverage may be incomplete.

WordPress host hunts:

  • New or modified PHP under wp-content, wp-includes, uploads, and must use plugin paths

  • Administrator account inventory drift (new, renamed, or unexpectedly privileged users)

  • SQL error spikes or anomalous query patterns involving author__not_in style parameters in application logs

  • Failed or rolled back core auto update events leaving sites on 6.8.x, 6.9.0 to 6.9.4, or 7.0.0 to 7.0.1

LegacyHive Windows User Profile Service hive load

Detection themes (endpoint / EDR):

  • Low privilege processes triggering unexpected user profile hive load or registry mount operations against another user’s hive path

  • Access to NTUSER.DAT or equivalent hive files of privileged users from standard user contexts on VDI, RDS, RDP jump hosts, helpdesk, and kiosk systems

  • Sudden classes root modifications associated with another user’s mounted hive

  • Follow on signals: scheduled task creation, Run key changes, or secret material access immediately after cross user hive mount

Illustrative process and registry hunt logic (pseudo Sigma style):

texttitle: Suspicious Cross User Registry Hive Load via Profile Service
id: legacyhive-cross-user-hive-load
status: experimental
description: Detects potential LegacyHive style abuse where a standard user context interacts with another user hive or unexpected profile load activity.
logsource:
  category: registry_event
  product: windows

selection_suspected_hive_paths:
  TargetObject|contains:
    - '\\Users\\'
    - 'NTUSER.DAT'
    - '\\ProfileList\\'

condition: selection_suspected_hive_paths

fields:
  - Image
  - User
  - TargetObject
  - CommandLine

Tune heavily per estate. Profile service activity is noisy; prioritize multi user hosts and correlate with non owner user context plus subsequent credential or persistence actions.

Zimbra Collaboration Suite 10.1.20 related detection

  • Confirm build inventory equals 10.1.20 everywhere before tuning suppressions

  • Alert on SNMP notification and Swatchdog related process spawns executing unexpected shell commands on mail hosts still below 10.1.20

  • Monitor Classic UI paths for reflected or stored XSS probe patterns and anomalous admin browser sessions

  • Review EWS and delegation configuration changes (CVE-2026-10631, CVE-2026-50054 context) and unexpected mail forwarding rule creation (CVE-2026-50055 context)

  • Detect server side request patterns consistent with Nextcloud SSRF toward internal metadata or admin endpoints

Serv U managed file transfer detection

  • Until full advisory IOCs and CVE strings are ingested, raise monitoring on internet facing Serv U listeners for authentication anomalies, unexpected account creation, and unusual file transfer bursts

  • Correlate pre update access with post update persistence checks (new admin users, odd virtual directories, unexpected automation scripts)

Nichirei partner and logistics side detection (business process, not network IOC)

  • Heightened monitoring on EDI, API, and email trust channels with disrupted logistics partners

  • Fraud and BEC style review for urgent shipping or payment changes referencing the disruption

  • No atomic attacker infrastructure is published in consulted sources for this event

Detection operations notes

  • Prefer version and build compliance dashboards as first class detections (unpatched SharePoint, GlobalProtect, WordPress, Zimbra, Serv U)

  • Pair preventative WAF and network restriction rules with the analytic detections above

  • Because IOC Count is 0 and IOC Enrichment is Pending, behavioral and version detections are the primary safety net

Consulted sources do not publish explicit vendor ATT&CK technique ID tables for these incidents. This section records mentioned behaviors from reporting and inferred MITRE components derived from those behaviors.

Cluster

Mentioned behavior in consulted sources

Inferred tactics

Inferred techniques

SharePoint CVE-2026-50522 family

Unauthenticated deserialization RCE; web shells in layouts; IIS machine key theft; w3wp child shells

Initial Access, Execution, Persistence, Privilege Escalation, Defense Evasion, Credential Access

T1190 Exploit Public Facing Application; T1059 Command and Scripting Interpreter; T1059.001 PowerShell; T1059.003 Windows Command Shell; T1505.003 Web Shell; T1550.001 Application Access Token; T1134 Access Token Manipulation; T1068 Exploitation for Privilege Escalation

PAN OS CVE-2026-0257

Forged authentication override cookies; VPN session without credentials

Initial Access, Defense Evasion, Lateral Movement

T1133 External Remote Services; T1550.004 Web Session Cookie; T1036 Masquerading; T1021 Remote Services

WordPress wp2shell

Pre auth REST batch route confusion; SQL injection via author__not_in; arbitrary PHP execution; possible PHP persistence files

Initial Access, Execution, Persistence, Credential Access

T1190 Exploit Public Facing Application; T1059 Command and Scripting Interpreter; T1505.003 Web Shell; T1087 Account Discovery

LegacyHive

Standard user mounts another user registry hive via ProfSvc; access to administrator class hive data

Privilege Escalation, Credential Access, Persistence, Defense Evasion

T1068 Exploitation for Privilege Escalation; T1003 OS Credential Dumping; T1552 Unsecured Credentials; T1112 Modify Registry

Zimbra 10.1.20 bundle

SNMP command injection when notifications and Swatchdog enabled; Classic UI XSS; forwarding restriction bypass; EWS and delegation auth flaws; Nextcloud SSRF

Initial Access, Execution, Persistence, Collection, Lateral Movement

T1190 Exploit Public Facing Application; T1059 Command and Scripting Interpreter; T1059.007 JavaScript; T1068 Exploitation for Privilege Escalation; T1090 Proxy or equivalent SSRF adjacent behavior (server side request abuse); T1114 Email Collection

Serv U critical update

Critical update on managed file transfer (detail incomplete)

Initial Access, Collection, Exfiltration (provisional)

T1190 Exploit Public Facing Application (if internet facing MFT flaw class); T1048 Exfiltration Over Alternative Protocol (provisional only if abused as MFT)

Nichirei disruption

Operational shipping disruption; RansomHouse self claim under attribution

Impact, Collection (provisional)

T1486 Data Encrypted for Impact (provisional); T1489 Service Stop; T1490 Inhibit System Recovery (provisional)

Narrative mapping notes

  • Strongest inferred coverage sits on Initial Access (T1190, T1133), Execution (T1059 family), Persistence (T1505.003, token and cookie reuse), Privilege Escalation (T1068), and Defense Evasion (T1550 family, masquerading VPN sessions)

  • Credential Access is evidenced for SharePoint machine keys and plausible for LegacyHive cross user hive secrets

  • Lateral Movement is a natural follow on from GlobalProtect footholds and compromised collaboration hosts (T1021) even when specific internal tools are not named

  • Impact techniques for Nichirei remain provisional because independent confirmation of ransomware family and encryption behavior is not present in consulted sources

  • Command and Control has insufficient atomic evidence; do not invent C2 technique IDs until telemetry shows channels

ATT&CK usage guidance for SOC content

  • Build detections and purple team cases primarily around T1190, T1133, T1505.003, T1550.001, T1550.004, T1068, and T1059

  • Tag tickets and incident records with both the CVE or product name and the inferred technique IDs above so metrics remain comparable when vendor official mappings later appear

  • Replace inferred rows with authoritative mappings when Microsoft, Palo Alto Networks, WordPress security publishers, Zimbra, CISA, or major response vendors publish them

Chapter 05 - Governance, Risk & Compliance

Systemic exposure themes

  • Legacy on premises collaboration (SharePoint Server), VPN edge (GlobalProtect), self hosted CMS (WordPress), mail collaboration (Zimbra), managed file transfer (Serv U), and multi user Windows estates create concentrated internet facing and insider adjacent risk when inventory driven patch governance is weak

  • Organizations that retain SharePoint Server instead of SharePoint Online, or self hosted WordPress instead of managed platforms, own rapid patching, secure configuration (including GlobalProtect certificate design), and log retention sufficient to investigate pre patch exploitation

  • Multi user Windows (VDI, RDS, jump boxes) without strict session separation amplifies LegacyHive style local privilege escalation impact even when edge RCEs are absent

Regulatory and assurance pressure

  • Consulted sources and broader public sector practice treat CISA Known Exploited Vulnerabilities listings as de facto evidence of reasonably foreseeable risk

  • Failure to remediate KEV listed issues such as CVE-2026-0257 and the WordPress wp2shell chain within required or industry norm timelines can undermine claims of due diligence after an incident and can affect regulatory, contractual, and cyber insurance postures

  • Frameworks commonly cited in enterprise governance programs (for example NIS2 aligned duties, sectoral cyber directives, and equivalent national baseline controls) increasingly expect emergency change paths for actively exploited edge vulnerabilities

Board and risk committee actions

Decision

Owner

Evidence to retain

KEV driven patch SLA (hours or days, not weeks) for internet facing SharePoint, GlobalProtect, WordPress

CISO / Head of Infrastructure

Inventory snapshots, change tickets, build verification screenshots

Emergency change management exemption path for zero day and KEV items

CIO / Change Advisory leadership

Written exemption procedure, post implementation review

Explicit risk acceptance for systems that cannot be patched (unsupported SharePoint farms, frozen appliances)

Risk committee

Compensating controls, isolation design, expiry date on acceptance

Certificate and authentication override configuration standard for GlobalProtect

Network security architecture

Config baselines, audit results

Forced WordPress auto update monitoring and exception register

Web platform owner

Sites where auto update failed, WAF compensating rules, fix dates

Multi user Windows local privilege escalation control standard (LegacyHive window)

Endpoint security

VDI/RDS hardening standard, micropatch policy, admin separation

Third party logistics cyber disruption playbook (Nichirei class events)

Business continuity / procurement

Partner dependency map, EDI failover, fraud review checklist

Cyber insurance notification assessment

General counsel / risk

Whether KEV exposure or confirmed exploitation meets notice triggers

Control expectations auditors will ask about

  • Evidence that internet facing SharePoint farms reached patched builds and that IIS machine keys were rotated after suspected exposure

  • Evidence that GlobalProtect authentication override cookies are disabled or use dedicated certificates, and that sessions were reset after changes

  • Evidence that WordPress estates are on 6.8.6+, 6.9.5+, or 7.0.2+ with WAF coverage for REST batch routes during transition

  • Evidence that Zimbra is on 10.1.20 and SNMP notification attack surface is justified or disabled

  • Evidence of Serv U critical update application once advisory packages are confirmed

  • Evidence of multi user Windows compensating controls during the LegacyHive unpatched window

  • Log retention covering pre patch exploitation investigation for VPN, IIS/SharePoint, WordPress, and mail MFT platforms

Insurance and third party risk notes

  • Insurers increasingly map KEV membership and delayed patching to control failure narratives after ransomware or extortion events

  • Customer and regulator questionnaires will ask whether CVE-2026-50522, CVE-2026-0257, and wp2shell were in your vulnerability management backlog with measured SLAs

  • Supply chain questionnaires should add logistics partner cyber disruption clauses after events like Nichirei, even when your own perimeter products are patched

Governance bottom line

  • Treat this window as a governance test of emergency patching, key rotation discipline, edge configuration standards, and third party continuity—not only as a technical patch sprint

  • Document decisions at risk committee level; undocumented “we will get to it” backlog handling is the compliance failure mode most likely to be second guessed after breach

Chapter 06 - Adversary Emulation

Purple team window: next 2 to 4 weeks in lab environments that mirror production for SharePoint, PAN OS GlobalProtect, WordPress core, Zimbra, Serv U (when advisory detail allows), and multi user Windows.

SharePoint emulation objectives

  • Replay or safely simulate malformed security token and serialized payload delivery to the same classes of endpoints used by public proof of concept material

  • Confirm patched builds reject exploit attempts and that failures, blocks, and anomalies are logged to SIEM

  • Validate detections for w3wp.exe child processes (cmd, powershell, script hosts, certutil, msbuild)

  • Validate file integrity monitoring on layouts paths for new .aspx web shells

  • After successful controlled exploit in an isolated lab only: demonstrate machine key theft impact and prove that key rotation invalidates forged auth material

  • Negative test: confirm SharePoint Online tenants are out of scope and not false positive sources for these detections

GlobalProtect emulation objectives

  • Test portal and gateway behavior across configurations:

    • authentication override enabled with shared certificate (vulnerable pattern)

    • authentication override disabled

    • authentication override enabled with dedicated cookie certificate (hardened pattern)

  • Confirm forged cookie establishment fails on patched releases and on hardened configs

  • Validate SIEM use cases that flag gateway login without recent interactive auth

  • Validate operational playbooks: session termination at scale, certificate rotation, MFA enforcement on privileged VPN users

  • Measure whether geo or IP ingress restrictions block external probe noise without breaking legitimate roaming users

WordPress wp2shell emulation objectives

  • Send crafted and high volume requests to /wp-json/batch/v1 and rest_route=/batch/v1 from test clients

  • Confirm WAF rules block unauthenticated batch access without breaking legitimate authenticated REST integrations

  • Confirm upgraded cores (6.8.6, 6.9.5, 7.0.2+) no longer allow the chain

  • Validate application logging of anonymous batch access and SOC alert routing

  • Post exploit lab only: verify detection of unexpected PHP writes under wp-content, wp-includes, uploads, and must use plugins

  • Test auto update failure modes (read only filesystems, disabled auto updates) so operations can detect silent lag

LegacyHive emulation objectives

  • On isolated multi user Windows lab images with July 2026 updates applied, reproduce researcher described ProfSvc hive load behavior only under approved purple team authorization

  • Validate whether EDR and advanced audit policies surface cross user hive mount and NTUSER.DAT access from standard user contexts

  • Validate hardening: blocking unnecessary interactive logons on jump hosts, separating admin and user sessions, restricting profile related privileges

  • If third party micropatches (for example 0patch) are approved in policy, validate they break the PoC without destabilizing profile load for legitimate users

  • Re test when Microsoft assigns a CVE or ships an official fix

Zimbra 10.1.20 emulation objectives

  • On pre 10.1.20 lab mail hosts with SNMP notifications and Swatchdog enabled, validate that the critical command injection path is reachable only under those feature flags, then confirm 10.1.20 closes it

  • Test detection of unexpected command execution chains spawned from monitoring components

  • Validate XSS input handling in Classic UI after patch

  • Validate forwarding, EWS, and delegation authorization boundaries after upgrade (CVE-2026-50055, CVE-2026-10631, CVE-2026-50054 context)

  • Confirm SSRF egress controls limit Nextcloud related server side request abuse toward link local and internal admin endpoints

Serv U emulation objectives

  • After primary advisory ingestion: build version specific exploit prevention and detection tests

  • Until then: validate inventory completeness, internet exposure reduction, and generic MFT anomaly detections (auth spikes, new admin users, unusual transfer graphs)

Nichirei class business emulation (tabletop, not exploit)

  • Tabletop a logistics partner cyber disruption: shipping EDI failure, urgent bank detail change emails, customer notification timelines

  • Validate fraud controls and out of band verification for payment and destination changes during partner incidents

  • Do not emulate ransomware against production logistics systems

Validation scorecard (pass or fail per control)

Control under test

Prevent

Detect

Respond

SharePoint July 2026 CU + key rotation

Exploit fails on patched build; old keys invalid after rotation

w3wp child process and layouts file alerts fire

Farm wide build verify + key rotate runbook completes inside SLA

GlobalProtect cookie hardening or patch

Forged cookie session fails

Gateway login without auth alert fires

Mass session kill + cert rotate runbook works

WordPress core upgrade + WAF batch block

Pre auth chain fails; anonymous batch blocked

Anonymous batch and PHP write alerts fire

Version compliance dashboard + restore from known good

LegacyHive mitigations

PoC fails or is contained on hardened multi user hosts

Cross user hive load alert fires on lab abuse

Local admin secret reset + session isolation playbook

Zimbra 10.1.20

SNMP injection and authz bypass paths closed

Monitoring component command spawn alert fires

Mail host patch wave tracked to completion

Serv U critical update

Advisory fix applied; exposure reduced

MFT anomaly alerts tuned

Advisory tracking owner assigned

Partner logistics disruption

Fraud holds prevent payment diversion

SOC or BEC queue flags partner incident themed lures

Comms and EDI failover plan executed in tabletop

Safety rules for emulation

  • Never run unauthenticated RCE or cookie forgery tests against production edge without explicit written authorization and containment

  • Prefer staging farms, lab firewalls, and disposable WordPress and mail clones

  • Capture packet and endpoint telemetry during tests to calibrate detections before production enablement

  • Retire temporary allow rules and test accounts immediately after validation

Intelligence Confidence72%

Combined confidence score: 72

Factor

Direction

Weight on score

Notes

NVD and vendor vulnerability metadata for SharePoint, PAN OS, WordPress

Up

High

CVEs, builds, and fixed versions well documented in consulted sources

CISA KEV confirmation for CVE-2026-0257 and WordPress wp2shell

Up

High

Active exploitation confirmed for core edge vectors

Multi outlet confirmation of SharePoint CVE-2026-50522 exploitation and machine key theft

Up

High

Independent press and technical write ups align

Concrete patch baselines (SharePoint builds, PAN OS hotfixes, WordPress 6.8.6 / 6.9.5 / 7.0.2, Zimbra 10.1.20)

Up

Medium

Actionable for operations

SANS practitioner coverage for Zimbra and Serv U flag

Up

Medium

Useful urgency signal; Serv U detail still thin

LegacyHive public PoC plus Microsoft investigating statement and 0patch reports

Up

Medium

Real risk on multi user Windows; no CVE yet

Peak CVSS 9.8 on SharePoint deserialization

Up

Medium

Anchors Severity Critical

Zero publishable IP, domain, URL, hash IOCs

Down

High

Blocks classic IOC driven defense and enrichment

No convergent named threat actor for primary RCE and VPN vectors

Down

High

Actors remain Under Attribution

MITRE technique IDs inferred rather than vendor published

Down

Medium

Sound mechanically; not authoritative mappings

Nichirei RansomHouse link is self claim only

Down

Medium

Operational disruption confirmed; attribution not independent

Serv U full advisory body insufficient in retrieved content

Down

Medium

Critical flag retained with incomplete CVE/CVSS

LegacyHive lacks official CVE and Microsoft patch

Down

Medium

Forces compensating control language

Sector and region labels partly product scope rather than confirmed victim lists

Down

Low

Avoids over precise victimology

Deep research standalone score 78 versus wide search standalone score 52

Blend

High

Combined record weights stronger exploitation evidence while keeping wide search facts