View Ridge Security
Back to Cyber Hose

Cisco patches actively exploited SD-WAN Manager auth bypass zero-day

Cisco patches a CVSS 9.8 SD-WAN zero-day under active exploitation, PaperCut MF zero-days reach a domain controller, and supply chain attacks target developers.

🚨 ACTIVE EXPLOITATION

  • Cisco patches actively exploited Catalyst SD-WAN Manager auth bypass zero-day (CVE-2026-76504) CVE-2026-76504
    Cisco has released fixes for a critical zero-day authentication bypass in Catalyst SD-WAN Manager that attackers are actively exploiting.

    • Affects Cisco Catalyst SD-WAN Manager (formerly vManage) releases 17.2.x through 26.2, regardless of system configuration; internet-exposed systems are at risk.
    • CVE-2026-76504 (CVSS 9.8, CWE-177) is an unauthenticated API authentication bypass granting admin privileges via improper URI encoding handling.
    • Attackers send crafted HTTP requests using %6a as the URI-encoded 'j' character to bypass an authentication rule on a specific API endpoint.
    • IOC: check serviceproxy-access.log (/var/log/nms/containers/service-proxy) and vmanage-server.log (/var/log/nms/) for j_security_check entries from unknown IPs.
    • This is the fifth actively exploited Cisco SD-WAN zero-day in 2026; fixed releases include 20.9.10.1, 20.12.8.2, 20.15.6.1, 20.18.4.1, 26.1.2.1, and 26.2.1.
    Sources 📄 Source: sec.cloudapps.cisco.com · 📎 Coverage: bleepingcomputer.com · 👁 via BleepingComputer, CVE ThreatInt (+1)

  • PaperCut MF zero-days chained to reach domain controller in education-sector intrusion
    Attackers exploited two PaperCut MF zero-days to compromise an internet-facing print server and steal an Active Directory database from the domain controller.

    • Applies to organizations running internet-facing PaperCut MF print servers; the observed victim was an education-sector customer running PaperCut MF 24.0.2, build 69746.
    • Vulnerable to CVE-2026-81578 and CVE-2026-82078, chainable to alter settings without authentication and run malicious Java bytecode in the PaperCut server's security context.
    • Attack chain: Java code delivered via the card/ID lookup field, in-memory loader plus web shell controlled by a custom HTTP header, then an AdaptixC2 implant hidden in a trojanized Microsoft Copilot binary (mscopilot.exe).
    • Attackers token-impersonated a domain-privileged service account, moved to the domain controller via admin file share and PlugPlay service abuse, dumped credentials, and exfiltrated a copy of the Active Directory database.
    • IOCs include C2 IP 156.227.0[.]13, download IP 47.79.64[.]225, and trojanized Copilot hash d2e55213a02fd16a077298c986130522eb63196bdf8a8c1aec0eed6ef318b222; eSentire detected the intrusion on August 31, 2026.
    Sources 📄 Source: esentire.com · 📎 Coverage: cybersecuritynews.com · 👁 via Cyber Security News, cryptika.com (discovered)

🔓 CVEs & KEV

  • CVE-2026-82804 — Apache Software Foundation Apache DolphinScheduler — CVSS 8.8 — Apache DolphinScheduler: Command Injection in the Alert Script PluginThe scri...

🕵️ RESEARCH & DEEP DIVES

  • Supply Chain Attacks Turn Developer Machines Into Gateways for Cloud Breaches
    Qualys reports that credential-stealing malware hidden in trusted packages turns compromised developer machines and build systems into gateways for cloud breaches.

    • Applies to software developers and build/CI systems across npm, PyPI, Ruby gems, Go modules, and Docker Hub ecosystems.
    • Malware hidden in trusted packages and dev tools steals cloud access keys, repository tokens, publishing credentials, and private keys, enabling cloud access, data theft, and persistence.
    • Attacks execute during package installation via automatic install scripts, before normal application protections engage; cancelling installation may not prevent credential theft.
    • Campaigns include Shai-Hulud (Sept 2025, exfiltrated to public GitHub repos), a November variant with backdoor/destructive behavior, and Mini Shai-Hulud (May 19, 2026: 639 compromised versions across 323 packages, including @antv scope).
    • Other actors: BufferZoneCorp malicious Ruby gems/Go modules (added SSH keys to ~/.ssh/authorized_keys), TeamPCP compromised scanning tools, trojaned @bitwarden/cli; stolen credentials were linked to the European Commission cloud breach.
    Sources 📄 Source: blog.qualys.com · 📎 Coverage: cybersecuritynews.com · 👁 via Cyber Security News, cryptika.com (discovered)

  • Hackers disguise signed MSP360 RMM installer as Zoom and PDF downloads to seize PC control
    Microsoft has identified a phishing campaign delivering a legitimate, digitally signed MSP360 RMM installer disguised as Zoom and PDF software to take over business PCs.

    • Targets organizations across several industries; activity identified by Microsoft in July 2026 and not tied to a named group.
    • Delivers legitimate MSP360 RMM v2.5.0.67 installer under deceptive filenames posing as meeting apps, PDF utilities, invitations, or business documents.
    • Phishing emails use meeting invitations, document requests, software updates, RSVP cards, job offers, and delivery notices linking to fake Adobe, Zoom, and document portal pages.
    • After the victim approves the Windows admin prompt, MSP360 installs with startup persistence and a firewall rule allowing inbound UDP traffic on port 48678; its agent then silently installs ConnectWise ScreenConnect as a second access route.
    • Delivery infrastructure rotates across attacker-controlled, compromised, and cloud-hosted sites (Amazon S3, Cloudflare R2, Dropbox, GitLab, Supabase); installer SHA-256 108ef7e628d7a20bd6241a5b57149e27a6061f467123eb64061975559f8f73dc.
    Sources 📎 Coverage: cybersecuritynews.com · 👁 via Cyber Security News, cryptika.com (discovered)

  • Voice phishing: how simple phone calls breached Odido, Google, Cisco, Charter and RingCentral
    Voice phishing attacks using plain phone calls and phishing pages have breached major companies including Odido, Google, Cisco, Charter, and RingCentral.

    • Affects employees at large organizations, especially customer support staff at tech, telecom, and ISP companies
    • Attackers trick employees over the phone into handing over credentials via old-school phishing pages — no AI required
    • Dutch telco Odido lost personal data of over six million people after a single call to a support agent; police released a reconstruction of the hacker's real voice
    • Similar call-based hacks hit Google's Salesforce-hosted customer database, Cisco, Charter, and RingCentral
    Sources 📄 Source: politie.nl · 📎 Coverage: this.weekinsecurity.com · 👁 via @zackwhittaker@mastodon.social

📋 ADVISORIES

  • Microsoft to enforce CSP blocking external script injection in Entra ID sign-ins starting October
    Microsoft will begin enforcing a Content Security Policy on Entra ID browser sign-ins in mid-October 2026 to block externally injected scripts.
    • Applies to organizations using browser-based Entra ID sign-ins via login.microsoftonline.com; MSAL and API-based authentication flows are unaffected.
    • CSP will allow only scripts from trusted Microsoft CDN domains, blocking external script injection and cross-site scripting (XSS) attacks that steal credentials during sign-in.
    • Rollout starts mid-October 2026 and completes by late October; enabled by default with no tenant configuration required.
    • Browser extensions and tools that inject scripts into sign-in pages will stop working, though users can still sign in; admins can check for CSP violations in the browser developer console.
    • The change is part of Microsoft's Secure Future Initiative launched after the 2023 Chinese breach of Exchange Online mailboxes.
    Sources 📎 Coverage: bleepingcomputer.com · 👁 via BleepingComputer

📋 ADVISORIES

  • 📄 Source for AI coding agents leaked 13,000+ internal screenshots from 300+ companies via public GitHub repos — glow.io

Need help assessing your exposure?

Start with the free Posture Self-Check to see where you stand against the current threat landscape.

Free Posture Self-Check