5 verified findings from 1 run · 5 updates to prior coverage · the settled record for this UTC day, in the classic brief order.
Criticality
Kind
Topic
Region
TL;DR · the day in one read
01Four espionage clusters ran the identical click-to-SYSTEM exploit kit within days of each other, Proofpoint calls it the same code, not parallel development. Proofpoint documents BlueMoon, an exploit kit chaining a Chrome V8 patch-gap zero-day (CVE-2026-85046) with a Windows kernel ALPC/WNF local-privilege-escalation flaw (CVE-2026-85880) into a single click-to-SYSTEM chain, independently adopted within days of each other by TA412/APT31 and three new China-nexus clusters targeting US, Vietnamese and Southeast Asian government, aerospace and manufacturing victims. Both CVEs are patched, but the kit's persistence mechanisms (a malicious browser extension, DLL sideloading, scheduled tasks) survive an OS/browser patch untouched. →
02Two pre-auth code-execution flaws sit in the certificate-processing step every VPN negotiation runs before a user ever authenticates. Check Point published two Critical (CVSS 9.8) advisories for VPN certificate-handling flaws discovered internally and reachable before authentication completes: CVE-2026-85103, a heap overflow in certificate ASN.1 decoding on the Security Gateway and Management Server, and CVE-2026-85102, an improper-certificate-validation flaw enabling unauthenticated RCE on the Security Gateway and Spark Firewall. No exploitation is reported; no workaround exists for the locally-managed Spark Firewall or Remote Access VPN. →
03Two maximum-severity SAP kernel flaws are reachable through the same ports every SAP GUI and RFC client needs; network segmentation alone will not close them. SAP's 8 September 2026 Patch Day fixed CVE-2026-44756 (OVERPASS, CVSS 10.0), an unauthenticated memory-corruption flaw in kernel Extended Passport processing reachable via the web tier, SAP Dispatcher or RFC, and CVE-2026-58240 (S4GET, CVSS 9.8), an unauthenticated Message Server trust-bypass reachable on the port every SAP GUI client uses; both yield unauthenticated remote code execution across the SAP kernel-based product line. Neither is yet confirmed exploited, but Onapsis found over 10,000 internet-facing SAP interfaces. →
04Google ships an emergency Chrome fix for a seventh actively exploited V8 zero-day this year. Google's Chrome 153 stable release (2026-09-08) fixes CVE-2026-87491, an out-of-bounds write in the V8 JavaScript engine that Google confirms is already being exploited via a crafted HTML page. CERT-FR and NCSC-NL both flagged the CVE within a day of release; every Chromium-derived browser needs the equivalent update. →
05A months-old Fortinet CAPWAP bug reaches CISA KEV alongside an AI-assisted post-exploitation RAT built specifically for FortiGate. CISA added CVE-2025-25249 to its Known Exploited Vulnerabilities catalog on 2026-09-09: an unauthenticated heap overflow in the CAPWAP daemon that FortiOS and FortiSwitchManager use to manage wireless access points. SOCRadar reports a likely Russian-speaking operator has exploited it since at least July 2026 against over 30,000 FortiGate IPs, dropping PivotC2, an AI-assisted RAT that harvests device credential stores. →
Proofpoint documents BlueMoon, a newly named exploit kit chaining a Chrome V8 JIT type-confusion bug (CVE-2026-85046) with an uncredentialed V8 sandbox escape and a Windows kernel ALPC/WNF heap-overflow local-privilege-escalation flaw (CVE-2026-85880) into a single click-to-SYSTEM chain (Proofpoint, 2026-09-08). The V8 bugs were a patch-gap zero-day: "the change containing the fix for CVE-2026-85046 was committed on 7 August 2026 but was not rolled into the general stable Chromium build until 3 September 2026" (Proofpoint, 2026-09-08), a nearly four-week window during which the public upstream diff let an exploit developer reverse-engineer and weaponize the bug before Chrome's stable channel shipped it; CVE-2026-85880 was separately patched by Microsoft as part of its September 2026 Patch Tuesday updates (The Hacker News, 2026-09-09); the referenced 2026-09-09 Windows entry covers Microsoft's own MSRC confirmation that it was exploited in the wild. After the browser-side chain achieves code execution and escapes the renderer sandbox, a reflectively loaded DLL fingerprints the host to decide whether to run the kernel LPE against a specific list of Windows builds, Proofpoint's own table names Windows 10 1809/2004/20H2/21H1/21H2/22H2, Windows 11 21H2's initial release build, and Server 2019/2022, a wider list than Microsoft's own advisory for this CVE, which describes the legacy line only and states it does not affect Windows 11 (Contradiction, unresolved here), then a process-injection stub runs an operator-supplied command inside the Chrome broker process, by default a plain curl download-and-execute, a deliberately crude step Proofpoint reads as evidence the developer traded stealth for speed. Four distinct espionage clusters adopted the identical kit within days of each other, each with its own delivery and payload: TA412/APT31 (from 2026-08-28) used student-internship and academic-conference spearphishing against US NGOs, mining and commodity-trading firms to install a malicious Chromium extension disguised as "Google Gemini" (GemStone), using an HMAC-forgery technique, named GhostChrome-X by outside researchers (The Hacker News, 2026-09-09), against Chrome's Secure Preferences integrity check so the extension survives the browser's own unauthorized-extension protection; GemStone keylogs, steals cookies/session storage, screenshots on keyword match and polls its C2 every 30 seconds to 60 minutes. UNK_LateNight (from 2026-09-02) targeted US aerospace/defense firms with B2B/RFQ lures to sideload the ShadowPad backdoor via a scheduled task. UNK_DoubleCheck (from 2026-09-02) phished a Vietnamese manufacturer from a compromised Southeast Asian government mailbox, obfuscating its loader and staging a second DLL from a Cloudflare R2 bucket. UNK_QuietRacket (from 2026-09-03) targeted government, consulting and financial-sector organizations in Indonesia and Singapore with conference-themed lures, resolving C2 entirely through DNS-over-HTTPS TXT-record lookups to a Cloudflare Worker. A Proofpoint researcher assessed the near-identical, simultaneous adoption as deliberate distribution rather than independent discovery: "there's no way that this is parallel development. The code is practically identical, even the variable naming, the commentary. It's the same kit. One hundred percent" (Mark Kelly, Proofpoint, via The Record, 2026-09-09). Patching Chrome and Windows closes the entry vector but removes nothing already installed, the GemStone extension, ShadowPad's DLL-sideload persistence, and the other clusters' scheduled tasks all survive a patch untouched.
Triage: a process tree rooted at the browser (browser → command shell → curl or a download utility → a newly dropped executable) is the chain's own crude final stage and a strong discriminator on its own; a scheduled task created immediately following a browser-initiated download narrows it further, since legitimate browser activity does not normally create scheduled tasks.
The change containing the fix for CVE-2026-85046 was committed on 7 August 2026 but was not rolled into the general stable Chromium build until 3 September 2026.
There’s no way that this is parallel development. The code is practically identical, even the variable naming, the commentary. It’s the same kit. One hundred percent.
Check Point published two Critical-severity advisories (last modified 2026-09-09) for its VPN certificate-handling code, both triggered during certificate processing before authentication completes and both discovered internally with no external researcher credited (Check Point, advisory sk1000118, 2026-09-07; sk1000117, 2026-09-07). CVE-2026-85103 (CVSS 9.8) is "a heap overflow in the VPN certificate ASN.1 decoding flow" that "may allow a remote attacker to remotely execute arbitrary code on the management and Security Gateway" (Check Point, sk1000118). CVE-2026-85102 (CVSS 9.8, CWE-295 improper certificate validation) is an authentication-bypass-to-RCE in Remote Access and Site-to-Site VPN negotiation: "improper validation of certificate data during VPN negotiation may allow an unauthenticated remote attacker to execute arbitrary code on the Security Gateway" (Check Point, sk1000117), reachable against the Security Gateway and Spark Firewall. Affected: R81.20, R82, R82.10, and the end-of-support R80/R80.10/R80.20/R80.30/R80.40/R81/R81.10 lines and their .x builds; R82.20 is confirmed not affected. "Both vulnerabilities were discovered internally by Check Point, and there are no reports of active exploitation as of September 9, 2026" (Forkast News, 2026-09-09); this is a distinct certificate-processing defect from the June 2026 IKEv1 key-exchange flaw (CVE-2026-50751) already on CISA KEV. Fix is delivered via Check Point LivePatch Take 24 (automatic if enabled) or Jumbo Hotfix Accumulator (R82.10 Take 44+, R82 Take 126+, R81.20 Take 166+), plus dedicated Spark Firewall builds (R82.00.10 Build 2325+, R81.10.17 Build 4968+). No workaround exists for the locally-managed Spark Firewall; for Site-to-Site VPN the only interim mitigation is disabling implied VPN rules and manually restricting UDP/500 and UDP/4500 to specific peer IPs, which does not apply to Remote Access VPN.
A heap overflow in the VPN certificate ASN.1 decoding flow may allow a remote attacker to remotely execute arbitrary code on the management and Security Gateway.
Improper validation of certificate data during VPN negotiation may allow an unauthenticated remote attacker to execute arbitrary code on the Security Gateway.
SAP's 8 September 2026 Security Patch Day fixed CVE-2026-44756 ("OVERPASS", CVSS 10.0) and CVE-2026-58240 ("S4GET", CVSS 9.8), both discovered and responsibly disclosed by Onapsis Research Labs, both remotely exploitable pre-authentication (CERT-EU, advisory 2026-011, 2026-09-09). OVERPASS is a memory-corruption flaw in the SAP kernel's processing of the Extended Passport, a tracing structure attached to requests and parsed before session authentication; because the handling code is shared, the flaw is reachable via three independent unauthenticated routes, the Internet Communication Manager/Web Dispatcher (HTTP/HTTPS, Fiori/WebGUI/APIs), the SAP Dispatcher (the SAP GUI logon protocol), and RFC connections between systems, with a single crafted request corrupting memory to reach arbitrary OS command execution as the account that owns the SAP installation (CERT-EU, 2026-09-09). Onapsis's own internet-wide fingerprinting found more than 10,000 unique internet-facing IPs presenting an SAP web interface, a figure it calls conservative since it structurally undercounts the SAP Web Dispatcher, which returns no distinguishing banner (Onapsis, 2026-09-09). S4GET is a distinct logic flaw in the SAP NetWeaver Message Server (kernel lines 9.16-9.20, native to S/4HANA and S/4HANA Cloud Private Edition) reachable through the same public port every SAP GUI client connects to: a crafted packet gets an arbitrary IP address accepted as a trusted internal node, and the Message Server propagates that false trust across the cluster so the attacker can register with the Gateway as internal and invoke RFC-callable programs to reach code execution as <sid>adm on every application server; "exploitation requires no credentials, no certificate, and no pre-existing misconfiguration" (Onapsis, 2026-09-09). Because the flaw abuses the Gateway's trust-membership decision rather than its ACLs, the standard secinfo/reginfo/ms/acl_info hardening does not intercept it. Neither flaw is confirmed exploited as of publication, but Onapsis notes SAP patches have historically been reverse-engineered into working exploits within 72 hours, as happened with the RECON vulnerability (CVE-2020-6287), and that window keeps shrinking with AI-assisted tooling, while a comparable pre-auth SAP disclosure (CVE-2025-31324) became 2025's most-exploited CVE by Mandiant's count (Onapsis, 2026-09-09). Fixed via SAP Security Note 3747649 (OVERPASS, a single kernel patch closing all three routes, with an HTTP-only interim workaround in Note 3756304) and Note 3759472 (S4GET, kernel patch levels 9.16 PL100/9.18 PL32/9.19 PL17/9.20 PL7).
Triage: an SAP Gateway or Message Server accepting a new application-server registration from an IP address that has never previously registered, or a burst of RFC-callable external-program invocations immediately following such a registration, is the S4GET trust-abuse pattern; normal application-server registration happens only at planned system startup, not ad hoc.
A targeted search using high-fidelity fingerprints identifies more than 10,000 unique Internet-facing IP addresses presenting an SAP web interface reachable from the public Internet, and that figure is conservative.
Exploitation requires no credentials, no certificate, and no pre-existing misconfiguration. A successful attack yields full remote code execution as <sid>adm, the OS-level user that runs SAP, on every application server in the cluster.
Google's Chrome 153 stable release (2026-09-08, versions 153.0.8010.36/.37 Windows/Mac, 153.0.8010.36 Linux) fixes 230 security bugs, including CVE-2026-87491, an out-of-bounds write in V8 that Google confirms is being exploited: "Google is aware that an exploit for CVE-2026-87491 exists in the wild" (Google, via Help Net Security, 2026-09-09). NVD describes the mechanism as allowing "a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page" (NVD, via The Hacker News, 2026-09-09), user interaction (visiting or being served the page) is required, but no authentication or special access. ENISA's EUVD records a CVSS 3.1 base score of 8.8 (ENISA EUVD, 2026-09-09); Google has disclosed no detail on the exploitation vector, victims, or actor, consistent with its practice of withholding detail until most users have updated. CERT-FR and NCSC-NL both independently issued advisories within a day of release ("Google reports that the vulnerability tracked as CVE-2026-87491 is being actively exploited," translated from Dutch, NCSC-NL, advisory NCSC-2026-0354, 2026-09-09), and CISA added the CVE to KEV the same day (CISA, 2026-09-09), with a due date of 2026-09-23 (CISA KEV catalog, 2026-09-09). This is the seventh Chrome zero-day Google has confirmed under active exploitation in 2026; every Chromium-derived browser (Edge, Brave, Opera, Vivaldi) inherits the same V8 engine and needs the equivalent update.
Google is aware that an exploit for CVE-2026-87491 exists in the wild.
Google (via Help Net Security)
Out-of-bounds write in V8 in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.
NVD (via The Hacker News)
Google reports that the vulnerability tracked as CVE-2026-87491 is being actively exploited.
CISA added CVE-2025-25249 to its Known Exploited Vulnerabilities catalog on 2026-09-09: a heap-based buffer overflow in the cw_acd CAPWAP daemon that FortiOS and FortiSwitchManager use to manage wireless access points, listening unauthenticated on UDP 5246 (CISA, 2026-09-09). SOCRadar's Threat Research Unit reports, with high confidence, that a likely Russian-speaking financially motivated operator has exploited the flaw since at least July 2026, targeting more than 30,000 FortiGate IP addresses and infecting 178 devices (SOCRadar, 2026-09-08). The exploit fingerprints a target's CAPWAP Discovery Response to leak memory pointers and defeat ASLR, matches the reported hardware/software revision against a hardcoded table of thirteen FortiGate and two FortiAP models on FortiOS 7.4.0-7.4.8, then grooms and overflows the daemon's heap-chunk pool via crafted CAPWAP messages to redirect execution (SOCRadar, 2026-09-08). Successful exploitation drops PivotC2, an AI-assisted Node.js RAT purpose-built for FortiGate post-exploitation that maintains a persistent multiplexed TLS channel, supports interactive shells and SOCKS5/HTTP tunneling, and (via an autonomous mode) harvests FortiGate configuration files and encrypted credential stores (VPN PSKs, SSL-VPN and LDAP bind credentials, admin accounts) using a device-specific key pulled from the device's own sync file (SOCRadar, 2026-09-08). In two confirmed US intrusions, operators pivoted further with reverse-SSH relays, network scanning, RDP-enablement registry edits for pass-the-hash, a PowerShell script that downloads and XOR-decrypts a payload before injecting it into svchost.exe via OpenProcess/VirtualAllocEx/WriteProcessMemory, and Exchange mailbox exfiltration to attacker-controlled cloud storage (SOCRadar, 2026-09-08). Affected: FortiOS 6.4 through 7.6.3, FortiSwitchManager 7.0-7.2.6, and FortiSASE 25.1.a.2/25.2.b; fixed in FortiOS 7.6.4/7.4.9/7.2.12/7.0.18 and FortiSwitchManager 7.2.7/7.0.6, with no confirmed fixed FortiSASE build in the sources reached this run.
Triage: an unexplained outbound TLS connection from a FortiGate management interface to a non-Fortinet destination, sustained over hours with periodic small keepalive-sized packets, is the multiplexed C2 channel's signature; normal FortiGate outbound traffic is FortiGuard update/telemetry to Fortinet's own infrastructure, not a persistent operator-controlled tunnel.
The SOCRadar Threat Research Unit (STRU) identified, with high confidence, exploitation of CVE-2025-25249, a heap-based buffer overflow vulnerability in FortiOS and FortiSwitchManager cw_acd daemon.
Active exploitation has been observed since at least July 2026 and is still ongoing.
the actors highly likely leveraged AI to develop the RAT
CISA added CVE-2026-20079 to its Known Exploited Vulnerabilities catalog on 2026-09-09, confirming active exploitation Cisco itself had not previously reported ("not aware of any public announcements or malicious use"). Status moves from patch-available-only to confirmed exploited; the hot fixes and compromise check this entry already describes are unchanged, but the compromise check is now the do-now priority rather than a precaution.
CISA added CVE-2026-20079 to its Known Exploited Vulnerabilities catalog on 2026-09-09, with a remediation due date of 2026-09-12 for federal civilian agencies. This confirms active exploitation that Cisco's own advisory had not reported as of its last revision, and reverses the "not aware of any malicious use" framing this entry's main analysis carried. The compromise check and hot-fix guidance above are unchanged; any FMC that has been network-reachable since 2026-03-04 and has not yet had the compromise check run should be treated as a priority, not a precaution.
The 2026-09-08 update stated CVE-2026-19490 had not been added to CISA's KEV catalog; CISA added it on 2026-09-09 (due date 2026-09-12). This is a listing/bookkeeping addition (the CVE was already recorded as exploited before this listing) so no exploitation-status narrative changes; the stale sentence is corrected in place. Also added the missing FIRST.org EPSS citation for CVE-2026-19490 (score unchanged, 0.0337, verified against FIRST.org); the entry's only prior EPSS source was scoped to CVE-2026-19489.
CISA added CVE-2026-19490 to its Known Exploited Vulnerabilities catalog on 2026-09-09, with a remediation due date of 2026-09-12 for federal civilian agencies. This CVE was already recorded here as exploited before this listing, so the addition is a jurisdiction-agnostic confirmation of what this entry already stated rather than a new exploitation-status development.
LevelBlue SpiderLabs independently reproduced and analysed all four PoCs, supplying mechanism-level detail the original vendor statements lacked: HardBreacher's session-namespace symlink DLL-load-path hijack with parent-PID spoofing, PrettyPrague's aswSnx IOCTL abuse to dump and offline-decrypt the SAM database via a CMSTPLUA UAC bypass, and a reparse-point/oplock mechanism for FalconFlank, which LevelBlue's own lab testing found CrowdStrike's cloud ML detection caught and quarantined, preventing the final step in that test run. LevelBlue also independently characterises GreenSection as a shared-memory-section trust-boundary finding with no demonstrated privilege escalation, a narrower claim than the original report's "memory-corruption bug" framing. Credibility moves from 2 to 1 on this independent confirmation. LevelBlue's own Key Takeaways further state that both FalconFlank and PrettyPrague have since received vendor remediation, though it names no specific patch version or date for either, superseding this entry's original "no fix"/"still developing a patch" framing for both, which the title, headline, summary, tags, actions and body are corrected to reflect.
LevelBlue SpiderLabs independently reproduced and analysed all four PoCs, adding mechanism-level detail none of the original vendor statements carried. HardBreacher: "every Windows logon session has a private object directory inside the kernel's namespace – \Sessions\0\DosDevices\{AuthId}\, and any standard user process can place symbolic links inside their own session's directory without any special privilege" (LevelBlue SpiderLabs, 2026-09-09); the exploit builds a fake filesystem tree redirecting Kaspersky's avpuimain.dll load path to an attacker DLL, then spawns avpui.exe suspended with the redirect live and resumes it so the OS loader loads the malicious DLL, additionally using NtCreateUserProcess with the parent-process attribute set to explorer.exe so EDR process-tree telemetry records Explorer, not the real caller, as the parent, the payload then hides and terminates the product's user-facing notification process from inside. PrettyPrague: "the vulnerability is that a standard user process can send IOCTL 0x82AC0054 directly to the aswSnx driver to request that a chosen executable be run inside the sandbox" (LevelBlue SpiderLabs, 2026-09-09), where the sandbox's virtualized SAM-hive copy carries none of the real SAM's ACLs; the exploit races the sandbox's own cleanup to copy the hive out via a rolled-back Kernel Transaction Manager transaction, decrypts NTLM hashes offline using the LSA boot key, and reaches a SYSTEM context through a CMSTPLUA COM-interface UAC bypass to log in as every local admin, reverting the passwords afterward. FalconFlank's precondition is narrower than the original report suggested: "for CrowdStrike clients to be susceptible to this local privilege escalation vulnerability, an endpoint must be assigned to a Prevention Policy with the 'Microsoft Office file malicious macro removal' setting enabled. This vulnerability does not impact CrowdStrike Falcon Government clients" (LevelBlue SpiderLabs, 2026-09-09), and in LevelBlue's own lab testing, CrowdStrike's cloud-based ML engine (detection logic OnWriteOfficeMacroMLMedium) identified and quarantined the malicious DLL the exploit stages, preventing the final privilege-escalation step in that test run, a detection outcome that limits, without eliminating, the real-world exploitability the initial disclosure implied. LevelBlue independently characterises GreenSection differently from the original report's "memory-corruption bug that crashes any application using Vulkan or OpenGL": its own analysis describes a standard user opening, mapping, modifying and restoring an NVIDIA global shared-memory section, with no privilege-escalation or code-execution primitive demonstrated, a narrower, trust-boundary-design finding rather than a crash bug, though LevelBlue did not claim to have tested for a crash condition either.
LevelBlue's closing assessment also updates the patch picture this entry originally carried: "PrettyPrague demonstrated the most significant security impact prior to remediation, while HardBreacher highlighted opportunities for security-product abuse and evasion. GreenSection is primarily a security design concern, and FalconFlank's operational relevance was limited both by its configuration-dependent exposure and by rapid vendor remediation" (LevelBlue SpiderLabs, 2026-09-09); both FalconFlank and PrettyPrague are now reported remediated, which supersedes the "no fix"/"still developing a patch" status this entry carried at disclosure. The Hacker News's own update to its original report names a specific fix: "as of September 4, 2026, Gen has released a patch for the following versions of Avast Antivirus for Windows - 26.7.11086, fix version 992 [and] 26.8.11125, fix version 993" (The Hacker News, 2026-09-03). No source reached for this entry names a specific fixed CrowdStrike Falcon build or date for FalconFlank; confirm current release status directly with CrowdStrike rather than treating this as a version-checkable patch.
The leak's national-security framing sharpens: a CDU defense-policy spokesperson states the published dataset includes civil-defense/total-defense emergency plans and barracks documents alongside the critical-infrastructure material already recorded, prompting the Bundeswehr's own operational command to join BSI's review. Separately, the Berlin district of Lichtenberg has refused to deploy CrowdStrike's Falcon Agent on its own servers over data-access and monitoring concerns, and Berlin's data protection commissioner has issued concrete victim guidance.
CDU defense-policy spokesperson Roderich Kiesewetter told Süddeutsche Zeitung "this data leak is of grave scope and endangers our national security" (translated from German), naming civil-defense and total-defense emergency plans and barracks documents as part of the published dataset alongside the critical-infrastructure material already recorded here; Germany's Bundeswehr Operative Führungskommando and the Nationales Cyberabwehrzentrum have joined BSI in reviewing the security fallout (heise online, citing Süddeutsche Zeitung, 2026-09-07). Separately, the Berlin district of Lichtenberg has refused to deploy CrowdStrike's Falcon Agent on its own servers: "in an internal letter, he cites concerns, according to rbb, about near-unlimited data access, possible disruption to specialised administrative applications, and remaining monitoring risks for staff" (translated from German), while the district states it has found no evidence of intrusion on its own systems and is demanding the Senate assume full responsibility and cost for the response (heise online, citing rbb24, 2026-09-07). Berlin's data protection commissioner Meike Kamp has now issued concrete guidance for potentially affected individuals: "change passwords, closely monitor account activity, and increased scepticism toward phishing emails" (translated from German) (heise online, citing Meike Kamp, 2026-09-07).
GreyNoise documents an AI-agent-orchestrated mass-exploitation campaign against this chain beginning 31 August 2026, using hundreds of AI agents to opportunistically compromise 440 PaperCut instances across 395 organizations in 48 countries, reaching domain admin against 12 of them in as little as five minutes via LSASS credential harvesting, the 2021 noPac flaws, or a PaperCut host running on the domain controller itself, all finishing with a DCSync-based NTDS.DIT credential dump.
GreyNoise's Global Observation Grid documents an AI-agent-orchestrated exploitation campaign against this chain
beginning 31 August 2026, run by a likely Russian-speaking operator already tracked since July 2026 for attacks on
Palo Alto, Ubiquiti, Citrix, SonicWall and Proxmox VE targets
(GreyNoise, 2026-09-09). The
operator built and tested both CVEs' exploits in a self-hosted PaperCut/Active Directory lab, sourced target lists
via the Netlas.io scanning service, then deployed hundreds of AI agents, built on OpenAI's Codex harness paired
with a DeepSeek model, to opportunistically "compromise at least 440 instances of PaperCut MF/NG hosted by 395
identified victim organizations in 48 countries"
(GreyNoise, 2026-09-09). GreyNoise
reports the adversary "went from an empty workspace to first achieving RCE against a real victim in just under
four hours, first domain admin in an additional two hours, and once the full campaign launched, compromised at
least 11 organizations in 26 seconds"
(GreyNoise, 2026-09-09), with one
US high school reaching full domain admin in seven minutes from initial access. Domain admin was ultimately reached
against only twelve of the 395 compromised organizations, "GreyNoise observed the adversary achieved domain admin
against only 12 victim organizations"
(GreyNoise, 2026-09-09), via three
paths: LSASS credential harvesting for pass-the-hash against the domain controller when the PaperCut host was
domain-joined; the 2021 noPac flaws (CVE-2021-42278/CVE-2021-42287) where those remained unpatched; or directly
adding a new account to Domain Admins when the PaperCut host itself ran on the domain controller or under a
domain-admin service account. All three paths finished with a DCSync-based full NTDS.DIT credential dump; Cloudflare's
WAF defeated the adversary against at least one targeted instance. This delta is reported by GreyNoise alone; a
second independent source had not corroborated it as of this update.
After confirming Chrome ≥152.0.7977.82 and the September Windows cumulative update are deployed fleet-wide, separately audit installed Chromium extensions requesting broad host/tab/storage permissions and any browser-associated scheduled task created in the days before patching; neither the malicious GemStone extension nor the kit's scheduled-task persistence is removed by the OS/browser patch.
Apply LivePatch Take 24 or the appropriate Jumbo Hotfix Accumulator to every Check Point Security Gateway, Management Server and Spark Firewall now; no workaround exists for Remote Access VPN or the locally-managed Spark Firewall short of patching.
Apply SAP Security Notes 3747649 (OVERPASS) and 3759472 (S4GET) to every SAP kernel-based system now, Onapsis found over 10,000 internet-facing SAP interfaces, and notes SAP patches have historically been reverse-engineered into working exploits within 72 hours, a window that keeps shrinking with AI-assisted tooling.
Update Chrome, Edge and every other Chromium-based browser in the fleet to ≥153.0.8010.36 now; this is the seventh actively-exploited Chrome zero-day patched in 2026, and Google has disclosed no interim mitigation short of the update.
Patch every internet-facing FortiGate/FortiSwitchManager to the fixed builds now, and on any device that exposed CAPWAP (UDP 5246) to an untrusted network before patching, rotate VPN PSKs, SSL-VPN and LDAP bind credentials and admin passwords rather than relying on the patch alone; PivotC2's autonomous mode is built to harvest exactly those credential stores.
2026-09-10T0410Z-intel· Sonnet 5 · window 24 h · 5 entries published
Verification & coverage notes
Intraday fire (gap_hours 10.72, window_hours 24 floor). Mechanical KEV sweep (tools/kev_window_diff.py) flagged 2 not-yet-covered CISA KEV additions in-window (CVE-2025-25249 Fortinet, CVE-2026-87491 Chrome); both fully researched and published as new entries. 5 new entries, 3 changelog updates.
borderline-drop: Veradigm (formerly Allscripts) vendor-API credential breach, US-domiciled healthcare-technology vendor, disputed scale (victim's own SEC 8-K says "a small number of customers" against the actor's claimed 3.5M records); the actor (actor:thegentlemen) carries an established European leak-site pattern and an uncorroborated current Swiss claim (Ixa Systems SA, tracked in coverage_backlog.md), but neither that actor-nexus argument nor the vendor-API-scoping lesson (standard practice, not a novel TTP) clears the stricter out-of-nexus breach gate on their own. Relevance-doubt resolves toward drop (v4.2).
borderline-drop: Mantax Otax, Indonesian consumer Android ransomware/spyware hybrid (Zimperium zLabs, single-source). No Swiss/EU/public-sector nexus; the constituency's device fleets are MDM-managed, making a sideload-only consumer-Android technique class a poor transferability fit. Does not clear PD-11(d).
Coverage backlog (state/coverage_backlog.md) worked this run: Boston Scientific struck (operationally concluded, "fully restored," no mechanism ever disclosed across 10 checks over two weeks); Zurich verdict, inside-it.ch Insel Gruppe, Ixa Systems SA, UICC (Krybit), Kairos/Ville de Libercourt, VMware VMSA-2026-0007, and the Spring Ring NTLM-relay row all re-checked with no change; dated notes appended to each. Three new backlog rows opened: Medela AG (ShinyHunters claim, Swiss home-region, uncorroborated), reichenau.at (SafePay claim, Austrian municipality, uncorroborated), and Ville du Tampon (France, victim-confirmed incident, no mechanism disclosed).
Dedup: 2026-09-10/bluemoon-exploit-kit-four-state-actors-chrome-windows-chain shares CVE-2026-85046 with 2026-09-04/cve-2026-85046-chrome-v8-type-confusion-exploited and CVE-2026-85880 with 2026-09-09/windows-september-2026-two-exploited-lpe-zero-days-kev, both declared in references[] as a genuinely distinct finding (a named exploit kit + four actor clusters) building on the covered CVEs, not a duplicate.
Watchlist: no watchlists configured (documented no-op on all four domains).
Essential-coverage: cisa-advisories 403'd for a 2nd consecutive run (transport block, never demotes; tools/fetch_source.py bridge already in use).
Coverage gaps: ccb-belgium (fetched, advisory list not confirmed present/absent); reliaquest, group-ib, ibm-xforce (all reached, newest content outside the 24h window); ransom-isac, venarix, zaufana-trzecia-strona, cyberinsider (all reached, no in-window content).