ENDLESSDOORS

2026-W32 looking ahead — items already in motion: a NIS2 law in force in six days, a PAM appliance whose full exploitation detail is due in September, five products that will never be patched, and a federal ISMS deadline five months out

Items already in motion at the close of ISO week 2026-W32, each with a source and a date. None of these is a prediction.

Dated obligations.

• 15 August 2026 — the Netherlands' Cyberbeveiligingswet enters into force, together with the companion critical-entities resilience law, imposing registration, duty-of-care, incident-notification and board-accountability duties on more than 8,000 organisations across 18 sectors, with registration in NCSC-NL's national entity register mandatory from that date (Rijksoverheid, 2026-07-07). Relevant to anyone with Dutch entities, suppliers or public-sector counterparts, whose notification behaviour changes on that date.
• 11 September 2026 — the Cyber Resilience Act's reporting obligations begin, ahead of the regulation's principal obligations in December 2027. 13 September 2026 — ENISA's consultation on the draft EU Managed Security Services certification scheme closes, two days later; providers delivering services under the EU Cybersecurity Reserve would need that certification within two years of the scheme's entry into force, which makes it a procurement gate rather than a voluntary mark. Both were established in prior weekly coverage and neither date has moved.
• 2 December 2026 — two new prohibited AI practices apply under the AI Act as amended, and 2 December 2027 / 2 August 2028 are the new application dates for high-risk obligations under Annex III and Annex I respectively, following Regulation (EU) 2026/1744 (EUR-Lex, 2026-07-24). Any readiness plan written against 2 August 2026 for Annex III systems is now diarised to the wrong date.
• 1 January 2027 — Swiss federal administrative units must have built their ISMS. The Informationssicherheitsverordnung requires the administrative units under its Article 2(1)(c) to build their information-security management system within three years of the ordinance's entry into force, and the ordinance entered into force on 1 January 2024 (Fedlex, ISV SR 128.1). Roughly five months remain. The addressee is the federal administration itself; commentary that presents this as a general critical-infrastructure obligation is reading it more broadly than the text supports.

Disclosure and exploitation clocks.

• September 2026 — full technical details of the WALLIX Bastion authentication bypass are due. WALLIX states that the reporting researchers intend to publish the complete write-up of the CVSS 4.0 base 10.0 flaw that gives an unauthenticated caller full product-administrator control of the appliance — its credential vault and session recordings included — in September (WALLIX, 2026-07-20). Bastion 12.3.7 and 12.4.1 and later are patched, per the CERT-FR advisory that relayed the bulletin (CERT-FR, 2026-08-06). This is a dated window for remediating quietly, not a current threat.
• Cl0p's Windchill and FlexPLM listings have still not begun. Research re-checked this week found no leak-site listing for that campaign, leaving affected organisations in the interval between exfiltration and publication — the status a prior weekly recorded, unchanged.

Flaws with no fix coming. Five items from this week's coverage will not be resolved by waiting for a vendor, and each therefore converts into an architecture or lifecycle decision:

• Tobit TeamDavid — 22 CVEs bounded at "Rollout 524" with no fixed release named, against roughly 12,000 internet-facing instances, and researchers reporting that both they and the coordinating national cyber security centre were left without a vendor response (InfoGuard Labs, 2026-08-07).
• Flowise — three CVEs assigned days after the vendor announced it is winding down; self-hosted operators own the compensating controls.
• Zbtlink routers (ENDLESSDOORS) — a factory-shipped root backdoor on twenty models, where the discloser's remediation is device replacement.
• CPDLC over ATN-B1 — five flaws that are properties of the standard, with CISA recording the remediation category as none-available.
• Check Point's end-of-support management trains — R80 through R81.10 are listed as affected by this week's unauthenticated management-authentication bypass with no fix on offer.

In development, no date. NCSC UK confirms it is working with international partners on a reference architecture for forensic observability in network appliances, intended to give vendors something concrete to build to (NCSC UK, 2026-07-29). It is not published, and no publication date is stated. Separately, the Metabase SQL-injection zero-day exploited this week still has no CVE identifier assigned, so it will not reach any process that waits for one.

Builds on: 2026-08-09/wallix-bastion-rest-api-unauth-admin-cvss10 · 2026-08-09/teamdavid-tobit-22-cves-unauth-mailbox-takeover-dach · 2026-08-08/flowise-three-cves-vendor-sunset-no-fix-coming · 2026-08-06/endlessdoors-zbtlink-router-factory-shipped-root-backdoor · 2026-08-08/cpdlc-atn-b1-five-protocol-flaws-no-mitigation-available · 2026-08-05/check-point-cve-2026-18574-management-auth-bypass · 2026-08-09/metabase-unauth-sqli-zeroday-exploited-framework-tally

Critical-infrastructure exposure this week sat in things no IT patch cycle owns — a carrier link, a factory-shipped router backdoor, an unauthenticated aviation protocol — and four national cyber agencies published the isolation method that answers exactly that class

Four separate critical-infrastructure findings landed across 2026-W32 and none of them is fixed by a patch cycle, because in each case the vulnerable component is a device class or a communications link that the IT estate does not own, update, or in some cases even inventory.

CERT Polska supplied the incident evidence. Its follow-up forensic report on the 29 December 2025 attacks on Poland's energy sector traces an intrusion from a compromised wind-farm substation, over SSH through a cellular router, into the distribution system operator's private APN — a mobile network shared by the wind farm and a combined heat and power plant — and from there into a controller whose WAN-side interface answered on factory credentials, ending with three PLCs in STOP mode and a steam turbine offline (CERT Polska incident follow-up report, 2026-08-08). The published summary is explicit about the enabling condition: "the attack was made possible, among other factors, by a misconfiguration that allowed arbitrary devices within the private APN network to communicate with one another" (CERT Polska, 2026-08-08). A private APN is bought as a private network, appears on no external-attack-surface scan, and — as this case shows — can carry an attacker between two unrelated sites that merely share a carrier contract.

Two further disclosures move the vulnerable thing outside the software estate entirely. VulnCheck documented ENDLESSDOORS on 5 August, a pre-installed remote-access implant enabled by default on twenty Zbtlink router and CPE models including rebranded units sold through mainstream e-commerce: a customised build of an open-source remote-control tool, launched at boot by the vendor's own init script, masquerading as a kernel worker thread, which registers outbound to hardcoded hosts and passes whatever the server sends straight to a shell as uid 0 with no authentication of any kind (VulnCheck, 2026-08-05). Because this is a shipped component rather than a memory-corruption defect, VulnCheck's guidance is to replace the affected devices or at minimum place them behind strict egress control and treat their LAN as untrusted — and it did not notify the vendor, on the reasoning that there is no patch to coordinate. CISA's advisory ICSA-26-219-01 covers five vulnerabilities in Controller-Pilot Data Link Communications as implemented over ATN-B1, the worldwide standard for text instructions between air traffic control and the cockpit; all five are properties of the standard rather than one vendor's product, the link being clear-text and unauthenticated, and CISA records remediation as none-available while assessing exploitation unlikely outside a lab setting (CISA, 2026-08-07).

The published answer to this class arrived one week before the window, and had not been carried here. On 28 July, CISA, the Australian Signals Directorate's ACSC as lead author, the UK's NCSC and the Canadian Centre for Cyber Security jointly issued "CI Fortify — Advice for isolating vital systems," which "explains how organisations can isolate critical operational technology (OT) and supporting systems from other networks during cyber incidents or periods of increased cyber threat" (ASD ACSC, 2026-07-28). Two of its provisions read as though drafted against the Polish case. First, on carrier links: "CI operators must treat any carrier-provided service as untrusted and potentially hostile," with the corollary that operators should "not use encryption built into OT devices – always use a dedicated device to implement encryption over untrusted carrier links" (ASD ACSC, 2026-07-28). Second, on coupling: the guidance directs operators to build dedicated OT capability by eliminating cross-dependencies with non-OT systems, naming shared directory, name-resolution, address-assignment, virtualisation, certificate and time-synchronisation services as the usual silent links — the dependencies that decide, during an incident, whether the OT estate can actually be disconnected and keep running. CISA frames the purpose as maintaining "robust isolation and recovery plans so that essential services can continue under degraded conditions" (CISA, 2026-07-28).

Builds on: 2026-08-09/cert-polska-private-apn-pivot-into-ot-chp-plant-shutdown · 2026-08-06/endlessdoors-zbtlink-router-factory-shipped-root-backdoor · 2026-08-08/cpdlc-atn-b1-five-protocol-flaws-no-mitigation-available · 2026-08-05/thermo-fisher-genetic-analyzer-dna-file-integrity · 2026-08-09/thermo-fisher-genetic-analyzer-correction-patch-exists · 2026-08-06/water-plc-lockouts-twelve-states-named-utility-confirms

ENDLESSDOORS (CVE-2026-66747) — twenty Zbtlink router models ship from the factory with an unauthenticated root-command backdoor, and the discloser's remedy is replacement

VulnCheck published an analysis on 2026-08-05 of what it names ENDLESSDOORS, a remote-access implant pre-installed on twenty router and CPE models from Zbtlink (Shenzhen Zhibotong Electronics), including units sold under a rebranded name through mainstream e-commerce platforms (VulnCheck, 2026-08-05). The implant is a customised build of the open-source rctl remote-control tool. VulnCheck's framing is the point of the research: this is not a memory-corruption bug in a parser but a component in the vendor's product, started at boot by the vendor's own init script, shipped across twenty models (VulnCheck, 2026-08-05).

Operationally, the device registers itself outbound to hardcoded command-and-control hosts with a short unauthenticated message carrying a device-class label and the unit's MAC address, and from that point there is no handshake, no key exchange, no negotiation — whatever the server sends afterwards is handed to a shell and executed as uid 0, with a separate command spinning up an interactive reverse shell (VulnCheck, 2026-08-05). The implant hides in plain sight by taking the name of a kernel worker thread, which in a process listing sits alongside the genuine kernel threads it imitates (VulnCheck, 2026-08-05). Because control depends only on reaching the device's chosen server rather than on any credential, whoever controls that infrastructure — or anyone who takes it over — controls every unit that still calls home. VulnCheck's guidance is to segment or replace: for anything carrying real traffic it advises replacing the device, or at minimum moving it behind strict egress control and treating its LAN as untrusted, noting that disabling the init script with shell access still leaves you trusting the rest of an image that shipped the implant (VulnCheck, 2026-08-05). No vendor remedy exists to weigh against that: VulnCheck states it did not notify Zbtlink, because there is no patch to coordinate and an early warning would reach whoever operates the command infrastructure rather than the device owners (VulnCheck, 2026-08-05).

Triage: routers legitimately make outbound connections for firmware update checks, NTP and vendor telemetry, so outbound-from-CPE alone is normal. The discriminators are that this connection persists as a long-lived channel rather than completing a transaction and closing, that the traffic is command-carrying in both directions rather than a fetch, and that it targets a fixed vendor-independent host on a high port rather than a documented update endpoint on standard ports.