Weekly Threat Bulletin – August 12th, 2026

Critical macOS RCE Vulnerability Allows Attackers to Gain Root Access Without Password

Apple has released emergency security updates for macOS Tahoe 26.6.1, Sequoia 15.7.9, and Sonoma 14.8.9 to address CVE-2026-65400, a critical pre-authentication remote code execution (RCE) vulnerability in Screen Sharing that allows unauthenticated remote attackers to execute arbitrary code and access files with root-level privileges. Discovered by researcher Ryan Dowd, the flaw resides in the Secure Remote Password (SRP) authentication handling of `screensharingd`, where a faulty frame-length validation path returns a stale success state, causing the service to treat an unauthenticated connection as legitimately authenticated. Unlike the previously disclosed CVE-2026-43760, which required authentication, CVE-2026-65400 requires no valid credentials, and resulting sessions lack standard cryptographic protections, enabling arbitrary file read/write operations and full RCE with persistence via LaunchDaemons or modified shell startup files. The impact is further elevated because the helper process `SSFileCopySender` runs with root privileges and holds the private Full Disk Access entitlement (`kTCCServiceSystemPolicyAllFiles`), bypassing macOS Transparency, Consent, and Control (TCC) protections. Because configuration hardening—such as disabling legacy VNC or removing approved users—fails to block this pre-authentication exploit, organizations must immediately apply the patches or disable Screen Sharing entirely. Security teams can detect potential exploitation by monitoring Endpoint Security events for anomalous Screen Sharing sessions where the authentication type is recorded as `SRP` instead of `RSA-SRP` and the username is logged as `root`, or by tracking `SSFileCopySender` launching from the `screensharingd` bundle with arguments like "0 80" followed by unusual filesystem activity.

Severity: Critical

Threat Details and IOCs

Mitigation Advice

• Prioritize and immediately deploy macOS updates Tahoe 26.6.1, Sequoia 15.7.9, and Sonoma 14.8.9 to all managed Mac endpoints.
• On macOS systems where patches cannot be immediately deployed, disable the Screen Sharing service entirely via System Settings or a mobile device management (MDM) profile.
• Configure perimeter and internal firewalls to block all inbound traffic to TCP and UDP port 5900 (used by Screen Sharing/VNC) on macOS devices, especially from the internet.
• In your SIEM or EDR platform, create a detection rule to alert on macOS Endpoint Security events where a Screen Sharing connection has 'authentication_type' set to 'SRP' and either 'session_username' or 'authentication_username' is 'root'.
• In your EDR platform, create a detection rule to alert on the 'SSFileCopySender' process being launched by 'screensharingd' with suspicious command-line arguments, such as '0 80'.

Compliance Best Practices

• Implement and maintain a comprehensive asset inventory system that automatically tracks all macOS endpoints, their OS versions, and the status of key services like Screen Sharing.
• Establish a formal patch management policy with defined service-level agreements (SLAs) for applying security updates based on severity, ensuring 'critical' vulnerabilities are addressed within 72 hours.
• Develop and enforce a standard security baseline for all macOS endpoints that disables non-essential services, including Screen Sharing, by default. Require explicit approval for enabling such services.
• Design and implement a network segmentation strategy that isolates user endpoint subnets from critical server environments and other sensitive network zones using firewalls and access control lists.
• Continuously evaluate and tune EDR detection rules for macOS to improve visibility into anomalous process execution, authentication patterns, and file system interactions, ensuring the capability to detect novel and future threats.

New WordPress Pre-Auth XSS Could Lead to PHP Code Execution - Patch ASAP

A high-severity pre-authentication reflected cross-site scripting (XSS) vulnerability, tracked as CVE-2026-64638 (CVSS score: 8.9), affects all WordPress versions from 4.7 through 7.0.2. The flaw stems from a parser discrepancy during failed login username sanitization, where a tag-like string containing whitespace after the opening bracket survives PHP's `strip_tags()` but is subsequently interpreted as valid HTML by ``wp_kses_post()`,` injecting malicious DOM elements into the failed-login page. These elements clobber the `ajaxurl` variable in `user-profile.js` and leverage WordPress's JSONP support to execute arbitrary JavaScript within the site's origin. By chaining this XSS with a Same Origin Method Execution (SOME) technique, an attacker can trick a logged-in administrator into approving an Application Password credential, which is then used via the REST API to upload a malicious plugin ZIP file and achieve remote PHP code execution. This vulnerability was patched on August 6, 2026, in WordPress version 7.0.3, with security fixes backported down to version 4.7.

Severity: Critical

Threat Details and IOCs

Mitigation Advice

• Update all WordPress instances to version 7.0.3 or the latest patched version available for your specific branch (4.7.x and newer).
• Verify that automatic background updates have successfully applied the WordPress 7.0.3 security release to all managed sites.
• Identify all WordPress sites running versions older than 4.7 and prioritize their immediate upgrade to a supported version or decommissioning.
• Review web server and WordPress logs for unusual failed login attempts, especially those containing HTML-like tags or unexpected characters in the username field, which could indicate exploitation attempts of CVE-2026-64638.

Compliance Best Practices

• Implement a policy requiring administrators to use a separate, non-privileged user account for daily tasks and only log into the administrator account when performing administrative functions.
• Deploy and configure a Web Application Firewall (WAF) to filter malicious inputs, including common XSS patterns, before they reach the WordPress application.
• Establish a formal asset management and patch management policy for all web applications, including a lifecycle plan to upgrade or replace software before it reaches end-of-life and falls outside of security support.
• Configure web server file permissions to prevent the PHP process from writing to the WordPress plugins directory, except during authorized update windows.
• Review the use of the 'Application Passwords' feature in WordPress and disable it if not required for business operations, or regularly audit created passwords and restrict the feature to only trusted users.

Critical Cisco IMC Vulnerability (CVE-2026-20200) Grants Root Access; Public PoC Available

Cisco has released security patches addressing a critical vulnerability, CVE-2026-20200 (CVSS score 9.8), in its Integrated Management Controller (IMC) that allows authenticated, low-privileged remote attackers to execute arbitrary commands as root via the web-based management interface. Discovered by Christoph Peil of NSIDE ATTACK LOGIC, this flaw affects Cisco UCS C-Series M7 and M8 Rack Servers in standalone mode and has a public proof-of-concept exploit named "CIMCown" available on GitHub. Because the IMC controls low-level functions like BIOS and SecureBoot, compromise allows persistent, deep system access below the operating system level. While no official workarounds exist, administrators are advised to apply the updates or temporarily disable the web interface and restrict management network access. Additionally, Cisco's August 5, 2026 advisory batch resolved several critical AI-discovered vulnerabilities in Cisco IOS XE (such as CVE-2026-20272 with a CVSS score of 9.8) and Cisco Catalyst SD-WAN (with CVSS scores of 9.9), though these currently have no known public exploits or active malicious exploitation.

Severity: Critical

Threat Details and IOCs

Mitigation Advice

• Identify and apply the security patch for CVE-2026-20200 to all vulnerable Cisco Integrated Management Controller (IMC) instances on UCS C-Series M7 and M8 Rack Servers.
• If immediate patching for CVE-2026-20200 is not possible, disable the web-based management interface (web UI) on all affected Cisco IMC instances.
• Identify and upgrade all network devices running vulnerable versions of Cisco IOS XE software to the recommended fixed releases.
• Identify and upgrade all on-premise or customer-managed devices running vulnerable versions of Cisco Catalyst SD-WAN software to the recommended fixed releases.

Compliance Best Practices

• Design and implement a dedicated, segmented management network for all infrastructure components, including server baseboard management controllers like Cisco IMC.
• Implement strict firewall rules and access control lists (ACLs) to ensure that only authorized administrator workstations can access the dedicated management network.
• Audit and enforce a principle of least privilege (PoLP) model for all administrative accounts on infrastructure management interfaces, ensuring users have only the minimum permissions required for their roles.

Zapscape (CVE-2026-64561): Guest-to-Host Escape in KVM/x86

Zapscape (CVE-2026-64561) is a guest-to-host escape vulnerability in the shadow MMU emulation of KVM/x86, specifically residing in the recursive zap path executed during shadow page reclamation. This use-after-free (UAF) vulnerability allows an attacker with guest kernel privileges to escape to the host and execute arbitrary commands with root privileges, posing a severe threat to multi-tenant x86 public clouds that support nested virtualization. The vulnerability affects Linux kernel versions spanning from commit `f95eec9bed76` (July 8, 2020) to `2abd5287f083` (July 21, 2026). A proof-of-concept (PoC) exploit targeting AMD SVM/NPT under QEMU TCG demonstrates how switching from long mode to PAE aliases a shadow page as both a child and a pinned root; subsequent memory accesses by an L2 guest trigger L0 quota reclamation and a recursive zap without a `root_count` guard, resulting in the UAF. On platforms like RHEL where `/dev/kvm` is world-writable, this vulnerability can also be leveraged for local privilege escalation (LPE) to gain root access on the host.

Severity: Critical

Threat Details and IOCs

Mitigation Advice

• Scan all virtualization hosts to identify systems running KVM on a Linux kernel version within the vulnerable range of f95eec9bed76 to 2abd5287f083.
• Apply the security patch containing commit 2abd5287f083 to all identified vulnerable KVM/x86 hosts.
• If immediate patching is not feasible, disable nested virtualization on all KVM/x86 hosts as a temporary mitigation.
• Review and change the file permissions for `/dev/kvm` on all KVM hosts to prevent access by unprivileged user accounts.

Compliance Best Practices

• Establish and document a formal policy for the regular, timely patching of all hypervisor kernels and virtualization software.
• Implement a security baseline configuration for all new hypervisor hosts that disables nested virtualization by default, enabling it only on a case-by-case basis with documented justification.
• Deploy and tune an Endpoint Detection and Response (EDR) agent on all hypervisor hosts to monitor for suspicious kernel activity and unauthorized file creation.
• Implement and enforce a Mandatory Access Control (MAC) policy, using SELinux or AppArmor, on all hypervisor hosts to contain processes and limit the impact of a potential VM escape.

TrueConf Server Vulnerabilities Exploited to Trojanize Client Installers With PhantomCore Backdoor

The Head Mare hacktivist group is actively exploiting two vulnerabilities, tracked as KLCERT-26-057 and KLCERT-26-058, in unpatched TrueConf video conferencing servers to deploy malicious backdoors. Affecting TrueConf Server versions prior to 5.3.9, 5.4.9, and 5.5.5, the attackers leverage the default open TCP port 4307 to connect without authentication, execute malicious scripts, escape the application sandbox, and escalate privileges to `NT AUTHORITY\SYSTEM`. Once administrative control is established, the threat actors replace the `\public\js\locale.php` file with a web shell to maintain persistent remote access, harvest sensitive data, and swap the legitimate TrueConf Client installer with a trojanized version containing the PhantomCore backdoor. Additionally, the attackers deploy the PhantomGraph backdoor—comprising the DLL files `SysExcSvc.dll` and `SysReadSvc.dll`—which abuses Microsoft OneDrive for command-and-control communications, dumps LSASS memory to exfiltrate credentials, and establishes reverse SSH tunnels. This campaign primarily targets Russian organizations across the energy, transportation, electronics, and software development sectors using initial access vectors such as phishing and compromised contractors.

Severity: High

Threat Details and IOCs

Mitigation Advice

• Immediately identify all TrueConf servers in the environment and update them to version 5.3.9, 5.4.9, or 5.5.5, or a newer version if available.
• At the perimeter firewall, create a rule to block all inbound connections to TCP port 4307 for any public-facing TrueConf servers until they can be patched.
• Scan the file systems of all TrueConf servers to verify the integrity of the '\public\js\locale.php' file and check for any unauthorized modifications or unexpected files in web-accessible directories.
• Use your Endpoint Detection and Response (EDR) tool to run a search across all endpoints and servers for the files 'SysExcSvc.dll' and 'SysReadSvc.dll'.
• Review SIEM and EDR alerts for any recent activity involving access to the LSASS process memory, especially on or originating from TrueConf servers.
• Analyze network traffic logs (firewall, proxy, DNS) for any unusual or unauthorized outbound connections from servers to Microsoft OneDrive domains.

Compliance Best Practices

• Develop and implement a comprehensive vulnerability management program that includes asset inventory, risk-based prioritization, and defined service-level agreements (SLAs) for patching public-facing applications.
• Implement an application control or whitelisting policy on endpoints that prevents the execution of unsigned or unauthorized executables.
• Design and implement network segmentation to place all public-facing servers, including video conferencing systems, into a secure Demilitarized Zone (DMZ) with strict access controls to and from the internal corporate network.
• Enable Credential Guard on all supported Windows endpoints and servers to protect LSASS process memory and prevent credential theft.
• Implement a default-deny egress filtering policy at the network perimeter, explicitly allowing only necessary outbound traffic from servers on a per-system basis.
• Incorporate training into the security awareness program that educates users on the dangers of downloading and installing software updates from third-party sources, even if they appear legitimate.