Daily Threat Briefing
← All briefings

Progress Kemp LoadMaster · IBM Db2 · Adobe ColdFusion 2025

DAILY THREAT INTELLIGENCE BRIEFING Date: 2026-07-01 Prepared for: SOC Analysts | Incident Responders | Vulnerability Management | Security Leadership

EXECUTIVE SUMMARY

Active exploitation of CVE-2026-46817 (Oracle E-Business Suite) continues with confirmed breach victims. New today: CVE-2026-48558 (SimpleHelp) CISA KEV deadline falls tomorrow (2026-07-02) — any outstanding remediation is now urgent. Adobe ColdFusion has received a cluster of critical-severity patches covering RCE, path traversal, and SSRF. IBM Db2 carries a new pre-authentication RCE flaw in its DRDA handshake. A Windows Defender privilege escalation (BlueHammer) has been confirmed exploited by ransomware gangs. The RustDuck botnet is actively expanding via compromised routers and servers.

CRITICAL VULNERABILITIES

NEW

CVE-2026-8037 (Progress Kemp LoadMaster)

  • Affected products: Progress Kemp LoadMaster (all versions with API enabled)
  • Severity: CVSS 9.8 (Critical)
  • EPSS: Not yet scored
  • Technical detail: An unauthenticated attacker can send a single crafted HTTP request to the LoadMaster management API and execute arbitrary OS commands as root. No credentials, session, or prior access are required. LoadMaster is widely deployed as an enterprise application delivery controller and load balancer; internet-exposed management interfaces are directly at risk. A vendor patch is available.
  • Exploitation status: No confirmed in-the-wild exploitation reported; CVSS 9.8 and trivial attack vector make this high priority.
  • Remediation: Apply the vendor patch immediately. If patching is not immediately possible, restrict API access to trusted management networks and disable external exposure of the management interface.

CVE-2026-10109 (IBM Db2)

  • Affected products: IBM Db2 11.5.0 through 11.5.9; 12.1.0 through 12.1.4
  • Severity: CVSS 9.8 (Critical)
  • EPSS: Not yet scored
  • Technical detail: A flaw in the pre-authentication DRDA (Distributed Relational Database Architecture) handshake allows a remote, unauthenticated attacker to achieve remote code execution on the Db2 server. DRDA is the default wire protocol for Db2 client-server communication and is typically exposed on TCP port 50000. Enterprise deployments where Db2 is network-accessible — including cloud-hosted instances — are directly at risk without any credential requirement.
  • Exploitation status: No confirmed exploitation; newly published.
  • Remediation: Apply IBM-issued patches for the affected version ranges. Where patching is delayed, restrict Db2 DRDA port access to authorized client IP ranges via firewall rules.

Adobe ColdFusion (CVE-2026-48283, CVE-2026-48281, CVE-2026-48282, CVE-2026-48277, CVE-2026-48315, CVE-2026-48313, CVE-2026-48285)

  • Affected products: Adobe ColdFusion 2025 through 2025.9; ColdFusion 2023 through 2023.20 and earlier
  • Severity: CVSS 10.0 (CVE-2026-48283 — unrestricted file upload leading to RCE); multiple additional CVEs at CVSS 9.3 and 10.0
  • EPSS: Not yet scored across the cluster
  • Technical detail: Adobe published seven ColdFusion advisories simultaneously. The most severe (CVE-2026-48283) is an unrestricted file upload vulnerability enabling arbitrary code execution in the context of the running user — no authentication requirement is specified. Additional flaws include two improper input validation RCE vulnerabilities (CVE-2026-48281, CVE-2026-48277), a path traversal leading to RCE (CVE-2026-48282), a further path traversal enabling arbitrary file system read (CVE-2026-48313), an input validation RCE requiring user interaction (CVE-2026-48315), and an SSRF enabling security feature bypass (CVE-2026-48285). ColdFusion is deployed in enterprise application servers and government portals; the combination of unauthenticated RCE and file upload flaws represents a severe attack surface.
  • Exploitation status: No confirmed exploitation; CVSS 10.0 on the file upload flaw warrants emergency treatment.
  • Remediation: Apply Adobe’s ColdFusion security updates to versions beyond 2025.9 and 2023.20 immediately. Restrict ColdFusion admin interfaces to internal networks. Review file upload directories for unexpected content.

BlueHammer (Windows Defender Privilege Escalation — CVE not confirmed in source data)

  • Affected products: Microsoft Windows (Microsoft Defender component)
  • Severity: Not confirmed; previously exploited as zero-day
  • EPSS: Not scored
  • Technical detail: CISA confirmed that ransomware groups are now actively exploiting this Microsoft Defender privilege escalation vulnerability, which was previously observed in targeted zero-day attacks. Ransomware operators are using it as a post-exploitation step to elevate from standard user to SYSTEM, enabling credential dumping and lateral movement. The shift from targeted use to ransomware gang adoption significantly broadens the threat to enterprise environments.
  • Exploitation status: Actively exploited by ransomware gangs; CISA confirmed.
  • Remediation: Ensure all Windows endpoints have the relevant Microsoft Defender / Windows security update applied. Prioritize unpatched endpoints in environments with known ransomware exposure. Review EDR telemetry for privilege escalation indicators.

CVE-2026-48558 (SimpleHelp) — STATUS CHANGE

  • CISA KEV remediation deadline is 2026-07-02 (tomorrow). Any organization that has not yet patched is now in breach of the KEV deadline. Djinn Stealer deployment confirmed in exploitation chain. Full entry in yesterday’s report.

ONGOING

  • CVE-2026-46817 (Oracle E-Business Suite): actively exploited by ShinyHunters; patch immediately, review access logs.
  • CVE-2026-55200 (libssh2): public PoC available; update libssh2 and all bundled applications.
  • CVE-2026-42208 (LiteLLM Proxy): actively exploited, CISA KEV; patch and rotate API keys.
  • CVE-2026-56290 (Page Builder CK for Joomla): CVSS 10.0 unauthenticated RCE; update or disable.
  • CVE-2026-41052 (SUSE Rancher): privilege escalation; upgrade to patched release.
  • CVE-2026-45087 (Dalfox), CVE-2026-58053 (Gitea act_runner), CVE-2026-49869/53576 (Kestra), CVE-2026-54350 (Budibase), CVE-2026-52785 (OpenProject): patch actions remain open per prior reporting.

EUROPEAN ADVISORIES

BSI published a large batch of updated advisories on 2026-06-30 covering Linux Kernel (multiple advisories: privilege escalation, DoS, memory corruption — WID-SEC-2026-0086, -0462, -0861, -1279, -1346, -1430, -1530, -1700, -1938, and several 2025-series entries), NGINX Open Source and NGINX Plus (WID-SEC-2026-0860, -1527, -1661: DoS, code execution, security bypass), OpenSSL (WID-SEC-2026-1852: RCE, bypass, information disclosure), Samba (WID-SEC-2026-1686: RCE, DoS, file manipulation), and Red Hat OpenShift Service Mesh (WID-SEC-2026-1934: RCE). Apply current vendor patches for all affected components.

WID-SEC-2026-1722 (Oracle E-Business Suite) — UPDATE: BSI updated its critical advisory for Oracle EBS. Cross-reference: CVE-2026-46817 is actively exploited; covered in Critical Vulnerabilities.

WID-SEC-2026-1190 (GNU libc) — UPDATE: BSI updated its critical advisory covering file manipulation, DoS, and unspecified attack vectors in GNU libc. Apply distribution-provided glibc updates.

WID-SEC-2026-2138 (OWASP ModSecurity) — NEW: Multiple vulnerabilities allow remote unauthenticated attackers to bypass WAF security controls. Organizations using ModSecurity as a perimeter defense layer should apply available patches promptly, as a bypass undermines downstream application protection.

WID-SEC-2026-2136 (Icinga) — NEW: Multiple vulnerabilities in the Icinga monitoring platform enable DoS, security bypass, and privilege escalation. Icinga is widely deployed in European enterprise and government monitoring environments. Apply available updates.

WID-SEC-2026-2132 (NATS Server) — NEW: Multiple vulnerabilities including RCE, privilege escalation, security bypass, data manipulation, and DoS. NATS is used in cloud-native and microservices architectures. Apply vendor patches.

WID-SEC-2026-2133 (OpenClaw) and WID-SEC-2026-1187 (Ruby/erb gem): updated advisories; apply vendor patches per existing guidance.

ACTIVE THREATS AND CAMPAIGNS

NEW — RustDuck Botnet QiAnXin XLab researchers have tracked the RustDuck botnet since February 2026. The malware is written in Rust and targets home routers, IP cameras, Android TV boxes, and poorly secured servers in a two-stage infection chain. The end goal is DDoS-for-hire capability. The botnet is notable for its rapid development pace and cross-platform targeting. Organizations should ensure internet-facing routers and embedded devices run current firmware, change default credentials, and monitor for anomalous outbound traffic volumes.

NEW — Phantom Squatting (AI-Hallucinated Domain Abuse) Unit 42 published research on “phantom squatting,” a supply chain attack vector where adversaries register domains that LLMs hallucinate as legitimate package sources or CDN endpoints. Developers or automated pipelines that act on AI-generated code recommendations may inadvertently fetch malicious packages from attacker-controlled domains. Security teams should enforce package integrity verification, use lockfiles, and audit AI-assisted code generation workflows for unverified dependency references.

NEW — Silent Swap Crypto Clipper McAfee Labs identified an active campaign distributing a browser-based cryptocurrency clipper via unsigned installers (both .NET and Golang variants). The malware installs a fake Google Notes browser extension that silently replaces cryptocurrency wallet addresses during transactions. Warn users handling cryptocurrency transactions; enforce browser extension policies and monitor for unsigned installer execution.

NEW — Malicious PyPI Packages Targeting Telegram Bot Developers A campaign active since November 2025 distributes trojanized Pyrogram forks via PyPI, targeting Python developers building Telegram bots. Compromised packages allow attackers to read arbitrary files on affected servers. Audit Python environments for unofficial Pyrogram packages; use dependency hash pinning and verify package provenance.

ONGOING — Mustang Panda / Zoho WorkDrive C2: active against Indian government targets; review outbound Zoho WorkDrive traffic. ONGOING — Microsoft-tracked multi-stage hospitality sector campaign: persistent footholds in Asian and European hotel networks. ONGOING — ShinyHunters Oracle EBS campaign: multiple confirmed breach victims; patch and monitor. ONGOING — FIFA 2026 fraud infrastructure: phishing and fraud campaigns active across multiple languages; user awareness recommended.

SECURITY NEWS AND CONTEXT

BlueHammer (Windows Defender): CISA confirmed ransomware gangs are now exploiting this previously zero-day privilege escalation flaw; covered in Critical Vulnerabilities above.

BioShocking attack technique: Researchers at LayerX demonstrated that six AI-powered browsers and assistants — including ChatGPT Atlas, Perplexity Comet, and Claude’s browser extension — can be manipulated via prompt injection framed as fictional scenarios to exfiltrate user credentials. Organizations deploying AI browser tools should assess exposure and await vendor mitigations.

Aflac data breach: Aflac disclosed a breach of its Japan subsidiary resulting in theft of personal and bank account information. No European customer data confirmed affected at this time.

Microsoft is accelerating its quantum-safe cryptography roadmap, citing faster-than-expected advances in quantum computing. Organizations should begin inventorying cryptographic dependencies in preparation for post-quantum migration.

RECOMMENDED ACTIONS

  1. Patch Progress Kemp LoadMaster immediately (CVE-2026-8037) — unauthenticated root RCE via API; restrict management interface if patching is delayed.
  2. Patch IBM Db2 for pre-auth DRDA RCE (CVE-2026-10109) — restrict TCP port 50000 to authorized clients as interim measure.
  3. Apply Adobe ColdFusion security updates immediately — CVSS 10.0 unauthenticated file upload RCE (CVE-2026-48283) plus six additional critical flaws; restrict admin interfaces.
  4. Ensure BlueHammer Windows Defender patch is applied on all endpoints — ransomware gangs actively exploiting for privilege escalation; review EDR telemetry.
  5. Remediate CVE-2026-48558 (SimpleHelp) by 2026-07-02 — CISA KEV deadline is tomorrow; hunt for Djinn Stealer on managed endpoints.
  6. Apply BSI-flagged patches for ModSecurity (WID-SEC-2026-2138) and Icinga (WID-SEC-2026-2136) — WAF bypass and monitoring platform privilege escalation.
  7. Patch NATS Server (WID-SEC-2026-2132) — RCE and privilege escalation in cloud-native messaging infrastructure.
  8. Audit PyPI dependencies in Python environments for trojanized Pyrogram packages; enforce hash pinning.
  9. Enforce browser extension allowlisting and warn users about Silent Swap crypto clipper campaign.
  10. Continue remediation of previously reported items: CVE-2026-46817 (Oracle EBS), CVE-2026-55200 (libssh2), CVE-2026-42208 (LiteLLM), CVE-2026-56290 (Joomla Page Builder CK), CVE-2026-41052 (Rancher), Kestra, Budibase, OpenProject, Froxlor, SzafirHost.