Daily Threat Briefing
← All briefings

Gitea Open Source Git Server · Linux kernel · Microsoft Edge

DAILY THREAT INTELLIGENCE BRIEFING Date: 2026-07-04 Prepared for: SOC Analysts | Incident Responders | Vulnerability Management | Security Leadership

EXECUTIVE SUMMARY

Today’s most significant new developments are a batch of critical Gitea vulnerabilities including an unauthenticated IP spoofing flaw (CVE-2026-20896, CVSS 9.8) and SSRF bypass (CVE-2026-22874, CVSS 9.6), a large Microsoft Edge security update addressing multiple remote code execution flaws, and a newly disclosed Linux kernel privilege escalation (CVE-2026-46242, “Bad Epoll”) affecting desktops, servers, and Android. A new modular malware framework, Avalon, has been identified distributing CrownX ransomware via phishing. No new CISA KEV additions in the last 24 hours.

CRITICAL VULNERABILITIES

NEW

CVE-2026-20896 (Gitea — Reverse Proxy Authentication Bypass)

  • Affected products: Gitea Open Source Git Server versions up to and including 1.26.2
  • Severity: CVSS 9.8 (Critical)
  • EPSS: 0 (not yet scored; newly published)
  • Technical detail: The Gitea Docker image ships with REVERSE_PROXY_TRUSTED_PROXIES=* by default, meaning any source IP can inject reverse-proxy authentication headers such as X-Forwarded-User to impersonate arbitrary users without credentials. This is exploitable remotely with no authentication against any Gitea instance deployed via Docker that has not overridden this default. Organizations using Gitea for source code management, CI/CD pipelines, or internal developer tooling are directly at risk of full repository compromise and supply chain exposure.
  • Exploitation status: No confirmed exploitation; CVSS 9.8 and trivial exploitability make this high priority.
  • Remediation: Upgrade to Gitea 1.26.3 or later. If immediate upgrade is not possible, explicitly set REVERSE_PROXY_TRUSTED_PROXIES to only the IP addresses of trusted reverse proxies. Audit access logs for unexpected authentication events.

CVE-2026-22874 (Gitea — Incomplete SSRF Protection)

  • Affected products: Gitea Open Source Git Server versions up to and including 1.26.2
  • Severity: CVSS 9.6 (Critical)
  • EPSS: 0 (newly published)
  • Technical detail: Gitea’s webhook and migration allow-list filtering does not fully block server-side request forgery. An authenticated attacker can craft webhook or migration requests that cause the Gitea server to make HTTP requests to internal network resources, potentially reaching cloud metadata endpoints, internal APIs, or other services not intended to be externally accessible. In cloud-hosted or containerized environments this can expose instance metadata credentials and enable lateral movement.
  • Exploitation status: No confirmed exploitation.
  • Remediation: Upgrade to Gitea 1.26.3 or later. Review and harden webhook and migration allow-list configurations. Restrict outbound network access from Gitea instances using firewall rules.

CVE-2026-46242 (Linux Kernel — “Bad Epoll” Local Privilege Escalation)

  • Affected products: Linux kernel (desktops, servers, Android); fix available
  • Severity: Not yet assigned a public CVSS at time of writing
  • EPSS: Not yet scored
  • Technical detail: Disclosed as “Bad Epoll,” this flaw resides in the kernel’s epoll subsystem and allows an unprivileged local user to gain full root access. It affects a broad range of Linux distributions and Android devices. The vulnerability sits in the same kernel code region where a separate bug was recently identified, suggesting this area warrants heightened scrutiny. No authentication or special privileges are required beyond local code execution, making it relevant to multi-tenant servers, VDI environments, and any system where untrusted users can run code.
  • Exploitation status: No confirmed in-the-wild exploitation; public disclosure increases risk of rapid weaponization.
  • Remediation: Apply kernel patches from your distribution vendor as soon as available. Prioritize internet-facing Linux servers and multi-tenant environments. Monitor vendor security channels (Red Hat, Ubuntu, SUSE, Debian) for patch availability.

CVE-2026-58289 (Microsoft Edge — Type Confusion RCE, highest-severity of batch)

  • Affected products: Microsoft Edge (Chromium-based) versions below 150.0.4078.48
  • Severity: CVSS 9.0 (Critical); multiple additional Edge CVEs in this release range from CVSS 8.1 to 8.8
  • EPSS: 0 (newly published)
  • Technical detail: Microsoft released Edge 150.0.4078.48 addressing at least 12 vulnerabilities, the most severe being CVE-2026-58289 (type confusion, CVSS 9.0, network-exploitable RCE). Additional flaws include use-after-free bugs (CVE-2026-57981, CVE-2026-57974 integer overflow, CVE-2026-58288, CVE-2026-58287), heap buffer overflow (CVE-2026-56645), improper authorization (CVE-2026-57983, CVE-2026-58284), and multiple spoofing and security feature bypass issues. Network-exploitable RCE via browser type confusion requires only that a user visit a malicious page, making this a realistic phishing or watering-hole vector.
  • Exploitation status: No confirmed exploitation; network-exploitable RCE warrants prompt deployment.
  • Remediation: Update Microsoft Edge to version 150.0.4078.48 or later. Enforce browser update policies via Group Policy or Intune. Consider blocking Edge access to untrusted external sites until patched.

CVE-2026-58424 / CVE-2026-58426 (Gitea — Workflow Approval Bypass and Artifact HMAC Flaw)

  • Affected products: Gitea up to 1.26.2 (CVE-2026-58424); Gitea 1.22.0 to 1.26.1 (CVE-2026-58426)
  • Severity: CVSS 8.9 (CVE-2026-58424); CVSS 9.6 (CVE-2026-58426)
  • Technical detail: CVE-2026-58424 allows a permanent fork to bypass pull request workflow approval gates, enabling unauthorized code merges into protected branches — a direct supply chain risk. CVE-2026-58426 exploits HMAC ambiguity in Gitea Actions Artifacts V4 signed URLs, permitting cross-repository artifact reads and cross-task upload-state writes. Together with CVE-2026-20896 and CVE-2026-22874, these flaws represent a cluster of serious supply chain risks in Gitea deployments.
  • Exploitation status: No confirmed exploitation.
  • Remediation: Upgrade to Gitea 1.26.3 or later. Review branch protection rules and audit recent pull request approvals and artifact access logs.

ONGOING

  • CVE-2026-45659 (Microsoft SharePoint Server): CISA KEV deadline was 2026-07-04 — verify patch applied; actively exploited.
  • Cisco Unified CM (June 2026 patch): actively exploited; apply June patch and audit access logs.
  • CVE-2026-44939 (SUSE Rancher): command injection, high exploitation probability; upgrade required.
  • CVE-2026-8037 (Progress Kemp LoadMaster): actively exploited; patch or isolate management interface.
  • CVE-2026-48558 (SimpleHelp): CISA KEV deadline passed; hunt for Djinn Stealer indicators.
  • CVE-2026-46817 (Oracle E-Business Suite): actively exploited; patch immediately.
  • CVE-2026-10109 (IBM Db2): pre-auth RCE; patch and restrict port 50000.
  • Adobe ColdFusion (CVE-2026-48283 et al.): CVSS 10.0 unauthenticated RCE; patch if not yet done.
  • BlueHammer (Windows Defender privilege escalation): actively exploited by ransomware gangs; verify patch applied.

EUROPEAN ADVISORIES

BSI published a new advisory for WatchGuard Firebox (WID-SEC-2026-2193, hoch): multiple vulnerabilities allow a remote unauthenticated attacker to execute arbitrary code, cause denial of service, manipulate or disclose data, and conduct cross-site scripting attacks. WatchGuard Firebox appliances are deployed as perimeter firewalls in many European SME and enterprise environments. Apply available WatchGuard security updates and restrict management interface access to trusted administrative networks.

BSI published a new advisory for Microsoft Exchange Online (WID-SEC-2026-2191, hoch): a remote authenticated attacker can exploit a privilege escalation vulnerability. Apply available Microsoft mitigations and monitor for anomalous privilege use in Exchange Online audit logs.

BSI published new advisories for Microsoft Azure and Entra (WID-SEC-2026-2184, hoch) and Microsoft 365 Copilot (WID-SEC-2026-2185, hoch): authenticated attackers can escalate privileges in Azure, Entra, and Copilot environments. Review Azure RBAC assignments and Entra conditional access policies; apply available Microsoft patches.

BSI published a new advisory for Dell PowerProtect Data Domain (WID-SEC-2026-2189, hoch): multiple vulnerabilities allow privilege escalation, arbitrary code execution, security bypass, denial of service, XSS, information disclosure, and file manipulation. Apply Dell’s available security updates for affected Data Domain versions.

BSI published a new advisory for Coolify (WID-SEC-2026-2192, hoch): covered in yesterday’s report; apply available patches.

BSI updated advisories (consolidated): Adobe ColdFusion (WID-SEC-2026-2155, kritisch — see ONGOING), PHP (WID-SEC-2026-1433, hoch), dnsmasq (WID-SEC-2026-1468, hoch), Red Hat OpenShift/gRPC-Go (WID-SEC-2026-1136), Docker (WID-SEC-2026-0873), FasterXML Jackson (WID-SEC-2026-2058), Splunk Enterprise (WID-SEC-2026-1618), ImageMagick (WID-SEC-2026-1567), OpenSSL (WID-SEC-2026-1852), Red Hat Enterprise Linux (WID-SEC-2026-1957), and multiple Linux Kernel advisories. Apply current vendor patches for all affected components.

Heise Security reported critical vulnerabilities in Ubiquiti UniFi requiring prompt updates — covered in yesterday’s report. Heise also reported on the Pegasus compromise of an MEP (see Active Threats).

ACTIVE THREATS AND CAMPAIGNS

NEW — Avalon Malware Framework with CrownX Ransomware Researchers have identified a previously undocumented modular malware framework called Avalon, distributed via multi-stage phishing chains capable of bypassing traditional security controls. Avalon integrates credential harvesting, lateral movement, remote access, recovery disruption, and ransomware execution (CrownX) within a single framework. The multi-stage delivery is designed to evade email security gateways. Organizations should update email filtering rules, enforce application allowlisting, and ensure backup systems are isolated from the primary network. No specific IOCs have been published at time of writing.

NEW — North Korea-Linked Malicious npm Packages Targeting Developers JFrog identified npm packages “rollup-packages-polyfill-core” and “rollup-runtime-polyfill-core” attributed to North Korea-linked threat actors. The packages mimic the legitimate “rollup-plugin-polyfill-node” project, including description and repository metadata, to facilitate remote access and data theft from developer environments. Development teams should audit their npm dependency trees for these packages, enforce lockfile integrity checks, and use software composition analysis tooling. Remove any identified packages immediately and rotate credentials on affected systems.

NEW — ARToken PhaaS Targeting Microsoft 365 A new phishing-as-a-service platform, ARToken, has been identified as an affiliate of the EvilTokens toolkit, providing adversary-in-the-middle capabilities to compromise Microsoft 365 accounts and bypass MFA via token theft. This adds to the existing ConsentFix/ClickFix token hijacking threat landscape. Enforce Conditional Access policies requiring compliant devices, monitor for impossible-travel sign-in events, and audit OAuth token grants in Microsoft 365 tenants.

NEW — Pegasus Spyware Used Against MEP Investigating Spyware Abuse Citizen Lab confirmed that former MEP Stelios Kouloglou, who served on the European Parliament’s PEGA committee investigating commercial spyware abuse, had his mobile device repeatedly compromised with Pegasus spyware. This is directly relevant to European political and institutional security. Organizations supporting MEPs, parliamentary staff, or civil society actors should review mobile device security posture and consider deploying mobile threat defense solutions.

NEW — PamStealer macOS Infostealer via Fake Maccy Sites A new macOS infostealer, PamStealer, is distributed as a compiled AppleScript file impersonating the Maccy clipboard manager. It abuses PAM (Pluggable Authentication Modules) checks to harvest macOS login passwords and exfiltrate sensitive data. Alert macOS users against downloading software from unofficial sources; enforce Gatekeeper and notarization requirements.

ONGOING — Armored Likho targeting government and power sector with BusySnake stealer: monitor for indicators in relevant sectors. ONGOING — ToddyCat Umbrij OAuth abuse: audit Google Workspace OAuth grants. ONGOING — JADEPUFFER AI-agent ransomware via Langflow RCE: patch and isolate Langflow instances. ONGOING — Anubis ransomware exploiting CVE-2025-5777 (Citrix Bleed 2): verify Citrix patching status. ONGOING — ChocoPoC RAT targeting security researchers via fake GitHub PoC repos: sandbox all third-party PoC code. ONGOING — FortiBleed campaign (INC/Lynx ransomware): rotate Fortinet credentials.

SECURITY NEWS AND CONTEXT

Rapid7 released a Metasploit update (6.4.142) adding an SMB-to-Meterpreter session upgrade module via PsExec and an exploit module for Peyara Remote Mouse 1.0.1 unauthenticated RCE. Defenders should ensure endpoint detection rules cover PsExec-based lateral movement and Peyara Remote Mouse deployments.

A joint operation involving Google disrupted the NetNut residential proxy network, cutting off approximately two million compromised Android devices used to anonymize malicious traffic — this is an ONGOING item with no new developments beyond yesterday’s report.

Heise Security published commentary noting that CISA’s CVSS enrichment practices are inflating scores for low-severity vulnerabilities, potentially degrading the signal value of CVSS for prioritization. Vulnerability management teams should cross-reference EPSS scores and exploitation evidence rather than relying solely on CVSS.

RECOMMENDED ACTIONS

  1. Upgrade Gitea to 1.26.3 or later immediately — CVE-2026-20896 (CVSS 9.8 unauthenticated impersonation) and CVE-2026-22874 (CVSS 9.6 SSRF bypass) are critical; audit access and artifact logs.
  2. Apply Linux kernel patches for CVE-2026-46242 (Bad Epoll) as soon as available from your distribution vendor — unprivileged local root on servers, desktops, and Android.
  3. Update Microsoft Edge to 150.0.4078.48 or later — multiple network-exploitable RCE flaws including CVSS 9.0 type confusion.
  4. Apply WatchGuard Firebox security updates and restrict management interface access — unauthenticated RCE possible.
  5. Apply Microsoft patches for Exchange Online, Azure, Entra, and M365 Copilot privilege escalation flaws — covered in new BSI advisories.
  6. Audit npm dependencies for “rollup-packages-polyfill-core” and “rollup-runtime-polyfill-core” — North Korea-linked supply chain packages; rotate credentials on affected developer systems.
  7. Update email filtering and endpoint controls to detect Avalon/CrownX multi-stage phishing delivery; ensure backups are network-isolated.
  8. Enforce Microsoft 365 Conditional Access and audit OAuth token grants — ARToken PhaaS actively targeting M365 accounts via token theft.
  9. Review mobile device security for parliamentary, government, and civil society staff — Pegasus confirmed against MEP on PEGA committee.
  10. Continue remediation of previously reported items: CVE-2026-45659 (SharePoint — deadline today), Cisco Unified CM, CVE-2026-48558 (SimpleHelp), CVE-2026-46817 (Oracle EBS), CVE-2026-8037 (Kemp LoadMaster), Adobe ColdFusion, BlueHammer, IBM Db2.