Daily Threat Briefing
← All briefings

CoreWCF · Linux kernel — virtually all mainstream distributions shipping the affected code since 2011 · UniFi Connect

DAILY THREAT INTELLIGENCE BRIEFING Date: 2026-07-09 Prepared for: SOC Analysts | Incident Responders | Vulnerability Management | Security Leadership

EXECUTIVE SUMMARY

Today’s most urgent items are two newly disclosed critical vulnerabilities: CVE-2026-54782 in CoreWCF (CVSS 10.0, SAML token validation bypass enabling authentication bypass) and CVE-2026-43499 “GhostLock” (a 15-year-old Linux kernel local privilege escalation to root, present in virtually all mainstream distributions since 2011). Additionally, Ubiquiti has patched seven critical UniFi flaws including a CVSS 10.0 command injection, and CISA has added Adobe ColdFusion and Langflow flaws to KEV — both with a 2026-07-10 deadline already reported yesterday.

CRITICAL VULNERABILITIES

NEW

CVE-2026-54782 (CoreWCF)

  • Affected products: CoreWCF versions prior to 1.8.1 and 1.9.1 (all editions using SAML 1.1 or SAML 2.0 token validation)
  • Severity: Critical (CVSS 10.0)
  • EPSS: 0 (not yet scored; freshly published)
  • Technical detail: CoreWCF’s SAML token validation logic fails to correctly resolve issuer identity, allowing an attacker to craft a malicious SAML token that passes validation without a legitimate signing key. This is a pre-authentication authentication bypass: any service endpoint protected by SAML-based WCF security is potentially accessible to an unauthenticated attacker. CoreWCF is the .NET Core successor to Windows Communication Foundation and is used in enterprise service-oriented architectures, particularly in organizations migrating legacy .NET Framework WCF services to .NET Core.
  • Exploitation status: No active exploitation confirmed. Severity and attack surface warrant immediate treatment.
  • Remediation: Upgrade to CoreWCF 1.8.1 or 1.9.1. Audit all service endpoints using SAML 1.1 or SAML 2.0 token authentication. Until patched, consider restricting access to affected endpoints to trusted network segments.

CVE-2026-43499 “GhostLock” (Linux Kernel)

  • Affected products: Linux kernel — virtually all mainstream distributions shipping the affected code since 2011 (Debian, Ubuntu, RHEL, SUSE, Fedora, and derivatives)
  • Severity: High (CVSS not yet published; researcher-assessed as enabling full local root)
  • EPSS: Not yet scored
  • Technical detail: Disclosed by Nebula Security, GhostLock is a 15-year-old kernel flaw requiring only a local authenticated session — no special privileges, no unusual configuration, no network access. A logged-in user can exploit the vulnerability to gain full root control and escape container boundaries. The flaw has shipped by default in essentially every mainstream Linux distribution since 2011. The combination of universal distribution, low exploitation bar, and container escape capability makes this high priority for any Linux-based server, cloud workload, or container host.
  • Exploitation status: No active exploitation confirmed at time of writing; public disclosure increases risk of rapid weaponization.
  • Remediation: Apply kernel patches from distribution vendors as they become available. Monitor vendor security channels (Red Hat, Canonical, SUSE, Debian) for errata. As an interim measure, restrict local shell access and audit sudoers and SSH authorized_keys on exposed systems. BSI advisory expected.

CVE-2026-50746 and related (Ubiquiti UniFi)

  • Affected products: UniFi Connect, UniFi Talk, UniFi Access, UniFi Protect, UniFi OS
  • Severity: Critical — CVE-2026-50746 CVSS 10.0 (improper access control, UniFi Connect); additional flaws rated critical across the product family
  • EPSS: Not yet scored
  • Technical detail: Seven critical vulnerabilities were patched across the UniFi product family. CVE-2026-50746 is an improper access control flaw in UniFi Connect Application enabling unauthenticated command execution. The broader set includes privilege escalation and arbitrary command execution vectors across UniFi OS, which underpins physical access control, video surveillance, and VoIP infrastructure. UniFi devices are widely deployed in European enterprise, hospitality, and SME environments, often with management interfaces exposed on internal networks or, in misconfigured deployments, the internet.
  • Exploitation status: No active exploitation confirmed; CVSS 10.0 rating and broad deployment make rapid exploitation likely.
  • Remediation: Apply all available UniFi firmware and application updates immediately. Verify management interfaces are not internet-exposed. Audit for unauthorized command execution or configuration changes.

CVE-2026-9074 and CVE-2026-3144 (IBM API Connect)

  • Affected products: IBM API Connect 10.0.8.0 through 10.0.8.9; 12.1.0.0 through 12.1.0.3
  • Severity: CVE-2026-9074 CVSS 9.1 (unauthenticated SQL injection in password reset); CVE-2026-3144 CVSS 8.1 (default credentials)
  • EPSS: Not yet scored
  • Technical detail: CVE-2026-9074 allows an unauthenticated attacker to inject SQL via the password reset endpoint, potentially enabling account takeover or data exfiltration without any prior authentication. CVE-2026-3144 compounds this: IBM API Connect 12.1.x ships with default credentials that are not enforced to change, meaning an attacker can authenticate before the SQL injection step is even needed. IBM API Connect is an enterprise API management platform used across financial services, telecommunications, and public sector organizations in Europe.
  • Exploitation status: No active exploitation confirmed.
  • Remediation: Apply IBM-supplied patches. Immediately rotate all default credentials on API Connect 12.1.x deployments. Restrict the password reset endpoint to trusted networks where operationally feasible.

CVE-2026-11903 (Progress MOVEit Transfer)

  • Affected products: MOVEit Transfer 2025.0.0 before 2025.0.8; 2025.1.0 before 2025.1.4; 2026.0.0 before 2026.0.1
  • Severity: High (CVSS 8.0)
  • EPSS: Not yet scored
  • Technical detail: A cross-site scripting vulnerability in the MOVEit Transfer Ad Hoc module allows an unauthenticated remote attacker to inject malicious scripts into the web interface. Given MOVEit Transfer’s history as a high-value target for data theft campaigns (including the 2023 Cl0p mass exploitation), any new vulnerability in this product warrants elevated attention. XSS in a file transfer platform can be used to steal session tokens and pivot to authenticated file access.
  • Exploitation status: No active exploitation confirmed.
  • Remediation: Apply Progress patches to reach 2025.0.8, 2025.1.4, or 2026.0.1 as appropriate. Review web access logs for XSS probe patterns against the Ad Hoc module.

ONGOING

  • CVE-2026-48282 (Adobe ColdFusion): actively exploited, CISA deadline 2026-07-10 — patch or isolate immediately.
  • CVE-2026-55255 (Langflow): actively exploited, CISA deadline 2026-07-10 — patch immediately.
  • CVE-2026-48908 / CVE-2026-56290 (Joomla extensions): actively exploited, CISA deadline 2026-07-10 — update and audit web root.
  • CVE-2026-40138 / CVE-2026-40139 (BeyondTrust RS/PRA): BSI WID-SEC-2026-2215 flagged; upgrade to 25.3.3 or 26.2.1.
  • CVE-2026-48316 (Adobe ColdFusion, CVSS 10.0): actively exploited; patch if not yet applied.
  • CVE-2026-53359 (Linux KVM “Januscape”): public PoC available; apply kernel patches.
  • CVE-2026-8037 (Progress Kemp LoadMaster): actively exploited; patch or isolate.
  • CVE-2026-46817 (Oracle E-Business Suite): actively exploited; patch immediately.

EUROPEAN ADVISORIES

BSI published a high volume of advisory updates on 2026-07-08. The following are new advisories of note:

WID-SEC-2026-2241 (Foxit PDF Editor and PDF Reader, NEU, hoch): Multiple vulnerabilities enabling privilege escalation, denial of service, code execution, and information disclosure. Foxit products are widely used in European enterprise environments as an Adobe Acrobat alternative. Apply the latest Foxit updates. See also Heise Security coverage of this issue.

WID-SEC-2026-2240 (X.Org X11 and Xwayland, NEU, hoch): Multiple vulnerabilities enabling denial of service and potential code execution. Relevant for Linux desktop and server environments using X11 or Xwayland. Apply distribution vendor updates.

WID-SEC-2026-2242 (IBM Operational Decision Manager, NEU, hoch): Multiple vulnerabilities allowing an unauthenticated remote attacker to bypass security restrictions, cause denial of service, and execute code. IBM ODM is deployed in enterprise business rules and decision automation environments. Apply IBM-supplied patches.

WID-SEC-2026-2238 (Joomla, NEU, hoch): Cross-site scripting and security mechanism bypass vulnerabilities in Joomla core. Distinct from the Joomla extension flaws in CISA KEV. Apply the latest Joomla core update.

WID-SEC-2026-2237 (ESRI ArcGIS, NEU, hoch): Multiple vulnerabilities allowing an unauthenticated remote attacker to bypass security controls or gain user-level access. Heise Security notes that targeted attacks have already been observed and that CERT has emphasized the importance of applying the June patch. Organizations running ArcGIS Enterprise should treat this as urgent.

WID-SEC-2026-2230 (ILIAS, NEU, hoch): Six vulnerabilities in the ILIAS e-learning platform (security bypass, information disclosure, XSS). ILIAS is widely deployed in German and European universities and public sector training environments. Apply updates for all three supported version branches.

BSI published multiple routine UPDATE advisories on 2026-07-08 covering: Samba (kritisch), Apache log4j (kritisch — ongoing remediation), Linux Kernel (multiple advisories, hoch), PostgreSQL (hoch), Golang Go (hoch), NGINX/NGINX Plus (hoch), Red Hat Enterprise Linux 389-ds-base (hoch), GnuTLS (hoch), Apache HTTP Server (hoch), FreeRDP (hoch), ImageMagick (hoch), Unbound (hoch), dpkg (hoch), Fleet (hoch). Apply outstanding vendor patches for all affected products as part of standard patch cycles.

ACTIVE THREATS AND CAMPAIGNS

NEW — Roundcube Exploitation Against Academic Institutions A China-linked threat cluster is actively exploiting Roundcube webmail vulnerabilities (including CVE-2024-42009, CVSS 9.3) to steal credentials and deploy backdoor malware at physics and engineering departments in North American universities. Roundcube is widely deployed across European research institutions, universities, and public sector organizations. Verify Roundcube is fully patched, review webmail access logs for credential harvesting indicators, and audit for unexpected outbound connections from webmail servers.

NEW — HalluSquatting: AI Coding Assistant Package Hallucination Exploitation Researchers have documented “HalluSquatting,” a technique where attackers register package names that AI coding assistants (such as GitHub Copilot, Cursor, and Claude Code) reliably hallucinate, then wait for developers to install the malicious packages. This is distinct from traditional typosquatting and is harder to detect because the package names appear plausible. Development teams using AI coding assistants should verify all package names against official registries before installation and consider dependency pinning and software composition analysis tooling.

NEW — Fake Paysafe and Skrill SDKs Delivering Credential Stealers Malicious packages impersonating Paysafe, Skrill, and Neteller SDKs have been identified on npm and PyPI, delivering stealer malware to developers and users of payment applications. Organizations with development teams working on payment integrations should audit their dependency trees for these packages and review developer workstations for stealer indicators.

NEW — Entra Passkey Enrollment Vishing Targeting Microsoft 365 A threat actor is conducting voice-based social engineering attacks against Microsoft 365 users across multiple sectors, impersonating IT security staff and requesting that targets enroll a new Entra passkey. Successful enrollment grants the attacker persistent MFA-compliant access. Brief helpdesk and end users: legitimate IT teams will not initiate unsolicited calls requesting passkey enrollment. Enforce out-of-band verification for any identity enrollment requests.

ONGOING — UAT-7810 LONGLEASH ORB network expansion: targeting internet-facing networking devices; update detection rules with Talos indicators. ONGOING — EvilTokens “ghost phishing” campaign targeting US and European businesses: traditional URL scanning may miss encrypted payloads; review email gateway capabilities. ONGOING — SCMBANKER / REF6045 ClickFix banking malware: targeting payment and fintech users via fake CAPTCHA pages; block ClickFix-style PowerShell execution chains. ONGOING — DEBULL device-code flow abuse against M365: disable device-code flow in Conditional Access where not required. ONGOING — ARToken PhaaS targeting Microsoft 365: enforce Conditional Access; audit OAuth grants.

SECURITY NEWS AND CONTEXT

GhostLock (CVE-2026-43499) is a 15-year-old Linux kernel local privilege escalation flaw enabling root access and container escape on virtually all mainstream distributions; full details are in Critical Vulnerabilities above.

GitHub’s “Verified” commit signature mechanism has been shown to be bypassable: researchers demonstrated that a signed commit’s hash can be rewritten to produce a second commit with identical files, author, date, and a valid signature that GitHub still marks “Verified.” This undermines supply chain integrity assumptions based solely on commit signature verification.

KDDI, Japan’s second-largest telecom, has confirmed a data breach affecting over 12 million customers, with email addresses and passwords exposed via a compromised email platform shared by five ISPs. Nextcloud GmbH separately disclosed and remediated a database misconfiguration that exposed company data; the Nextcloud software product itself is not affected.

RECOMMENDED ACTIONS

  1. Upgrade CoreWCF to 1.8.1 or 1.9.1 immediately (CVE-2026-54782, CVSS 10.0) — unauthenticated SAML authentication bypass; restrict SAML endpoints to trusted networks until patched.
  2. Apply Linux kernel patches for GhostLock (CVE-2026-43499) as soon as distribution vendors release errata — local root and container escape on all mainstream distributions; restrict local shell access in the interim.
  3. Apply all Ubiquiti UniFi firmware and application updates (CVE-2026-50746 and related, CVSS 10.0) — verify management interfaces are not internet-exposed.
  4. Patch IBM API Connect for CVE-2026-9074 (unauthenticated SQLi) and immediately rotate default credentials on all 12.1.x deployments (CVE-2026-3144).
  5. Apply Progress MOVEit Transfer patches (CVE-2026-11903) — update to 2025.0.8, 2025.1.4, or 2026.0.1 as appropriate.
  6. Apply ESRI ArcGIS June patch urgently — BSI and Heise report targeted attacks already observed; treat as actively exploited until confirmed otherwise.
  7. Apply ILIAS updates across all supported version branches — widely deployed in German and European education and public sector environments.
  8. Brief developers on HalluSquatting and fake payment SDK packages (Paysafe/Skrill on npm/PyPI) — enforce SCA tooling and package verification before installation.
  9. Alert Microsoft 365 users and helpdesk staff to Entra passkey enrollment vishing — enforce out-of-band verification for all identity enrollment requests.
  10. Continue remediation of previously reported items: ColdFusion CVE-2026-48282 and CVE-2026-48316 (deadline 2026-07-10), Langflow CVE-2026-55255 (deadline 2026-07-10), Joomla extensions CVE-2026-48908/56290 (deadline 2026-07-10), BeyondTrust CVE-2026-40138/40139, Kemp LoadMaster CVE-2026-8037, Oracle EBS CVE-2026-46817.