Daily Threat Briefing
← All briefings

VMware Avi Load Balancer · WordPress Core · @fastify/http-proxy

Daily Threat Intelligence Briefing

Date: 2026-07-19 Prepared for: SOC Analysts | Incident Responders | Vulnerability Management | Security Leadership

Executive Summary

The most urgent new developments today are a cluster of six VMware Avi Load Balancer vulnerabilities — including unauthenticated authentication bypass (CVSS 9.8, EPSS 0.67) and two RCE flaws (EPSS 0.68 each) — published yesterday with no prior coverage. The BSI has issued an emergency advisory for WordPress Core “wp2shell” (CVE-2026-63030 / CVE-2026-60137), confirming public exploits are now available. A 7-Zip RCE flaw patched in version 26.02 also requires immediate endpoint action. Microsoft has warned of a surge in ACR Stealer campaigns targeting enterprise customers.

Critical Vulnerabilities

CVE-2026-47865 — VMware Avi Load Balancer (Unauthenticated Authentication Bypass)

  • Severity: CVSS 9.8
  • EPSS: 0.67 — high exploitation probability
  • Technical detail: A network-accessible attacker with no credentials can bypass the authentication mechanism of the Avi Control Plane entirely. Affected versions span all supported branches: 22.1.1–22.1.7, 30.1.1–30.2.6, and 31.1.1–31.2.2. The control plane manages load balancing policy, SSL certificates, and application delivery configuration, making full compromise of this component high-impact in enterprise environments.
  • Exploitation status: No confirmed in-the-wild exploitation; EPSS 0.67 indicates elevated near-term risk.
  • Remediation: Apply VMware-issued patches for each affected branch. Restrict Avi Control Plane network access to trusted management networks immediately as a compensating control.

CVE-2026-47871 — VMware Avi Load Balancer (Directory Traversal, Authenticated)

  • Severity: CVSS 8.8
  • EPSS: 0.90 — very high exploitation probability
  • Technical detail: Authenticated network users can exploit flawed file path validation to traverse the directory structure of the Avi Control Plane host. Affects the same version ranges as CVE-2026-47865 plus 32.1.1. At EPSS 0.90, this is the highest-probability exploitation risk in today’s data set; directory traversal in a load balancer control plane can expose TLS private keys, configuration secrets, and credential stores.
  • Exploitation status: No confirmed exploitation; EPSS 0.90 warrants treating this as imminent.
  • Remediation: Patch immediately per VMware advisory. Audit Avi Control Plane access logs for anomalous file path requests. Rotate TLS certificates and secrets stored on affected appliances after patching.

CVE-2026-47867 / CVE-2026-47869 — VMware Avi Load Balancer (Remote Code Execution, Authenticated)

  • Severity: CVSS 8.7 each
  • EPSS: 0.68 each — high exploitation probability
  • Technical detail: Two distinct authenticated RCE paths exist in the Avi Control Plane. CVE-2026-47867 allows a network-accessible authenticated user to reach the control plane and execute code remotely. CVE-2026-47869 is a separate code injection path also requiring authentication. Both affect all supported version branches (22.x, 30.x, 31.x, 32.x). Combined with the authentication bypass (CVE-2026-47865), an unauthenticated attacker can chain these for full unauthenticated RCE.
  • Exploitation status: No confirmed exploitation; chaining with CVE-2026-47865 creates a critical unauthenticated RCE path.
  • Remediation: Treat as part of the same patch action for the Avi Load Balancer cluster. Do not defer patching on the assumption that authentication provides sufficient protection given CVE-2026-47865.

CVE-2026-63030 / CVE-2026-60137 — WordPress Core (“wp2shell”, Unauthenticated RCE + SQLi)

  • STATUS CHANGE: Public exploits confirmed available as of 2026-07-18. BSI has issued an emergency advisory (see European Advisories). Risk level has materially increased since yesterday’s full entry.
  • Update: Bleeping Computer and Heise Security confirm working public exploits are circulating. Patch to WordPress 6.9.5 / 7.0.2 is now critically urgent — verify auto-updates completed on every internet-facing installation. Manual verification is required; do not rely solely on auto-update confirmation.

CVE-2026-16117 — @fastify/http-proxy (URL-Encoded Prefix Bypass)

  • Severity: CVSS 10.0
  • EPSS: 0.0 — no exploitation observed yet
  • Technical detail: Versions up to and including 11.5.0 fail to rewrite the request prefix when the prefix segment is URL-encoded. Fastify’s router decodes paths for route matching but the proxy does not re-encode before forwarding, allowing attackers to bypass prefix-based access controls and reach backend services that should be restricted. Relevant for any Node.js API gateway or BFF (backend-for-frontend) pattern using this library.
  • Exploitation status: No exploitation observed; CVSS 10.0 warrants prompt action in affected deployments.
  • Remediation: Upgrade @fastify/http-proxy to 11.6.0 or later. Audit proxy routing rules for prefix-sensitive access control logic.

ONGOING:

  • CVE-2026-25089 / CVE-2026-39808 (Fortinet FortiSandbox): CISA KEV deadline was 2026-07-19 — patch immediately if not yet done.
  • CVE-2026-58644 (SharePoint RCE): CISA KEV deadline was 2026-07-19 — verify patched.
  • LegacyHive (Windows LPE zero-day): no patch available; maintain EDR alerting on privilege escalation.
  • CVE-2026-9198 cluster (IBM Langflow OSS, CVSS 9.8–9.9): NadMesh actively scanning; patch and isolate.
  • CVE-2026-15409 (SonicWall SMA1000): public PoC available; treat unpatched as compromised.
  • CVE-2026-53412 (Zoom for Windows, CVSS 9.8): patch to 7.0.0+.
  • CVE-2026-44747 (SAP NetWeaver ABAP, CVSS 9.9): patch immediately.

European Advisories

BSI Emergency Advisory — WordPress “wp2shell” (2026-07-18): The BSI has published an emergency IT security notification confirming that public exploits are now available for CVE-2026-63030 (“WP2Shell”) and CVE-2026-60137. The advisory describes the attack chain: CVE-2026-60137 is a SQL injection via the unsanitized author__not_in parameter in WP_Query; CVE-2026-63030 exploits the WordPress REST API and, when chained with the SQLi, enables unauthenticated remote code execution. The BSI explicitly flags the PoC availability as elevating urgency. Update to WordPress 6.9.5 or 7.0.2 immediately. Full technical detail covered in Critical Vulnerabilities (STATUS CHANGE entry above). BSI Advisory

No new BSI WID or CERT-EU advisories were published in the last 24 hours beyond the WordPress emergency notification above.

Previously reported BSI advisories (ONGOING): WID-SEC-2026-2400 (Moodle/M365 plugin), WID-SEC-2026-2398 (Chrome), WID-SEC-2026-2393 (Ubuntu Pro client), WID-SEC-2026-2390 (nginx-ui) — apply vendor patches if not yet done.

Active Threats and Campaigns

STATUS CHANGE — ACR Stealer (enterprise surge): Microsoft has issued a formal warning of a significant surge in ACR Stealer activity targeting enterprise customers. The malware exfiltrates browser-stored passwords, live authentication tokens, and Microsoft 365 documents including OneDrive/SharePoint-synced files, delivered via ClickFix social engineering lures. This represents a material escalation from the campaign first noted yesterday. Prioritize blocking ClickFix-style lures via browser policy; hunt for unexpected mshta.exe, wscript.exe, or PowerShell execution from user-interactive processes; review M365 audit logs for anomalous OAuth token usage. Bleeping Computer

ONGOING — NadMesh Botnet: actively targeting exposed AI services (Langflow, ComfyUI, Ollama, n8n); harvesting cloud credentials; audit internet exposure of all AI/ML endpoints.

ONGOING — ViteVenom / ChainVeil: malicious npm packages targeting Vite ecosystem with blockchain-based C2; audit npm dependencies and enforce lockfile integrity.

ONGOING — UAT-11795 / Starland RAT: trojanized WebEx/Zoom installers, European targets confirmed; verify installer integrity.

Security News and Context

7-Zip RCE (CVE not yet assigned): Version 26.02 patches a remote code execution flaw triggered by opening specially crafted compressed archives. Update 7-Zip across all endpoints immediately. Bleeping Computer

WordPress wp2shell public exploits: Public exploit code is now circulating for the unauthenticated RCE chain; patch urgency is critical. Bleeping Computer / Heise Security

  1. Patch VMware Avi Load Balancer across all affected branches (22.x, 30.x, 31.x, 32.x) — unauthenticated auth bypass (CVE-2026-47865, EPSS 0.67) chains with RCE; restrict control plane network access immediately as interim measure.
  2. Verify WordPress auto-updates completed to 6.9.5 / 7.0.2 on all internet-facing sites — public exploits for wp2shell (CVE-2026-63030) now confirmed; manual verification required.
  3. Update 7-Zip to version 26.02 on all endpoints — RCE via malicious archive files, no user privilege required beyond opening a file.
  4. Upgrade `@fastify/http-proxy` to 11.6.0+ (CVE-2026-16117, CVSS 10.0) — audit all Node.js API gateway deployments using this library for prefix-bypass exposure.
  5. Hunt for ACR Stealer indicators — review EDR telemetry for ClickFix delivery chains; audit M365 OAuth tokens and browser credential stores on potentially affected endpoints.
  6. Confirm Fortinet FortiSandbox and SharePoint patches applied — CISA KEV deadlines were today (2026-07-19); escalate any outstanding remediation immediately.
  7. Rotate credentials and audit access logs on any VMware Avi Load Balancer deployments — CVE-2026-47871 (EPSS 0.90) may have enabled pre-patch directory traversal to extract secrets.
  8. Continue remediation of previously reported items: LegacyHive (Windows LPE, no patch — maintain EDR monitoring), IBM Langflow OSS CVE-2026-9198 cluster, CVE-2026-15409 (SonicWall), CVE-2026-53412 (Zoom), CVE-2026-44747 (SAP NetWeaver).