August 27, 2026 | Jonathan Brown

Command View

Verification cutoff

13:56 UTC, August 27, 2026. This edition prioritizes confirmed exploitation affecting Citrix NetScaler, Microsoft SQL Server, Ajax.NET Professional, Zimbra, and Gitea; a documented web-server campaign using several of the newly added KEV vulnerabilities; two critical Next.js code-execution paths; and an unpatched industrial gateway used in energy and manufacturing environments.

Priority posture

  • RED: Active exploitation affects NetScaler gateways, unpatched legacy SQL Server installations, vulnerable Ajax.NET applications, qualifying Zimbra servers, and Gitea source-control systems. These require remediation plus compromise assessment.
  • AMBER: Next.js disclosed two critical unauthenticated code-execution paths. Ebyte industrial gateways remain exposed to multiple administrative and authentication failures without a confirmed patch.
  • WATCH: TeamViewer Linux clients require updates for a user-assisted command-injection path. Three older Linux and Red Hat privilege-escalation vulnerabilities are being used after attackers establish an initial foothold.
  • CONTEXT: Cisco Talos’s UAT-10147 reporting demonstrates how old application and local-privilege flaws are being assembled into automated Windows and Linux web-server intrusion chains.

Today’s decisions

  • RED — Network and identity teams: Upgrade affected NetScaler ADC and Gateway appliances immediately. Preserve configurations and logs, identify Gateway and AAA virtual servers, and investigate unexpected processes, files, sessions, configuration changes, and outbound connections.
  • RED — Database and incident-response teams: Identify SQL Server systems lacking the applicable July 2019 update for CVE-2019-1068. Review database-engine child processes and service-account activity, particularly where application or user accounts could submit queries.
  • RED — Web application teams: Identify applications containing Ajax.NET Professional or derivative packages. Upgrade supported AjaxNetProfessional deployments to 21.11.29.1 or later; remove or replace vulnerable packages for which the maintainer lists no patched release.
  • RED — Messaging administrators: Upgrade qualifying Zimbra systems to 10.1.20 or later and treat previously exposed vulnerable servers as suspected compromises. Use CERT Polska’s published log and filesystem checks during investigation.
  • RED — DevOps and supply-chain owners: Upgrade Gitea to 1.27.1 or later. Audit repository hooks, temporary directories, diffpatch activity, service-account processes, build outputs, and CI/CD secrets.
  • AMBER — Application engineering: Upgrade affected Next.js applications to 15.5.24, 16.3.3, or a later supported version, then rebuild and redeploy production artifacts.
  • AMBER — OT engineering: Isolate Ebyte NE2-D11 gateways running FW-9167-0-11. Remove public access, restrict management to controlled administration paths, and monitor for a vendor firmware update.

Threat and Resilience Ledger

RED — Network edge and identity | Global — NetScaler exploitation confirmed as researchers demonstrate an RCE path

CISA added CVE-2026-8452 to its Known Exploited Vulnerabilities catalog on August 26, setting an August 29 federal remediation deadline. Citrix describes the flaw as a memory overflow causing unpredictable behavior or denial of service when NetScaler ADC or Gateway is configured as a Gateway—SSL VPN, ICA Proxy, clientless VPN, or RDP Proxy—or as an AAA virtual server. Citrix rates it 8.8 under CVSS 4.0. WatchTowr reported converting the vulnerable code path into unauthenticated root-level remote code execution, while Bishop Fox independently verified a remotely reachable SAML-parser heap overflow with potential code-execution consequences. Citrix’s bulletin continues to describe the official impact as denial of service.

Affected releases are NetScaler ADC and Gateway 14.1 before 14.1-72.61 and 13.1 before 13.1-63.18, NetScaler ADC 14.1-FIPS before 14.1-72.61 FIPS, and NetScaler ADC 13.1-FIPS or NDcPP before 13.1-37.272. Citrix-managed cloud services have already been updated; the bulletin applies to customer-managed appliances.

Several security firms reported on August 27 that attackers were attempting to deploy x.php and z.php web shells and execute discovery commands such as id and echo. Those reports are operationally credible but had not been corroborated by Citrix or CISA or accompanied by a complete public indicator set by the cutoff. Operators should upgrade, retain evidence, enumerate active sessions and accounts, compare configurations against known-good records, and investigate appliance-originated connections.

Evidence: confirmed exploitation; independently demonstrated or verified memory corruption with an RCE path; post-exploitation web shells reported but not yet independently confirmed.
Attribution: unknown.
Confidence: high on exploitation and vulnerability scope; moderate on the newly reported web-shell activity.
Uncertainty: CISA has not published victim scope, payloads, indicators, or post-exploitation telemetry.
Sources: CISA — “CISA Adds Six Known Exploited Vulnerabilities to Catalog,” August 26, 2026; Citrix — “NetScaler ADC and NetScaler Gateway Security Bulletin for CVE-2026-8451, CVE-2026-8452, CVE-2026-8655, CVE-2026-10816, CVE-2026-10817, and CVE-2026-13474,” updated July 20, 2026; watchTowr Labs — “You’re Back In The Room: Citrix NetScaler Pre-Auth RCE CVE-2026-8452(?),” August 14, 2026; Bishop Fox — “No Crash Required: Verifying the Citrix NetScaler SAML Patch for CVE-2026-8452,” August 21, 2026.

RED — Database infrastructure | Global — Exploited SQL Server flaw converts query access into operating-system code execution

CISA added CVE-2019-1068 to KEV on August 26, with an August 29 federal deadline. The vulnerability arises when SQL Server improperly processes internal functions. An authenticated database user can submit a crafted query and execute code in the context of the SQL Server Database Engine service account.

Authentication does not make that behavior expected or authorized. A user may legitimately possess permission to execute database queries without possessing authority to execute arbitrary operating-system code under the more powerful Database Engine identity. The vulnerability therefore creates a privilege-boundary failure between database permissions and the host service account.

Microsoft’s affected servicing branches included SQL Server 2014 SP2 and SP3, SQL Server 2016 SP1 and SP2, and SQL Server 2017 RTM. The applicable July 2019 updates are KB4505217 or KB4505419 for SQL Server 2014 SP2; KB4505218 or KB4505422 for SQL Server 2014 SP3; KB4505219 or KB4505221 for SQL Server 2016 SP1; KB4505220 or KB4505222 for SQL Server 2016 SP2; and KB4505224 or KB4505225 for SQL Server 2017, depending on whether the installation follows the General Distribution Release or Cumulative Update servicing branch.

Administrators should verify the installed build or KB rather than infer safety from the major version. Investigation should cover suspicious queries, service-account logons, SQL Server child processes, credential access, scheduled tasks, and lateral movement originating from database hosts.

Evidence: confirmed exploitation through CISA KEV; vulnerability behavior and security updates confirmed by Microsoft.
Attribution: unknown.
Confidence: high.
Uncertainty: CISA has not disclosed which SQL Server versions are being attacked, how attackers obtain the required database credentials, or whether CVE-2019-1068 is being chained with an external entry vulnerability.
Sources: CISA — “CISA Adds Six Known Exploited Vulnerabilities to Catalog,” August 26, 2026; Microsoft — “CVE-2019-1068: Microsoft SQL Server Remote Code Execution Vulnerability,” July 9, 2019; Microsoft — July 2019 SQL Server security updates; NIST NVD — “CVE-2019-1068.”

RED — Web application infrastructure | Global — Ajax.NET exploitation tied publicly to UAT-10147 campaign

CISA added CVE-2021-23758 to KEV on August 26, with a September 9 federal deadline. Ajax.NET Professional’s custom deserializer permits attacker-controlled data to instantiate arbitrary .NET classes, enabling unauthenticated remote code execution when a vulnerable Ajax.NET endpoint is reachable.

Cisco Talos separately reported that UAT-10147—a Chinese-speaking, financially motivated intrusion group—used CVE-2021-23758 among the publicly known vulnerabilities weaponized against Windows and Linux web servers. Talos observed the group deploying Meterpreter and other implants, conducting data theft and search-engine-optimization fraud, and using AI-assisted tooling to automate exploitation, validation, troubleshooting, and persistence. CISA did not state that Talos’s campaign was the specific basis for KEV inclusion, so the relationship should not be presented as confirmed government attribution.

Package identity matters for remediation. GitHub’s reviewed advisory lists AjaxNetProfessional versions through 21.11.29 as affected and 21.11.29.1 as patched. The maintainer’s advisory lists no patched release for the separate AjaxPro.2, Joint.AjaxPro, or JointAjax.AjaxPro NuGet packages; the CVE record describes all AjaxPro.2 versions as vulnerable. Those packages should be removed, replaced, or migrated to a verified corrected distribution rather than assumed safe because a similarly named project has a patch.

Search deployed application directories and loaded assemblies, not only current source manifests. Investigate exposed servers for suspicious Ajax.NET requests, IIS worker processes spawning command interpreters, unexpected DLLs, web shells, scheduled tasks, Defender exclusions, and outbound connections.

Evidence: confirmed exploitation through CISA KEV; exploitation by UAT-10147 reported directly by Cisco Talos.
Attribution: public assessment linking observed exploitation to UAT-10147; CISA attribution unknown.
Confidence: high on exploitation and package risk; moderate-to-high on Talos’s campaign assessment.
Uncertainty: It is unknown whether all current exploitation belongs to UAT-10147 or which commercial and internal applications still bundle the vulnerable derivative packages.
Sources: CISA — “CISA Adds Six Known Exploited Vulnerabilities to Catalog,” August 26, 2026; Cisco Talos — “UAT-10147: Chinese-Speaking Adversary Integrates Agentic AI into Post-Compromise Operations,” August 20, 2026; GitHub Security Advisory — “Remote Code Execution in AjaxNetProfessional,” updated February 3, 2026; Ajax.NET Professional — GHSA-6r7c-6w96-8pvw; Mogwai Labs — “Unauthenticated Remote Code Execution in Ajax.NET Professional,” December 2021.

RED — Messaging and collaboration | Global — At least 274 Zimbra servers identified as compromised

The Shadowserver Foundation reported on August 24 that 274 Zimbra instances displayed compromise associated with CVE-2026-73570 exploitation. This materially strengthens the earlier active-exploitation warning from CERT Polska and CISA.

The vulnerability affects Zimbra Collaboration before 10.1.20 when SNMP notifications are enabled through snmp_notify and the swatchdog service is running. CERT Polska notes that swatchdog is enabled by default. A remote unauthenticated attacker can trigger operating-system command execution as the zimbra user. Zimbra fixed the vulnerability in 10.1.20, and NVD rates it 8.9.

CERT Polska recommends searching /var/log/zimbra.log for malicious content embedded in Service status change messages and examining files created by the zimbra user during the preceding 30 days in /opt/zimbra/jetty/webapps/, /opt/zimbra/jetty_base/webapps/, and /tmp/. These are actionable investigation points, not substitutes for a complete forensic examination. Operators should also examine authentication artifacts, unauthorized keys, web shells, persistence, mailbox access, and credentials or tokens available to the service.

Evidence: confirmed exploitation; externally observed compromise; vendor patch available.
Attribution: unknown.
Confidence: high that the identified systems displayed compromise indicators; moderate that every observed compromise resulted exclusively from this vulnerability.
Uncertainty: The complete victim population, payloads, persistence mechanisms, degree of mailbox access, and responsible operators remain unknown.
Sources: Shadowserver Foundation — “Alert! Zimbra compromises associated with CVE-2026-73570 exploitation are spreading,” August 24, 2026; CERT Polska — “Aktywnie wykorzystywana podatność w Zimbra Collaboration Suite,” August 17, 2026; Zimbra — “Zimbra Security Advisories”; NIST NVD — “CVE-2026-73570.”

RED — Source control and CI/CD | Global — Gitea exploitation threatens repositories, secrets, and downstream builds

CVE-2026-60004 remains an immediate supply-chain concern ahead of CISA’s August 28 federal deadline. The vulnerability affects Gitea 1.17 through 1.27.0 and is fixed in 1.27.1. Gitea’s advisory assigns a CVSS score of 9.8.

An attacker with ordinary repository write access can abuse the diffpatch API to install and execute a Git hook under the Gitea operating-system account. The trigger also requires Git 2.32 or later, an enabled diffpatch route, and a writable and executable temporary filesystem. Open registration is required only for the no-prior-credentials path: on a default installation permitting self-registration, an external visitor can create an account and repository and thereby obtain the required write access.

One publicly reported incident used the vulnerability to deploy a dropper whose behavior and associated CPU consumption were consistent with cryptojacking. The next-stage binary was not fully analyzed, so the exact malware, wallet, pool, and operator remain unconfirmed.

Operators should upgrade, audit temporary and repository hook directories, inspect diffpatch requests and Gitea child processes, validate repository and release integrity, and rotate database credentials, OAuth secrets, runner tokens, deployment keys, package-registry credentials, and signing material reachable from the compromised service.

Evidence: confirmed exploitation; public proof of concept; one reported miner-like deployment.
Attribution: unknown.
Confidence: high on the vulnerability and exploitation; moderate on the nature of the reported payload.
Uncertainty: It is unknown whether other campaigns have targeted private source code, deployment credentials, or build outputs rather than cryptocurrency.
Sources: CISA — Known Exploited Vulnerabilities catalog entry for CVE-2026-60004, August 25, 2026; Gitea — “Gitea 1.27.1 Is Released,” July 27, 2026; Gitea — “Remote Code Execution via diffpatch Git Hook Installation,” GHSA-rcr6-4jqh-j84m, July 28, 2026; public incident report, August 2026.

WATCH — Linux privilege escalation | Global — UAT-10147 uses three newly added KEVs after web-server compromise

CISA’s August 26 additions included CVE-2022-0995 in the Linux kernel, CVE-2015-5287 in Red Hat’s Automatic Bug Reporting Tool, and CVE-2015-3246 in libuser. Cisco Talos observed UAT-10147 using all three after establishing access to Linux web servers.

CVE-2022-0995 is an out-of-bounds write in the Linux kernel’s watch_queue notification mechanism that can allow an unprivileged local user to escalate privileges. CVE-2015-5287 abuses improper symbolic-link handling in ABRT’s sosreport functionality. CVE-2015-3246 affects libuser file handling and can be abused to corrupt /etc/passwd and obtain root access. CISA gives all three a September 9 federal deadline.

These are not unauthenticated remote-entry vulnerabilities, but they become urgent when an internet-facing application server is vulnerable to RCE or may already contain a web shell. Operators should match distribution-specific packages and kernels, patch affected systems, and examine suspected web-server compromises for escalation to root.

Evidence: confirmed exploitation through CISA KEV; direct campaign observation by Cisco Talos.
Attribution: public assessment linking observed use to UAT-10147; broader exploitation unknown.
Confidence: high.
Uncertainty: CISA has not identified which campaign or evidence prompted each KEV addition, and other actors may also be using the public privilege-escalation exploits.
Sources: CISA — “CISA Adds Six Known Exploited Vulnerabilities to Catalog,” August 26, 2026; Cisco Talos — “UAT-10147: Chinese-Speaking Adversary Integrates Agentic AI into Post-Compromise Operations,” August 20, 2026; NIST NVD records for CVE-2022-0995, CVE-2015-5287, and CVE-2015-3246.

AMBER — Web application platforms | Global — Next.js patches two critical unauthenticated RCE paths

Next.js published an August 25 security release correcting two critical vulnerabilities capable of unauthenticated remote code execution.

CVE-2026-75604, scored 9.0 under CVSS 3.1, affects Windows-hosted applications using the Pages Router or App Router without Cache Components. Affected versions are Next.js 13.4 through releases before 15.5.24 and Next.js 16.0 through releases before 16.3.3. There is no known workaround for affected Windows-hosted applications.

GHSA-2xp9-vwfh-vxw4, scored 9.5 under CVSS 4.0, affects the Next.js Image Optimization API when it processes AVIF files through the underlying libheif and sharp dependency path. It affects Next.js 10.0.0 through releases before 15.5.24 and the relevant 16.x releases before 16.3.3. The project disabled AVIF optimization until the corrected dependency propagated.

Both issues are fixed in 15.5.24 and 16.3.3. No confirmed in-the-wild exploitation was identified by the cutoff, although public discussion and defensive WAF rules are now available. Administrators should upgrade, rebuild, redeploy, verify the package version inside the running workload, and remove vulnerable replicas and rollback images.

Evidence: confirmed vulnerabilities; vendor patches available; no confirmed exploitation.
Attribution: not applicable.
Confidence: high.
Uncertainty: Public exploit maturity and the number of directly exposed self-hosted deployments remain unknown. Hosting-provider architecture can remove or alter the vulnerable execution path.
Sources: Next.js — “August 2026 Security Release,” August 25, 2026; GitHub Security Advisory — GHSA-p293-qw3h-jr36; GitHub Security Advisory — GHSA-2xp9-vwfh-vxw4; Cloudflare — “WAF Release — 2026-08-26 — Emergency,” August 26, 2026.

AMBER — Industrial gateways | Global — Ebyte gateway exposes an unpatched administrative control path

CISA’s August 25 advisory documents eleven vulnerabilities in the Ebyte NE2-D11 running firmware FW-9167-0-11. The device bridges serial and IP-connected equipment and is deployed worldwide in critical manufacturing and energy environments.

CVE-2026-73125, rated 9.8 under CVSS 3.1, concerns inconsistent authentication enforcement in the web management interface. An unauthenticated remote attacker can obtain sensitive configuration information, modify settings, or disrupt device availability. The remaining findings concern cleartext communications, weak credential protection, client-side authentication, sensitive information in query strings, cross-site request forgery, inadequate authorization, insufficient login throttling, and interface-framing weaknesses.

Ebyte acknowledged the reports and indicated that a patch was under development, but no corrected firmware was confirmed by the cutoff. CISA reports no known public exploitation. Operators should remove the management interface from public and general enterprise networks, restrict access through a controlled jump host or VPN, change exposed credentials, capture a verified configuration, and monitor for unauthorized changes.

Evidence: confirmed vulnerabilities; no confirmed exploitation.
Attribution: not applicable.
Confidence: high.
Uncertainty: Patch availability, installed population, internet exposure, forensic logging, and downstream control consequences remain unclear.
Sources: CISA — “ICSA-26-237-06: Ebyte NE2-D11,” August 25, 2026; CISA CVE record — CVE-2026-73125.

TeamViewer published bulletin TV-2026-1009 on August 26 for CVE-2026-19042, an 8.8-rated command-injection vulnerability in TeamViewer Full Client and Host for Linux before 15.81.5.

An attacker can send a crafted URL through out-of-session chat and execute commands in the current user’s context if the recipient clicks the link. Sending the message requires the attacker to be in the recipient’s contact list or for the recipient to have enabled messages from users outside that list. External messaging is disabled by default.

TeamViewer Remote, Tensor, and ONE deployments using Linux clients should move to 15.81.5 or later. The interaction and messaging prerequisites prevent RED classification, but the issue remains important on privileged administration workstations and unattended-access hosts.

Evidence: confirmed vulnerability; vendor patch available; no confirmed exploitation.
Attribution: not applicable.
Confidence: high.
Uncertainty: No campaign telemetry or installed-population data was reported.
Sources: TeamViewer — “TV-2026-1009: Command Injection in TeamViewer Clients for Linux through Chat Link Handling,” August 26, 2026.

Defensive Posture Changes

Treat edge and collaboration updates as incident-response events

NetScaler, Zimbra, and Gitea can hold or broker privileged sessions, credentials, repositories, communications, and access to downstream systems. If an affected service was exposed while exploitation was occurring, remediation should include evidence preservation, integrity comparison, account and token review, process inspection, and validation of dependent systems.

Map authenticated access to actual authority

SQL Server and Gitea illustrate why “authenticated” can obscure operational severity. A database user authorized to submit queries is not authorized to execute operating-system code under the Database Engine account. A repository writer is not authorized to install executable hooks in server-controlled temporary storage.

Resolve package identity before claiming remediation

Ajax.NET has multiple similarly named packages with different maintenance status. Verify the exact assembly and package deployed. Updating AjaxNetProfessional does not automatically remediate applications still bundling AjaxPro.2 or an unsupported derivative.

Correlate remote entry with local escalation

Talos’s UAT-10147 evidence connects web-server RCE with a catalogue of old Linux privilege-escalation exploits. On a server with suspected application compromise, missing local patches should influence containment and forensic assumptions even when those vulnerabilities are not themselves remotely reachable.

Validate software inside running workloads

For Next.js and Ajax.NET, inspect deployed containers, application directories, assemblies, server bundles, and archived release images. A corrected source repository or lockfile does not prove the production runtime was rebuilt and replaced.

Protect control-path integrity after repository compromise

If Gitea exploitation cannot be excluded, validate commits, tags, release archives, CI definitions, container images, packages, deployment manifests, signing operations, and runner registrations. Rotate secrets only after the platform has been returned to a trusted state.

Regional and Sector Pulse

North America — RED

The new KEV entries affect edge, database, web-application, and Linux infrastructure. Federal deadlines fall on August 28 for Gitea and August 29 for NetScaler and SQL Server. Talos identified affected UAT-10147 servers in Canada, while the actor’s broader target list was global.

Europe and the United Kingdom — RED

CERT Polska supplied detailed confirmation and investigation guidance for the Zimbra campaign. Self-hosted Zimbra installations used by government, education, service providers, and privacy-sensitive organizations remain the clearest regional operational concern.

Indo-Pacific — AMBER

Talos identified UAT-10147 activity affecting systems in China and Vietnam and assesses the operator as Chinese-speaking and financially motivated. This is behavioral and linguistic attribution, not a state-sponsorship finding. Ebyte’s industrial gateway exposure is worldwide and should not be converted into a China-specific campaign claim.

Latin America and the Caribbean — WATCH

Talos identified affected UAT-10147 servers in Brazil and Bolivia. That confirms regional victim presence but not a regionally exclusive campaign. The same application and post-compromise techniques apply globally.

Middle East and Africa — WATCH

No distinct campaign or victim set was confirmed by the cutoff. Global exposure remains applicable wherever affected products are internet-facing or embedded in legacy applications.

Vulnerability and Supplier Watchlist

Citrix NetScaler ADC and NetScaler Gateway

Issue: CVE-2026-8452, actively exploited memory corruption with an independently demonstrated RCE path.
Affected scope: Gateway or AAA configurations on 14.1 before 14.1-72.61, 13.1 before 13.1-63.18, and the specified FIPS and NDcPP branches.
Fixed release: 14.1-72.61, 13.1-63.18, 14.1-72.61 FIPS, or 13.1-37.272 as applicable.
Severity: CVSS 4.0 8.8.
Status: RED — actively exploited edge exposure; federal deadline August 29.

Microsoft SQL Server

Issue: CVE-2019-1068, authenticated crafted-query RCE under the Database Engine service account.
Affected scope: Unpatched SQL Server 2014 SP2 or SP3, 2016 SP1 or SP2, and 2017 RTM servicing branches.
Fixed release: Applicable July 2019 GDR or CU security update.
Severity: CVSS 3.0 8.8.
Status: RED — confirmed exploitation; federal deadline August 29.

Ajax.NET Professional

Issue: CVE-2021-23758, unsafe deserialization permitting unauthenticated RCE.
Affected scope: AjaxNetProfessional through 21.11.29; vulnerable AjaxPro.2 and derivative packages embedded in reachable applications.
Fixed release: AjaxNetProfessional 21.11.29.1; no patched release listed for AjaxPro.2, Joint.AjaxPro, or JointAjax.AjaxPro.
Severity: CVSS 3.1 9.8.
Status: RED — confirmed exploitation and documented UAT-10147 use.

Zimbra Collaboration

Issue: CVE-2026-73570, unauthenticated command injection through SNMP notification processing.
Affected scope: Releases before 10.1.20 with the vulnerable SNMP-notification condition.
Fixed release: 10.1.20.
Severity: CVSS 8.9.
Status: RED — active exploitation and hundreds of observed compromises.

Gitea

Issue: CVE-2026-60004, code execution through diffpatch and Git-hook installation.
Affected scope: Gitea 1.17 through 1.27.0; specific Git, route, filesystem, and repository-write prerequisites apply.
Fixed release: 1.27.1.
Severity: CVSS 9.8.
Status: RED — active exploitation with supply-chain consequences; federal deadline August 28.

Next.js

Issue: CVE-2026-75604 and GHSA-2xp9-vwfh-vxw4, unauthenticated RCE through Windows-hosted routing/cache behavior or AVIF image optimization.
Affected scope: Configuration-dependent Next.js releases before 15.5.24 or 16.3.3.
Fixed release: 15.5.24 or 16.3.3 and later supported versions.
Severity: CVSS 9.0 and 9.5 respectively.
Status: AMBER — critical pre-authentication paths without confirmed exploitation.

Ebyte NE2-D11

Issue: Eleven vulnerabilities led by CVE-2026-73125.
Affected scope: NE2-D11 firmware FW-9167-0-11.
Fixed release: None confirmed by cutoff.
Severity: Up to CVSS 3.1 9.8.
Status: AMBER — industrial gateway exposure without a confirmed patch.

TeamViewer Linux clients

Issue: CVE-2026-19042, command injection through a crafted chat link.
Affected scope: TeamViewer Full Client and Host for Linux before 15.81.5.
Fixed release: 15.81.5.
Severity: CVSS 8.8.
Status: WATCH — remote administration context, but messaging access and a user click are required.

Outlook and Uncertainty

Next 24 hours

Watch for authoritative confirmation and indicators associated with the reported NetScaler web-shell deployments; details explaining how attackers obtain the authenticated access required for CVE-2019-1068; growth in Shadowserver’s Zimbra compromise count; additional Gitea campaigns; public Next.js exploit material; and an Ebyte firmware release.

What is not known

CISA has not disclosed the victim populations or complete telemetry behind its six August 26 KEV additions. Talos explains observed exploitation of Ajax.NET and three local Linux or Red Hat vulnerabilities, but CISA has not confirmed that UAT-10147 supplied the evidence for those additions.

The actors, persistence, payloads, and data access associated with the Zimbra and Gitea campaigns remain incompletely documented. No public exploitation has been confirmed for the Next.js, Ebyte, or TeamViewer vulnerabilities.

Trigger for escalation

Escalate Next.js upon verified in-the-wild exploitation or reliable public exploit code against common production configurations.

Escalate Ebyte upon confirmed remote exploitation, discovery of exposed management interfaces in operational environments, unauthorized configuration changes, or proof that gateway compromise can manipulate downstream industrial processes.

Broaden the SQL Server response if exploitation is shown to use compromised application accounts at scale or if an unauthenticated entry chain emerges. Broaden NetScaler compromise assessment if CISA, Citrix, or multiple independent telemetry providers confirm persistent root-level access, credential theft, or repeatable web-shell deployment.

Jonathan Brown is a cybersecurity researcher and investigative journalist at bordercybergroup.com.

If you would like to support our work — useful, well-researched, ad-free cybersecurity intelligence — subscribe, comment, or buy us a coffee! Thanks.