Thursday, September 3, 2026 | Jonathan Brown

Switchvox exploitation expands after disclosure of an unauthenticated RCE

Horizon3 reported on September 1 that attackers were exploiting CVE-2026-9586 against internet-exposed Sangoma Switchvox systems. The flaw is an unauthenticated SQL injection in the /pa endpoint: crafted XML can place attacker-controlled input into a PostgreSQL query, and the resulting database access can be converted into operating-system command execution. Sangoma fixed the issue in Switchvox 8.4.0.2 on July 14.

The first validated attempts, seen on August 30, came from one address and tried to launch reverse shells and enumerate running processes. In a September 2 update, Horizon3 told Help Net Security that dozens of additional source addresses had since reached its honeypots, ranging from scanners to systems installing second-stage malware. One payload appeared, on cursory review, to be a cryptocurrency miner; that payload assessment remains preliminary.

Inventory every exposed Switchvox deployment, move it to 8.4.0.2 or a later supported release, and restrict access to the management surface and /pa wherever an immediate upgrade is impossible. Review /var/log/switchvox/db-quirks.log for injected SQL and command execution. If evidence is present, isolate the appliance and treat it as a possible internal foothold rather than assuming the patch removes an existing compromise.

Watch for: CISA Known Exploited Vulnerabilities catalog action, additional payload analysis, new source infrastructure, and evidence that attackers are harvesting appliance or integration credentials.

Sources: Horizon3 attack research; Sangoma 8.4.0.2 release notes; Help Net Security update

Cleo Harmony research chains SAML and token flaws to host command execution

Armadin published research on September 2 showing how flaws in Cleo Harmony can take a low-privileged user to full administration and then to operating-system command execution through the product's built-in Actions engine. CVE-2026-84114 covers a SAML XML Signature Wrapping flaw, while CVE-2026-84115 covers over-privileged refresh-token issuance and a cross-store identity lookup error. Both were fixed in Harmony 5.8.1.11.

The four-request chain starts with a legitimately signed assertion from a low-privileged login. It then substitutes an asserted identity, obtains a token typed UNI_ADMIN, and causes that token to be resolved against Harmony's separate administrator store. An administrator can invoke the documented SYSTEM action, which runs commands as the account hosting the Cleo service. This is therefore not a stand-alone, unauthenticated RCE claim; the published chain depends on valid low-privilege access and the affected SAML and token flows.

The public record supports proof-of-concept availability, not confirmed exploitation in the wild. Upgrade to 5.8.1.13—the latest build listed in Cleo's 5.8.1 release notes—or a later vendor-supported release, rather than stopping at the minimum fixed build. Review SAML assertions, administrator aliases and recent Actions. Hunt for /api/authentication/refresh requests carrying a bearer token without the expected SSO cookie, followed by rapid creation and execution of Commands actions.

Watch for: scanning or exploitation reports, a Cleo security bulletin with fuller scope, and activity targeting exposed Portal and administrative API paths.

Sources: Armadin technical disclosure; Cleo Harmony 5.8.1 release notes; CVE-2026-84115 record

Cisco fixes root RCE in specified Nexus 9000 models and issues an IOS XR hardening release

Cisco published two distinct critical network-infrastructure advisories on September 2. CVE-2026-20212, scored 9.8, affects the specified Nexus 9000 models containing Silicon One ASICs. TCP ports 43210 and 43211 are reachable in the default Layer 3 VRF, allowing an unauthenticated remote attacker to send crafted input that executes as root or crashes the S1HAL process and reloads the device. Nexus 9000 fabric switches in ACI mode are not affected.

The separate IOS XR hardening release groups multiple internally found flaws under seven CVEs. Cisco says all IOS XR releases, including IOS XR7, are within scope, although the applicable underlying flaw and fix vary by platform, release and functional area. CVE-2026-20274 and CVE-2026-20279 carry maximum scores of 9.8. There are no workarounds for the IOS XR group; most supported trains require the mapped software maintenance updates, while future 26.2.2 and 26.3.1 releases are expected to contain the fixes without SMUs.

Cisco reports no known malicious use of either advisory. For affected Nexus devices, apply a fixed release and use infrastructure ACLs to deny traffic to local addresses on ports 43210 and 43211 as a temporary control; Cisco also offers a Live Protect shield. For IOS XR, use the platform-specific advisory matrix rather than treating a base-version upgrade alone as complete remediation.

Watch for: public exploit code, scanning for the Nexus ports, revisions to Cisco's fixed-release mappings, and operational issues associated with the large IOS XR SMU set.

Sources: Cisco Nexus 9000 advisory; Cisco IOS XR hardening advisory

Jenkins patch release closes controller RCE and high-impact plugin flaws

Jenkins published a broad security advisory on September 2 covering core versions 2.579 and earlier, LTS 2.568.2 and earlier, and numerous plugins. The leading core issue, CVE-2026-84645, lets an attacker who can submit a crafted config.xml nest configuration objects that later handle web requests through Stapler, reaching an improperly protected Script Console and executing code on the controller. The advisory does not characterize this path as unauthenticated.

The plugin findings include controller-level risks. Vulnerable SAML Plugin builds can let a user able to submit certain forms overwrite identity-provider metadata and then authenticate as another user. Performance Plugin can allow a user with Item/Configure to execute code; File Parameter Plugin can write outside its intended path and reach RCE; Allure can expose arbitrary controller files; and ThinBackup can redirect backup writes and include controller files. Parameterized Remote Trigger stores tokens in plaintext and had no fix at publication.

Update Jenkins weekly to 2.580 or LTS to 2.568.3, then reconcile every installed plugin with the advisory's fixed-version list. Disable or remove the unfixed Parameterized Remote Trigger Plugin if feasible and rotate exposed tokens. The advisory does not report active exploitation, but Internet exposure, permissive Overall/Read access and delegated job or form permissions materially increase the reachable attack surface.

Watch for: public proof-of-concept code, anomalous configuration XML, unexpected identity-provider metadata changes, controller file writes, and emergency plugin updates.

Sources: Jenkins Security Advisory 2026-09-02

PostGREShell research narrows the real exposure behind PostgreSQL CVE-2026-6471

Cyera's September 1 technical analysis of CVE-2026-6471 explains how a PostgreSQL account holding the REPLICATION attribute—but not database superuser rights—can choose an arbitrary logical-decoding plugin path and load a shared library as the operating-system account running PostgreSQL. The PostgreSQL project fixed the issue on August 13 in versions 18.6, 17.11, 16.15, 15.19 and 14.24.

Remote exploitability depends on deployment conditions. Logical decoding must be enabled. On Windows, an attacker can point to a remote DLL if the server can reach attacker-controlled SMB; on Linux or macOS, NFS automounting can provide a similar path. Otherwise, the attacker must already have a way to place a library on disk. This is not an unauthenticated RCE, and Cyera's discovery of malicious PostgreSQL plugins in VirusTotal does not by itself demonstrate exploitation of this vulnerability.

Patch supported PostgreSQL branches, remove unneeded REPLICATION rights, restrict replication connections in pg_hba.conf, and block unnecessary outbound SMB and NFS from database servers. Hunt for unusual CREATE_REPLICATION_SLOT activity and plugin names containing path separators or traversal sequences.

Watch for: credible exploitation telemetry, cloud-provider-specific exposure guidance, and evidence connecting malicious plugins to the vulnerable loading path.

Sources: PostgreSQL CVE-2026-6471 advisory; Cyera PostGREShell research

Multiple actors are using the signed Node.js runtime as a malware launcher

Symantec reported on September 3 that multiple threat actors have abused the legitimate, signed node.exe runtime in attacks since February, with victims including government departments, technology companies and hotels. This is not a Node.js vulnerability. Attackers install or stage the normal runtime and place their malicious logic in interpreted JavaScript, sometimes using a Windows Run key to relaunch it at logon.

At an Asian technology company, a ClickFix-style intrusion was followed by repeated blocked attempts to deploy AdaptixC2 and Cobalt Strike. The attackers then downloaded the official Node.js installer, established Run-key persistence and connected to Ethereum RPC gateways, most likely to retrieve configuration or payload data through EtherHiding. Symantec also observed a new Node.js version of AsukaStealer at several Asian hotels. A related U.S. fintech intrusion used shared infrastructure and a similar chain but did not show Node.js activity; Symantec found no credential theft, lateral movement or destructive payload there.

Do not block Node.js indiscriminately in development environments. Instead, identify recent installations on systems with no approved development use, correlate node.exe with user-writable scripts or data files, inspect its parent and child processes, and review Run keys and unexplained blockchain-RPC traffic. The installation context is a stronger signal than the signed binary alone.

Watch for: new Node.js payload families, expanded targeting, updated indicators, and ransomware deployment following C2Looper or related footholds.

Sources: Symantec Threat Hunter Team; The Hacker News

FBI investigates a market claiming 153 million North American driver’s license images

The FBI said on September 2 that it was examining reports of tens of millions of U.S. and Canadian driver's-license images being sold through a dark-web service called Nexus. KrebsOnSecurity, which discovered the service on September 1, reported that its operator claimed more than 153 million license scans, plus other identity, travel and medical documents. That figure is the seller's claim, not a confirmed victim count.

Krebs validated records with nine people and observed the listed license total increase by nearly 400,000 in 24 hours, evidence consistent with an actively refreshed data source. The suspected upstream source remains unresolved: Reuters could not establish it, and identity-verification provider IDScan.net said it was investigating. Nexus disappeared shortly after the report was published.

Organizations that collect identity images should identify every processor and subprocessor that stores them, confirm retention and deletion controls, and prepare for replay of authentic document images in account-recovery and know-your-customer workflows. Static possession of an ID scan should not be treated as sufficient proof of identity.

Watch for: confirmation from an affected provider, a defensible deduplicated record count, breach notices, regulator action, and fraud campaigns using the images.

Sources: KrebsOnSecurity investigation; Reuters

Thomson Reuters discloses C-Track court-file breach across North America

Thomson Reuters and affected courts disclosed on September 2 that an unauthorized party obtained C-Track files in March from an environment supporting court case-management services. The incident reaches appellate or other court systems in 11 U.S. states, the U.S. Virgin Islands and Ontario. Thomson Reuters detected unauthorized activity on June 30 and says it contained and secured the environment with outside experts and law enforcement.

The information exposed varies by court and remains under review. Notices say a subset of records contained names and personal information; the Canadian notice adds that confidential, redacted or sealed material may have been involved for some courts. Thomson Reuters reports no operational disruption to C-Track and no evidence to date of fraud or misuse. Ontario's courts also report no indication that court financial-transaction systems were affected.

Court administrators should preserve vendor and local access records, identify affected exports and backups, and map each file set to its notification obligations rather than applying one aggregate scope to every jurisdiction. Organizations whose legal matters appear in affected systems should route notices to privacy, legal and identity-fraud teams.

Watch for: court-specific scope findings, numbers of affected people, file dates and types, actor or access-vector attribution, and evidence of misuse.

Sources: U.S. C-Track notification; Ontario courts statement; Reuters

Luminis Health disruption now includes reported care diversions and canceled treatment

Luminis Health said on September 1 that a cybersecurity incident had made certain systems unavailable across its Maryland organization and could affect operations. By September 2, WBAL-TV reported that Anne Arundel Medical Center had canceled some treatments and redirected patients to other hospitals.

The health system has not publicly identified an entry vector, named ransomware, confirmed data theft or set a restoration timetable. Its own notice asks patients to call before appointments and says the effect on patient information remains under investigation. The care-impact details should therefore remain attributed to WBAL rather than presented as a complete systemwide accounting.

Healthcare organizations should verify downtime access to medication, laboratory, imaging and scheduling information; monitor emergency-access accounts; and preserve logs before rebuilding dependent systems. Restoration priorities should be driven by clinical safety while forensic validation determines which systems can return without reintroducing the incident.

Watch for: an official operational update, confirmed restoration milestones, a ransomware or extortion claim, evidence of protected-health-information exposure, and changes in diversion status.

Sources: Luminis Health incident update

Jonathan Brown writes independent, decision-focused analysis on cybersecurity, infrastructure resilience, and operational risk, with an emphasis on primary-source verification and explicit uncertainty.

Support this work by sharing the briefing with operators who can act on it. Corrections supported by primary evidence are welcomed; material errors should be amended transparently. Feel free to subscribe, comment, or buy us a coffee! Thanks.

© 2026 Border Cyber Group. All rights reserved.