Cyware Daily Threat Intelligence - August 11, 2026
Ransomware gangs are slashing through enterprise defenses by chaining critical vulnerabilities in remote management and access platforms, with over 8,500 SharePoint servers exposed online and attackers leveraging authentication bypasses to push encryption across entire fleets. Cyware spotlights how a single unpatched system can become the launchpad for widespread disruption.
Attackers are turning trusted IT tools into attack vectors, exploiting flaws in SonicWall SMA1000 appliances and N-Central consoles to gain unauthorized access and deploy ransomware. With vendor hotfixes available, the window for exploitation remains open as hundreds of devices stay unpatched.
State-linked threat actors are blending social engineering with technical exploits, luring defense and IT professionals into opening weaponized documents or downloading trojanized VPNs. These campaigns, tracked by multiple security firms, show how persistent access and data theft can begin with a single job offer or recruiter message.
Top Malware Reported in the Last 24 Hours
CVE-2026-45659 hits SharePoint with ransomware
CVE-2026-45659 is a high-severity remote code execution vulnerability in Microsoft SharePoint that enables ransomware deployment. CVE-2026-45659 allows attackers with low privileges to execute arbitrary code on unpatched servers by exploiting deserialization of untrusted data. CVE-2026-45659 provides a fast path from initial access to full service disruption and data loss through encryption. Attackers deliver ransomware by leveraging this flaw on exposed SharePoint instances. CVE-2026-45659 targets organizations running unpatched SharePoint servers, with 8,500 servers exposed online and over 200 still unpatched, according to Shadowserver. CISA added CVE-2026-45659 to the Known Exploited Vulnerabilities Catalog, and a patch is available.
SonicWall SMA1000 flaws feed ransomware
CVE-2026-15409 and CVE-2026-15410 are critical vulnerabilities in SonicWall SMA1000 appliances exploited in ransomware attacks. CVE-2026-15409 is a remote, unauthenticated SSRF flaw (CVSS 10.0) enabling attackers to reach internal or external resources, while CVE-2026-15410 is an administrator-authenticated code injection issue (CVSS 7.2) that deepens attacker control. Attackers use these flaws to gain unauthorized access, exfiltrate data, and deploy ransomware from edge devices. The vulnerabilities are exploited through chained attacks on SMA1000 models 6210, 7210, and 8200v running impacted firmware. SonicWall provides hotfixes for affected versions.
N-Central CVE opens door to StormEncryptor
CVE-2026-18577 is a critical authentication bypass in N-Central that allows unauthenticated attackers to gain admin access and deploy StormEncryptor ransomware. CVE-2026-18577 enables attackers to abuse remote monitoring and management platforms to push ransomware across large device fleets. CVE-2026-18577 is exploited by attackers to compromise a single server and cascade attacks to up to 24,000 managed devices. Microsoft suspects Storm-1175 is leveraging this bug, and British security researcher Kevin Beaumont assisted a government agency affected by the campaign. The issue was discovered on July 31, with a hotfix released on August 2 after an incomplete update for CVE-2026-18556.
Top Vulnerabilities Reported in Last 24 hours
CVE-2026-48907: Joomla JCE extension unauthenticated takeover
CVE-2026-48907 is a critical improper access control vulnerability in the Joomla JCE extension (CVSS 10.0 / 9.8) that allows unauthenticated attackers to execute code and take over affected sites. Successful exploitation lets attackers upload crafted XML files containing malicious PHP, leading to remote code execution. CVE-2026-48907 is actively exploited, with a public Python exploit script available. The vulnerability was disclosed as CWE-284, and enables full compromise, including data theft and service disruption. A fix is available in JCE version 2.9.99.5 or later.
CVE-2026-15409 and CVE-2026-15410: SonicWall SMA1000 vulnerabilities
CVE-2026-15409 (CVSS 10.0) and CVE-2026-15410 (CVSS 7.2) are critical vulnerabilities in SonicWall SMA1000 appliances that enable remote code execution and deeper compromise. Exploitation allows attackers to make unauthorized requests and inject code, leading to ransomware deployment. Attackers are actively exploiting these flaws in ransomware campaigns. CISA and defenders have identified log patterns as indicators of compromise. Vendor hotfixes are available for SMA1000 models 6210, 7210, and 8200v running affected firmware.
CVE-2026-18577: N-Able N-Central authentication bypass
CVE-2026-18577 is a high-severity authentication bypass in N-Able N-Central (CVSS 8.1) that allows attackers to gain unauthorized admin access. Successful exploitation lets attackers use the platform to push ransomware and other actions across customer fleets, with a single server managing up to 24,000 devices. CVE-2026-18577 is already exploited in the wild, with Microsoft attributing activity to Storm-1175 and Kevin Beaumont assisting a government agency. The vulnerability was discovered on July 31, with a hotfix released on August 2, and is linked to an incomplete update for CVE-2026-18556.
Top Threat Actors Reported in Last 24 hours
Lazarus Group pushes job-lure zero-day
Lazarus Group (also tracked as Operation Dream Job) is a suspected North Korea-attributed threat actor focused on espionage and data theft. Lazarus Group uses fake job offers to deliver a Windows zero-day (CVE-2026-68820) into defense-related networks. Lazarus Group operates two infection chains: one leverages DLL sideloading with a bundled PDF viewer leading to MISTPEN and ForestTiger backdoor, while another uses a trojanized SecurityPDF viewer to load the Troy backdoor. Lazarus Group targets defense, aerospace, and aviation organizations. The campaign uses weaponized PDFs and trojanized viewers as access vectors. Lazarus Group blends command-and-control into compromised websites and webmail servers, using RelayShell and supports file operations, process management, and in-memory DLL injection.
Storm-1175 hits MSPs via N-central
Storm-1175, a suspected China-linked threat actor, is motivated by ransomware deployment and supply chain compromise. Storm-1175 exploits CVE-2026-18577 in the N-central RMM console to gain unauthenticated server access. Storm-1175 uses this access to deploy ransomware and reach downstream client environments. Storm-1175 targets managed service providers and their customer organizations. The campaign leverages a critical authentication bypass as the access vector. Storm-1175 activity was first detected on July 31, with emergency hotfixes issued on August 2 and August 6, but many servers remain unpatched.
Sandworm lures Ukrainian IT workers
Sandworm, a Russia-linked hacking group associated with the GRU, is suspected of targeting Ukrainian IT workers for espionage. Sandworm uses legitimate job sites to identify system administrators and IT professionals, then moves conversations to Telegram for fake interviews under the fabricated identity Atlas Business Group. Sandworm directs victims to download a modified VPN app called SopraVPN hosted on SourceForge and linked from a fake company website. Sandworm targets individual IT workers, risking compromise of both personal and organizational systems. The campaign uses job recruitment as the access vector. Sandworm enables encrypted command execution on infected machines using SopraVPN built from legitimate WireGuard code.
Frequently Asked Questions
What is CVE-2026-45659? CVE-2026-45659 is a high-severity Microsoft SharePoint remote code execution bug that CISA says ransomware gangs are already exploiting. The flaw stems from deserialization of untrusted data and lets attackers with low privileges run arbitrary code on unpatched servers, turning a SharePoint foothold into a fast path to ransomware deployment.
What is CVE-2026-15409? CVE-2026-15409 and CVE-2026-15410 are being used as a one-two punch against SonicWall SMA1000 appliances in ransomware attacks, according to CISA. The first issue is a remote, unauthenticated SSRF weakness (CVSS 10.0) that can be used to reach internal or external locations, while the second is an administrator-authenticated code injection flaw (CVSS 7.2) that helps attackers deepen control for persistence and payload staging.
What is CVE-2026-18577? CVE-2026-18577 is a critical N-Central authentication bypass that allows unauthenticated attackers to gain admin access, and it is being exploited to deploy ransomware. Because N-Central is used by MSPs for remote monitoring and management, the impact can cascade: a single compromised server can be abused to push ransomware across large fleets, with the source noting it can manage up to 24,000 devices.
What is CVE-2026-48907? A critical bug in the Joomla JCE extension’s profile import feature (CVE-2026-48907, CVSS 10.0 / 9.8) can let an unauthenticated attacker run code on the server and effectively take over the site. The attack path described in the advisory involves grabbing a CSRF token and then uploading a crafted XML file that carries malicious PHP, which can be reached from the server to trigger remote code execution.
What is CVE-2026-15409? CISA is warning that attackers are exploiting SonicWall SMA1000 appliances in ransomware activity, chaining issues that can open the door to deeper compromise. The alert centers on an unauthenticated server-side request forgery bug (CVE-2026-15409, CVSS 10.0) that can be used to make unauthorized requests to internal or external locations, alongside a second weakness that requires admin authentication (CVE-2026-15410, CVSS 7.2) described as a code-injection issue.
What is CVE-2026-18577? A high-severity authentication bypass in N‑Able N-Central (CVE-2026-18577, CVSS 8.1) is being exploited to gain unauthorized admin access—an especially dangerous foothold inside managed service provider environments. With admin control of an N-Central server, attackers can use the platform itself to push ransomware and other actions across customer fleets, and the article notes a single server can manage up to 24,000 devices.
What is Lazarus Group? Lazarus Group (also tracked as Operation Dream Job), a North Korea-attributed threat actor, is using fake job offers to deliver a Windows zero-day (CVE-2026-68820) into defense-related networks. They run two infection chains: one relies on DLL sideloading where a bundled PDF viewer leads to MISTPEN and then the ForestTiger backdoor, and another uses a trojanized SecurityPDF viewer that triggers when a crafted PDF is opened and loads the Troy backdoor.
What is Storm-1175? Storm-1175, a China-linked threat actor, is exploiting a critical flaw (CVE-2026-18577) in the N-central RMM console to deploy ransomware by gaining unauthenticated access to servers. By turning a supply-chain-style weakness in a remote management tool into administrative control, they can use one compromise to reach many downstream client environments.
What is Sandworm? Sandworm, a Russia-linked hacking group associated with the GRU, is targeting Ukrainian IT workers by posing as recruiters and turning job hunting into an infection path. They use legitimate job sites to identify system administrators and other IT professionals, then move conversations to Telegram for fake interviews under a fabricated company identity, Atlas Business Group.