Verified status
Checked by defend.network against the NIST National Vulnerability Database (NVD) and CISA’s Known Exploited Vulnerabilities catalog.
- CVE-2026-63077 in Jetbrains Teamcity is listed in CISA’s Known Exploited Vulnerabilities (KEV) catalog (added 2026-08-05; federal remediation due 2026-08-08). NVD rates it 9.8 (CRITICAL) on CVSS v3.1. NVD lists a vendor advisory. (checked 2026-08-06)
- CVE-2026-18556 in N-Able N-Central is listed in CISA’s Known Exploited Vulnerabilities (KEV) catalog (added 2026-08-04; federal remediation due 2026-08-07). NVD rates it 7.4 (HIGH) on CVSS v3.1. NVD lists a vendor advisory. (checked 2026-08-05)
- CVE-2026-34486 in Apache Tomcat is listed in CISA’s Known Exploited Vulnerabilities (KEV) catalog (added 2026-08-04; federal remediation due 2026-08-07). NVD rates it 9.8 (CRITICAL) on CVSS v3.1. NVD lists a vendor advisory. (checked 2026-08-06)
- CVE-2026-9198 in Langflow is listed in CISA’s Known Exploited Vulnerabilities (KEV) catalog (added 2026-08-04; federal remediation due 2026-08-07). NVD rates it 9.8 (CRITICAL) on CVSS v3.1. NVD lists a vendor advisory. (checked 2026-08-05)
TL;DR
New Linux KVM vulnerability (Zapscape) enables guest-to-host escape with kernel privileges when nested virtualization is exposed. Cisco issued patches for 12 critical SD-WAN and IOS XE flaws. Researchers demonstrated successful bypass of Spectre v2 defenses using interrupt injection, affecting Intel and AMD CPUs.
Executive Summary
- Zapscape, a new Linux kernel vulnerability (CVE-2026-6), allows attackers with kernel privileges inside L1 guest VMs to escape KVM isolation and execute code on the host system when nested virtualization is exposed to untrusted guests.
- Cisco has released patches addressing 12 security vulnerabilities in Catalyst SD-WAN and IOS XE Software, including three flaws rated CVSS 9.8, following a comprehensive internal security review.
- MIT CSAIL researchers have disclosed a new interrupt injection technique that allows unprivileged Linux programs to bypass Spectre v2 defenses by re-poisoning the branch predictor after kernel sanitization.
- Four actively exploited vulnerabilities continue across enterprise platforms: JetBrains TeamCity (unauthenticated RCE), N-able N-central (auth bypass), Apache Tomcat (encryption bypass), and IBM Langflow (code injection RCE).
- A Swiss government SharePoint breach compromised approximately 200 accounts after attackers exploited vulnerabilities in Microsoft SharePoint servers.
Top Threats Today
1. Zapscape Linux KVM Virtual Machine Escape
Severity: HIGH Affected: Technology
Zapscape, tracked as CVE-2026-6, is a Linux kernel vulnerability allowing an attacker with kernel privileges inside an L1 guest virtual machine to escape KVM isolation and execute code on the host [1]. The vulnerability applies when nested virtualization is exposed to untrusted guests [1], creating risk in multi-tenant and sandbox environments.
Sources:[1] The Hacker News
Recommended Action
- Audit KVM deployments for exposure of nested virtualization to untrusted guests
- Disable nested virtualization on systems running untrusted workloads until patched
- Monitor for Linux kernel security advisories and apply patches upon release
- Segment virtualized infrastructure to limit blast radius of guest compromise
2. Cisco SD-WAN and IOS XE Critical Patches Released
Severity: HIGH Affected: Technology
Cisco has rolled out updates addressing 12 security vulnerabilities in Catalyst SD-WAN Software and Cisco IOS XE Software following an internal security review [1]. Three of the flaws carry a CVSS score of 9.8 [1], indicating critical severity. The affected SD-WAN products apply regardless of device configuration [1].
Sources:[1] The Hacker News
Recommended Action
- Prioritize deployment of Cisco SD-WAN and IOS XE patches across all affected devices
- Review Cisco security advisories for specific CVE details and mitigation guidance
- Test patches in a staging environment before production deployment
- Monitor Cisco device logs for indicators of exploitation attempts
3. Interrupt Injection Attack Bypasses Spectre v2 Mitigations
Severity: HIGH Affected: Technology
Researchers from MIT CSAIL, Daniël Trujillo and Mengjia Yan, have disclosed a technique that allows an unprivileged Linux program to bypass Spectre v2 defenses by ⚠ timing a hardware interrupt to land between the processor sanitizing its branch predictor and the kernel using it, thereby re-poisoning the predictor after the defense has run [1]. The attack affects both Intel and AMD CPUs ⚠[1]. This represents a fundamental challenge to existing Spectre v2 mitigations and demonstrates that defenses can be evaded under specific timing conditions.
Sources:[1] The Hacker News
Recommended Action
- Monitor CPU and processor vendors (Intel, AMD) for updated microcode and BIOS firmware mitigations
- Review and assess the impact of Spectre v2 bypasses on your current security posture
- Prioritize OS-level patches addressing interrupt handling and branch predictor sanitization
- Evaluate the need for additional side-channel attack detection and prevention controls
4. ClickFix Malware Targets macOS Users for Cryptocurrency Theft
Severity: HIGH Affected: Technology
A Go-based malware delivered through ClickFix attacks is targeting macOS users and exfiltrating cryptocurrency assets, browser-stored passwords, Apple Keychain data, and cached credentials [1]. This attack combines delivery through fake security alerts (ClickFix technique) with credential harvesting and cryptographic asset theft.
Sources:[1] BleepingComputer
Recommended Action
- Alert macOS users to verify system notifications before clicking security alerts
- Advise users to avoid downloading or executing files from unsolicited browser or system prompts
- Deploy endpoint detection and response (EDR) tools with behavioral analysis for Go-based malware
- Monitor for unauthorized access to Apple Keychain and credential management systems
5. Swiss Government SharePoint Breach Affects ~200 Accounts
Severity: HIGH Affected: Government
Switzerland's federal IT office disclosed that hackers exploited vulnerabilities in its Microsoft SharePoint servers, compromising approximately 200 accounts [1]. The breach represents unauthorized access to government systems and the data contained within compromised accounts.
Sources:[1] BleepingComputer
Recommended Action
- Identify and remediate the specific SharePoint vulnerabilities exploited in this incident
- Reset credentials for all 200 affected accounts and enforce MFA
- Audit SharePoint access logs for lateral movement or data exfiltration
- Apply Microsoft SharePoint security patches and configure network segmentation for collaboration platforms
Today’s Action Checklist
- ☐ URGENT: Assess KVM nested virtualization exposure and disable where untrusted guests may run
- ☐ URGENT: Plan and execute deployment of Cisco SD-WAN and IOS XE critical patches
- ☐ HIGH: Review Intel/AMD BIOS and microcode updates for Spectre v2 interrupt injection mitigations
- ☐ HIGH: Audit SharePoint systems for vulnerability exploitability and apply latest Microsoft patches
- ☐ MEDIUM: Update EDR signatures to detect Go-based ClickFix malware on macOS endpoints