Cisco released patches for 24 vulnerabilities across three of its core infrastructure platforms on the same day CISA flagged a critical CI/CD flaw for emergency remediation and researchers published a fileless attack technique that turns Oracle Database into a malware compiler. For defenders, this is a day where patching discipline, build-pipeline integrity, and database-layer visibility all demand attention simultaneously.

In the News

Cisco Patches 24 Flaws Across SD-WAN, IOS XE, and FMC — One PoC Is Public

Cisco published advisories for 24 vulnerabilities spanning Catalyst SD-WAN, IOS XE, and Firepower Management Center (FMC). Several carry critical severity ratings. The most urgent: at least one vulnerability has a publicly available proof-of-concept exploit, which compresses the timeline between disclosure and mass exploitation from weeks to days — or hours.

The breadth of this patch drop is the real story. SD-WAN controllers, edge routers running IOS XE, and the centralized firewall management plane are three distinct attack surfaces, but in most enterprise deployments they share a single administrative domain. A compromise in one often provides lateral movement opportunities to the others. Organizations running Cisco infrastructure stacks should treat this as an emergency patch cycle, not a routine monthly update.

For environments that cannot patch immediately, Cisco’s Catalyst SD-WAN “Live Protect” feature — available in controller v20.18.3+ and router v26.1+ — provides pre-patch shielding that can buy time while maintenance windows are scheduled. For IOS XE and FMC, compensating controls include restricting management-plane access to out-of-band networks and enabling IPS signatures that match the public PoC traffic patterns.

What defenders should do: Inventory all Cisco SD-WAN, IOS XE, and FMC instances. Prioritize the flaw with the public PoC. Restrict management-plane access to trusted networks. Monitor for anomalous traffic patterns on affected device interfaces.

CISA KEV Adds TeamCity RCE — CVE-2026-63077, CVSS 9.8

CISA added CVE-2026-63077 to the Known Exploited Vulnerabilities catalog after confirming active exploitation against JetBrains TeamCity on-premise installations. The flaw is an unauthenticated remote code execution vulnerability — no credentials required, no user interaction needed. CVSS 9.8.

TeamCity occupies a privileged position in software delivery pipelines. It holds source code access, build secrets, deployment credentials, and signing keys. A compromised TeamCity instance does not just give attackers a foothold on one server — it gives them the ability to inject malicious code into every downstream build artifact. This is the supply-chain attack scenario that security teams have been warning about since the SolarWinds incident. The difference is that this time the entry point is a single unauthenticated HTTP request.

JetBrains has released patches. CISA’s KEV listing means federal agencies are required to remediate within the standard binding operational directive timeline, but private-sector organizations should treat this with the same urgency. If your TeamCity instance is internet-facing, the exploitation window may already be closed — not by your patch, but by the attacker’s access.

What defenders should do: Patch TeamCity immediately. If patching is delayed, isolate the TeamCity server from both the internet and production networks. Audit recent build artifacts for unexpected modifications. Rotate all secrets stored in TeamCity configurations. Review CI/CD pipeline logs for unauthorized build triggers. MITRE ATT&CK: T1195.002 — Supply Chain Compromise: Compromise Software Supply Chain.

Attackers Compile Malware Inside Oracle DB, Pivot to SYSTEM Without Touching Disk

Researchers documented a post-exploitation technique where attackers leverage Oracle Database’s embedded Java runtime — the JVM that ships with every Oracle DB installation — to compile and execute a toolkit dubbed “khunt” entirely in memory. The compiled payload escalates privileges to Windows SYSTEM and establishes persistence, all without writing a single executable to the file system.

This technique exploits a fundamental architectural assumption in most endpoint detection strategies: that malicious code must exist as a file, a process, or a loaded library at some point in its lifecycle. Inside Oracle’s JVM, the compilation happens within the database process itself. From the operating system’s perspective, oracle.exe is doing what it always does — running Java code. The malware never materializes as a standalone binary. EDR agents that monitor file creation, DLL loads, and process trees see nothing anomalous.

The lateral movement path is equally concerning. Once the attacker has SYSTEM on the database server, they pivot to adjacent systems using the database server’s machine account or cached credentials — a host that typically has broad network access because it needs to serve application queries from multiple tiers.

What defenders should do: Enable Oracle Database audit logging for Java compilation events (DBMS_JAVA package usage). Monitor for unexpected privilege escalation on database server hosts (Windows Event ID 4672 correlated with Oracle process activity). Enforce least-privilege on Oracle service accounts. Segment database servers so they cannot initiate connections to workstations or domain controllers. MITRE ATT&CK: T1059.007 — Command and Scripting Interpreter: JavaScript/JScript (closest mapping for in-DB JVM execution); T1055 — Process Injection.

Defender Action Items

  • Cisco infrastructure: Inventory all SD-WAN, IOS XE, and FMC versions. Patch the flaw with the public PoC first. Activate SD-WAN Live Protect on controller v20.18.3+ as a pre-patch shim. Restrict management interfaces to OOB networks.
  • TeamCity (CVE-2026-63077): Patch or isolate immediately. Rotate all build secrets and deployment credentials. Audit build logs for unauthorized triggers since July 2026 at minimum.
  • Oracle Database hosts: Audit DBMS_JAVA usage. Correlate Oracle process activity with Windows 4672 events. Segment DB servers from tier-1 identity infrastructure.
  • Gitea (CVE-2026-59774): Update to 1.27.1. Audit repositories for exposed secrets or credentials in Org-mode files.
  • Linux OVS hosts (CVE-2026-64531): Patch kernel. The public exploit ships with 800+ kernel build offsets — exploitation is low-skill.
  • Network edge: Audit for Zbtlink router hardware in your supply chain. Block known C2 domains associated with the factory backdoor at the DNS layer.

Detection Spotlight

Detecting the khunt Oracle DB technique requires correlating database-layer events with OS-level privilege changes. The following Splunk SPL query identifies Windows hosts where the Oracle service process triggers a special privilege logon — a high-fidelity indicator of in-DB privilege escalation:

index=wineventlog EventCode=4672 SubjectUserName="OracleService*"
| join host [search index=oracle_audit action="DBMS_JAVA" operation="compile"]
| stats count by host, SubjectUserName, _time
| where count > 0
| table _time, host, SubjectUserName, count

This query looks for Windows Event 4672 (special privileges assigned to a new logon) where the subject is an Oracle service account, then joins against Oracle audit logs for Java compilation events. False positive rate is low in environments where Oracle’s embedded JVM is not actively used for custom Java stored procedures — which is most environments. If your organization does use Java stored procedures, baseline normal compilation activity and alert on deviations.

References

Subscribe to the it-learn Brief

Get the daily cybersecurity brief in your inbox every weekday morning — news, SE angles, and detection queries.