Two actively exploited vulnerabilities dominate this morning — one hitting email servers already compromised at scale, the other scoring a perfect 10.0 on the CVSS scale with zero authentication required. Meanwhile, an unpatched residential gateway flaw reminds us that NAT was never a security boundary, and a UK government disclosure puts a real number on Iranian ICS disruption: 4 days of power plant downtime.

In the News

270+ Zimbra Servers Compromised in Active CVE-2026-73570 Campaign

Attackers are actively exploiting CVE-2026-73570 in Zimbra Collaboration Suite, and the scale is already significant: over 270 servers confirmed compromised as of this writing. CISA added the vulnerability to the Known Exploited Vulnerabilities catalog and imposed a 72-hour remediation deadline on federal agencies under Binding Operational Directive 22-01.

Zimbra remains widely deployed in mid-market enterprises, educational institutions, and public-sector organizations. The exploitation campaign is ongoing, and the 270 figure represents confirmed compromises — the actual number of targeted servers is likely higher. Organizations running any version of Zimbra Collaboration Suite should validate their patch status immediately, not on the next maintenance window.

The 72-hour CISA deadline signals the severity assessment at the federal level. For organizations outside the federal mandate, the urgency is identical — the attackers exploiting this flaw are not checking whether their targets are subject to CISA binding directives. Email servers are high-value initial access targets because they process credentials, contain sensitive communications, and are typically internet-facing by design.

What defenders should do: Patch Zimbra Collaboration Suite immediately. If patching requires a maintenance window, deploy compensating controls: email gateway inspection to catch exploitation payloads, DNS-layer filtering to block known C2 infrastructure associated with the campaign, and enhanced monitoring of Zimbra server logs for indicators of compromise. Treat any unpatched Zimbra instance as potentially compromised and investigate accordingly.

Oracle WebLogic CVE-2026-21962 — CVSS 10.0, No Auth, Actively Exploited

CISA added CVE-2026-21962 to the KEV catalog after confirming active exploitation. The vulnerability affects Oracle WebLogic Server and Oracle HTTP Server and scores a perfect 10.0 on the CVSS scale. The attack vector is network-based, requires no authentication, and needs no user interaction — the textbook definition of a maximum-severity flaw.

WebLogic is deeply embedded in enterprise Java application stacks. Many organizations treat it as infrastructure that “just runs” — which means patching cycles are slow and asset inventories are incomplete. An unauthenticated, network-accessible path to critical data in these environments is as severe as it gets.

What defenders should do: Apply the relevant Oracle Critical Patch Update immediately. For environments where immediate patching is not feasible, deploy WAF rules or IPS signatures for virtual patching. Audit network exposure of WebLogic instances — any internet-facing WebLogic server without the patch is an active target. Review access logs for anomalous unauthenticated requests to WebLogic administration endpoints.

Unpatched Calix Gateway Flaw Bypasses NAT, Exposes Internal Devices

A vulnerability in Calix residential gateways — widely deployed by ISPs to home and small-business subscribers — allows remote attackers to bypass NAT and expose internal devices directly to the internet. No patch is currently available.

The enterprise risk is indirect but concrete. Remote workers on ISP-issued Calix gateways are now potential pivot points. An attacker who bypasses NAT on a home gateway can reach devices on the internal home network, including the endpoint that tunnels into a corporate VPN. NAT was never designed as a security control, but many network security models implicitly relied on it as a layer of obscurity. This flaw removes even that.

What defenders should do: This is a zero-trust network access validation moment. Enforce device posture checks at the VPN or ZTNA access layer — verify endpoint health regardless of the upstream network. If your remote access architecture assumes the home network is trusted, it is time to revisit that assumption. SD-WAN tunnel encryption and segmentation reduce the blast radius if a home network is compromised.

Iranian Cyber Actors Shut Down UK Power Plant for 4 Days

The UK government disclosed that an Iranian cyberattack caused a 4-day operational shutdown of a power plant. The US Treasury simultaneously announced sanctions against the Iranian actors responsible. This is a government-attributed, government-disclosed ICS disruption event — the kind of concrete evidence that OT security conversations often lack.

Four days of operational downtime in a power generation facility is a significant physical-world consequence. The disclosure confirms that Iranian threat actors are not limited to espionage or data theft in critical infrastructure environments — they are capable of and willing to cause operational disruption.

What defenders should do: Organizations operating critical infrastructure should validate IT/OT segmentation controls. Ensure that a compromised IT network cannot reach OT systems without crossing monitored and enforced segmentation boundaries. Deploy OT-specific network monitoring for asset visibility and anomaly detection on the OT side of the boundary.

Today’s Deep Dive — AI-Augmented Server Exploitation: UAT-10147 and the SPECTRE Implant

A Chinese-speaking threat group tracked as UAT-10147 is using AI to scale server-side exploitation globally. The group deploys the SPECTRE implant, which features two capabilities that make detection particularly difficult: a Linux rootkit for persistence and stealth, and a bring-your-own-vulnerable-driver (BYOVD) technique to bypass EDR.

BYOVD is not new — it has been documented across multiple threat actors and mapped to MITRE ATT&CK T1068 (Exploitation for Privilege Escalation) and T1014 (Rootkit). What distinguishes UAT-10147 is the integration of AI into the target selection and exploitation workflow. The group uses AI to identify vulnerable web servers at scale, reducing the manual reconnaissance phase and increasing the volume of targets they can engage simultaneously.

The defensive challenge is twofold. First, the BYOVD technique means that even environments with EDR deployed may not detect the initial implant installation — the driver used is legitimately signed, so the EDR trusts it. Second, the Linux rootkit hides the SPECTRE implant from standard process and file enumeration tools, meaning host-based detection requires integrity monitoring or memory forensics rather than conventional file scanning.

For defenders running Linux server workloads, this is a reminder that EDR alone is not sufficient. Application allowlisting, kernel module signing enforcement, and driver load monitoring are the controls that address BYOVD. Network detection — specifically monitoring for anomalous outbound connections from server workloads — provides an independent detection layer that the rootkit cannot easily subvert.

Defender Action Items

  • Zimbra (CVE-2026-73570): Patch immediately. If patching requires scheduling, deploy email gateway inspection and DNS-layer filtering as compensating controls. Audit server logs for indicators of compromise. Treat unpatched instances as potentially compromised.
  • Oracle WebLogic (CVE-2026-21962): Apply Oracle CPU patch. Deploy WAF/IPS virtual patching for internet-facing instances. Audit for unauthenticated access attempts to WebLogic administration paths.
  • Calix gateway (no CVE assigned, no patch available): Enforce device posture checks at VPN/ZTNA access layers. Do not rely on home-network NAT as a security assumption. Validate SD-WAN tunnel encryption for remote-worker segments.
  • miniOrange SAML SSO (CVE-2026-61979, CVSS 8.1): Update WordPress plugin immediately. Audit admin accounts for unauthorized additions. Active exploitation confirmed.
  • Red Hat Keycloak (CVE-2026-18963, CVSS 9.1): Patch Keycloak deployments. Monitor password-reset endpoints for anomalous volume. Not yet exploited in the wild but high severity.
  • OT/ICS environments: Validate IT/OT segmentation in light of UK-disclosed Iranian power plant shutdown. Deploy OT-specific network monitoring for asset visibility.

Detection Spotlight

UAT-10147’s SPECTRE implant uses BYOVD to load a vulnerable signed driver for EDR bypass on Linux servers. Monitor for unexpected kernel module loads — this Splunk SPL query flags unsigned or anomalous driver loads on Linux endpoints:

index=linux_syslog sourcetype=syslog OR sourcetype=linux:audit
("insmod" OR "modprobe" OR "finit_module")
| stats count by host, _time, process, process_path, module_name
| where NOT match(module_name, "^(ext4|xfs|nfs|overlay|br_netfilter|ip_tables|iptable_filter)$")
| sort -_time

This query surfaces kernel module load events that fall outside common legitimate modules. Expect false positives from legitimate driver installations and kernel updates — baseline your environment first. Correlate hits with outbound network connections from the same host to identify potential C2 activity from the SPECTRE implant.

References

Subscribe to it-learn Brief

Get it-learn Brief in your inbox (Mon–Fri) — Daily cybersecurity news, SE angles, and detection queries.