A pre-authentication SQL injection in one of the most widely deployed open-source webmail platforms is under active exploitation today. CVE-2026-48842 hits Roundcube Webmail before the login page - no credentials required. Meanwhile, a protocol-level flaw in TACACS+ threatens the authentication infrastructure that network engineers rely on to secure administrative access to routers, switches, and firewalls. And CISA added two more confirmed-exploited vulnerabilities to the KEV catalog, including a CVSS 9.8 path traversal in WSO2 API gateway infrastructure.

In the News

Roundcube Pre-Auth SQL Injection Under Active Exploitation

CVE-2026-48842 is a pre-authentication SQL injection vulnerability affecting Roundcube Webmail versions 1.6.x and 1.7.x. The Canadian Centre for Cyber Security (CCCS) has confirmed active exploitation targeting internet-facing Roundcube instances. The attack surface is significant: Roundcube is one of the most commonly deployed open-source webmail platforms, used by universities, government agencies, ISPs, and small-to-midsize enterprises worldwide.

The vulnerability is pre-auth, meaning an attacker does not need valid credentials to exploit it. SQL injection at this layer gives attackers direct access to the mail database - stored messages, contacts, session tokens, and potentially credentials if the database stores authentication material. Post-exploitation, attackers can pivot to credential harvesting, business email compromise, or use the compromised mail server as a staging point for lateral movement into the internal network.

Organizations running Roundcube should patch to the latest release immediately. If patching requires a maintenance window, take the webmail interface offline or restrict access to VPN-only until the update is applied. Web application firewall rules targeting SQL injection patterns in HTTP POST parameters provide a compensating control, but they are not a substitute for patching. Asset inventory is the prerequisite - many organizations have Roundcube instances deployed by individual departments or legacy projects that central IT does not track.

What defenders should do: Patch Roundcube to the latest release. If you cannot patch immediately, restrict internet-facing access. Audit your asset inventory for self-hosted webmail instances you may not know about. Deploy WAF rules as a compensating control.

Source: SecurityWeek

TACACS+ Protocol Vulnerability Threatens Network Authentication Infrastructure

A critical vulnerability has been discovered in the TACACS+ protocol - the decades-old standard used to authenticate, authorize, and account for administrative access to network devices. Unlike a typical CVE in a single product, this flaw affects the protocol specification itself, meaning any implementation of TACACS+ could be impacted regardless of vendor.

TACACS+ is the backbone of device administration AAA in enterprise networks. Network engineers use it to centralize login credentials and command authorization for switches, routers, firewalls, and wireless controllers. A protocol-level flaw in TACACS+ means the trust model for “who can log into network infrastructure” is potentially compromised. The blast radius is the entire management plane of the network.

Details on specific exploitation vectors and patch availability are still emerging. Organizations should monitor their TACACS+ server vendor (Cisco ISE, FreeRADIUS with TACACS+ support, and others) for advisories and patches. In the interim, ensure that TACACS+ traffic is encrypted in transit (the protocol historically supported obfuscation rather than true encryption), segment management plane traffic onto a dedicated out-of-band management network, and audit which accounts have device administration privileges.

What defenders should do: Monitor your AAA vendor for patches. Confirm TACACS+ traffic is encrypted and segmented onto an out-of-band management network. Audit administrative access accounts for least privilege. Evaluate migration to modern AAA protocols where feasible.

Source: Risky Business News

CISA Adds WSO2 and Adobe Commerce to KEV - CVSS 9.8 Path Traversal Confirmed Exploited

CISA added CVE-2026-5430, a CVSS 9.8 path traversal vulnerability in the WSO2 API Control Plane, and an Adobe Commerce flaw to the Known Exploited Vulnerabilities catalog. Both are confirmed exploited in the wild.

WSO2 is widely deployed as API gateway and management infrastructure in organizations that have modernized their application architectures with microservices. The API gateway sits at the trust boundary between internal services and external API consumers - a path traversal at this layer can give attackers access to configuration files, credentials, and internal service endpoints. Many organizations that adopted WSO2 during rapid cloud migration may not have it in their formal vulnerability management scope because it is classified as middleware rather than a traditional server.

For federal agencies, KEV addition triggers a mandatory patch deadline. Private sector organizations should treat KEV additions as high-confidence exploitation signals - these are not theoretical vulnerabilities. The Adobe Commerce flaw affects e-commerce platforms and carries similar urgency for retailers and any organization running Magento-based storefronts.

What defenders should do: Patch WSO2 API Control Plane and Adobe Commerce immediately. Confirm whether WSO2 is in your asset inventory and vulnerability scanning scope. Federal compliance customers: verify patch deadlines against your agency’s BOD 22-01 SLA.

Source: The Hacker News

Storm-2570 Ransomware Affiliate Uses Consistent TTPs Across Four Payloads

Microsoft Threat Intelligence published detailed tracking of Storm-2570, a ransomware affiliate that deploys Qilin, DragonForce, Anubis, and BERT payloads while maintaining uniform post-compromise tradecraft. The affiliate uses the same credential access techniques (MITRE ATT&CK T1003 - OS Credential Dumping), lateral movement tooling (T1021 - Remote Services), and staging behaviors regardless of which ransomware brand is delivered as the final payload.

This finding is operationally significant because it validates what defenders have argued for years: behavioral detection is the primary countermeasure against ransomware, not payload-based signatures. An organization that can detect credential dumping, anomalous RDP/SMB lateral movement, and data staging will catch Storm-2570 whether they deploy Qilin or BERT. An organization relying on antivirus signatures for each ransomware family will miss the pre-encryption window entirely.

What defenders should do: Prioritize behavioral detection for credential access (T1003), lateral movement via remote services (T1021), and data staging (T1074). Tune XDR and NDR correlation rules to alert on these TTPs regardless of the final payload. Review the Microsoft blog for specific Storm-2570 IOCs and hunting queries.

Source: Microsoft Security Blog

Defender Action Items

  • Patch Roundcube Webmail to the latest release addressing CVE-2026-48842. If immediate patching is not possible, restrict internet-facing access to VPN-only and deploy WAF rules for SQL injection detection.
  • Audit TACACS+ deployments - confirm encryption in transit, verify management plane segmentation, and monitor your AAA vendor for protocol-level patches.
  • Patch WSO2 API Control Plane (CVE-2026-5430, CVSS 9.8) and Adobe Commerce. Confirm WSO2 is in your vulnerability management scope.
  • Tune behavioral detection for credential dumping (T1003), lateral movement (T1021), and data staging (T1074) based on Storm-2570 TTPs published by Microsoft.
  • Block or monitor the domain third-party.com - ClickFix campaigns are abusing this placeholder domain across 17,000 URLs to serve fake Cloudflare verification pages.

Detection Spotlight

Storm-2570 consistently uses credential dumping tools that trigger Windows Security Event ID 4688 (process creation) with known tool names and command-line patterns. The following Splunk SPL query hunts for common credential access binaries associated with MITRE ATT&CK T1003 across your Windows endpoints:

index=wineventlog EventCode=4688
| eval cmdline=lower(New_Process_Name + " " + Process_Command_Line)
| where match(cmdline, "(mimikatz|sekurlsa|lsass\.dmp|procdump.*lsass|ntdsutil.*ifm|vssadmin.*shadows)")
| stats count by host, Account_Name, New_Process_Name, Process_Command_Line, _time
| sort - _time

This query catches the most common credential dumping tools and techniques - Mimikatz, LSASS memory dumps via ProcDump, ntdsutil IFM snapshots, and VSS shadow copy abuse. False positive rate is low in production environments; legitimate use of these tools outside of red team engagements is rare. Correlate hits with RDP/SMB lateral movement events within a 30-minute window for high-confidence ransomware precursor detection.

References

Subscribe to it-learn Brief

Get it-learn Brief in your inbox (Mon–Fri) - Daily cybersecurity news, SE angles, and detection queries.