InfoSec.Watch - Issue #154

SonicWall says two vulnerabilities affecting its SMA 1000 Series are being actively exploited in the wild. CVE-2026-83548 is a critical pre-authentication server-side request forgery flaw caused by an unintended forward-proxy path, while CVE-2026-83549 is a post-authentication remote-code-execution flaw. The affected products are SMA 6210, 7210, and 8200v appliances running the vulnerable 12.4.3 and 12.5.0 hotfix branches. SonicWall lists 12.4.3-03526 and 12.5.0-02952 as the fixed versions.

The remediation guidance makes this more than a patch ticket. SonicWall tells affected organizations to upgrade and contact support for indicator-of-compromise review. If indicators are found, the company recommends re-imaging hardware appliances or redeploying virtual ones, changing all user and administrator passwords, and resetting TOTP tokens.

The operational distinction matters: once an exposed remote-access appliance is under active exploitation, installing a hotfix closes the vulnerability but does not answer whether the appliance—or the credentials passing through it—was already compromised.

Source: SonicWall PSIRT

JFrog disclosed CVE-2026-82329 as a critical improper-authentication flaw in Artifactory. Under the default configuration, JFrog says an unauthenticated attacker with network access may obtain administrative privileges. JFrog’s cloud environments were already fortified, while self-hosted customers are directed to upgrade to the fixed release for their branch. The company lists 7.111.21, 7.117.28, 7.125.20, 7.133.29, 7.146.38, and 7.161.20 as remediating versions.

The disclosure landed August 28, but the risk materially changed during this issue window. Canada’s Cyber Centre updated its advisory on September 2 to report that CISA had added CVE-2026-82329 to the Known Exploited Vulnerabilities catalog. That shifts the defender question from vulnerability management to exposure and access review.

Artifact repositories sit close to packages, build pipelines, credentials, and release processes. Administrative access therefore carries consequences well beyond the repository UI. Self-hosted teams should verify the running branch, patch status, network reachability, and recent administrative activity rather than treating the upgrade as sufficient evidence of closure.

Sources: JFrog · Canadian Centre for Cyber Security

Microsoft Threat Intelligence says it observed a human-operated campaign using Microsoft Teams external collaboration to impersonate IT or helpdesk staff. The attacker persuades a user to grant an interactive session through a legitimate workflow such as a Teams control request or Quick Assist. Once connected, the operator uses PowerShell to download a malicious MSI, stages a portable Node.js runtime and obfuscated JavaScript implant, performs Active Directory reconnaissance, and uses WinRM to move toward high-value systems including domain controllers and certificate authorities.

Microsoft is explicit that this is not a Teams software vulnerability. The campaign succeeds by convincing users to override external-contact warnings and authorize a workflow that security teams normally consider legitimate. That makes control design—not just awareness training—the important defensive question.

Microsoft recommends restricting Teams external access to trusted domains, controlling remote-support tooling, and limiting WinRM to authorized management paths. Those measures reduce the number of legitimate-looking routes an attacker can turn into hands-on-keyboard access.

Source: Microsoft Security Research

Cisco disclosed CVE-2026-20212, a 9.8-rated flaw affecting specified Nexus 9000 switches with Silicon One ASICs. An unauthenticated remote attacker could reach TCP ports 43210 or 43211 in the default L3 VRF and execute code with root privileges. Cisco has updates and a workaround available and says it is not aware of malicious use.

Source: Cisco

Google Threat Intelligence Group says BREEZE COMET targets Brazilian financial organizations and seeks access to payment systems, APIs, mTLS credentials, cloud tokens, and administrative certificates. In investigated cases, Mandiant says the actor used privileged access to core financial applications and then executed waves of fraudulent transactions. The defensive priority is protecting the identities and certificates that can authorize money movement, not only the endpoints around them.

Source: Google Threat Intelligence Group / Mandiant

Google’s September 1 desktop update moved Chrome to 152.0.7977.75/.76 on Windows and Mac and 152.0.7977.75 on Linux. The release contains 26 security fixes, including critical CVE-2026-84353 in Shared Tab Groups and CVE-2026-84352 in WebGL. Google’s release post does not state that either flaw is being actively exploited.

Source: Chrome Releases

Microsoft disclosed a phishing-evasion technique that inserted invisible characters from the Unicode Tags block inside finance-themed lure words so filters could parse the text differently from a human reader. The high-volume phase Microsoft measured occurred earlier in 2026, but the September 3 analysis gives defenders a concrete test: verify that mail normalization and tokenization handle U+E0000–U+E007F consistently before classification.

Source: Microsoft Security Research

The week’s pattern is the alternate route. SonicWall’s SMA 1000 flaw exposes an unintended forwarding path before authentication; JFrog’s Artifactory weakness can turn network reachability into administrative access; and Microsoft’s Teams campaign gets to interactive control through workflows the user is allowed to approve. Cisco’s exposed management-adjacent ports and BREEZE COMET’s focus on payment-authorizing credentials reinforce the same lesson: a security control can be present and still be bypassed by another path to the privileged outcome. Defenders should map equivalent routes to administration—external collaboration, remote support, service registration, management protocols, recovery paths, and delegated credentials—and ask whether each one is governed, logged, and revocable with the same rigor as the primary login screen.

Action: Run a 48-hour review of the path from external Teams contact to remote support and administrative movement.

Who runs it: Collaboration and identity engineering own Teams external-access policy; endpoint/platform teams own Quick Assist and RMM controls; the SOC owns the hunt; Windows infrastructure owners validate WinRM restrictions.

Check these specifically: Review which external Teams domains are allowed and whether broad federation is necessary. Inventory permitted remote-support tools and identify unmanaged alternatives. Hunt the last 14 days for external Teams interactions followed by Quick Assist or RMM launches, PowerShell or msiexec from the same user session, unexpected portable node.exe execution from user-writable directories, and WinRM connections on TCP 5985 from user-context endpoints toward domain controllers, certificate authorities, or other servers. Investigate and rotate credentials for any endpoint showing the sequence.

Evidence you're done: Exported Teams external-access configuration, an approved remote-support-tool list with owners, SIEM/EDR query results covering the hunt sequence, documented WinRM source restrictions, and incident or exception tickets for every suspicious or noncompliant finding.

Controls do not fail only when they are disabled. They also fail when an attacker reaches the same objective through a route that was never governed as tightly as the primary one. This week, those routes include a forward proxy, service authentication, external collaboration, remote support, management protocols, and payment credentials.

For high-value systems, draw the paths to the privileged outcome rather than stopping at the product boundary. If an attacker cannot use the front door, what is the next legitimate workflow that can still grant control? That second path is where policy, telemetry, and revocation need to be just as strong.