Cybersecurity Weekly Briefing, 15-21 August

A Microsoft hotfix addresses only one of the four vulnerabilities in an RCE chain affecting 100 million customers

Researcher Omri Baso, from XM Cyber, has disclosed a remote code execution chain in Microsoft Configuration Manager (SCCM/ConfigMgr) that allows any authenticated Active Directory user to gain SYSTEM privileges on the primary site server and, by extension, on all the clients it manages (Baso estimates that around 100 million SCCM clients are in operation worldwide).

The hotfix KB38232642 published by Microsoft only addresses CVE-2026-47301 (CVSSv3 8.8 according to the vendor), a missing role-based access control check in the AdminService’s fragmented load endpoint, which allowed any domain user to upload a malicious CAB file without holding any SCCM role. The other three links in the chain (a path traversal vulnerability dubbed CabSlip, weak validation of Authenticode signatures that accepts non-revoked code certificates, and the hijacking of the adsource.dll DLL loaded by the SYSTEM process smsexec.exe) remain unpatched.

There is no confirmed active exploitation, but Baso has published the full exploit, so it is recommended that the available hotfix be applied.

More info

Joint alert regarding AI-based attacks on Siemens PLCs in critical sectors

The FBI, the NSA, CISA, the Department of Energy and the EPA have issued a joint alert regarding an active campaign targeting Siemens S7 programmable logic controllers (S7-200 to S7-1500 series, including F-series safety models), affecting critical manufacturing, energy, water and wastewater, chemicals, food and commercial facilities.

The attackers are using AI-generated exploit scripts, disguised as legitimate industrial monitoring tools, relying on libraries such as snap7.dll and python-snap7 to read and write to the controllers’ memory, configuration and ladder logic via the S7comm protocol. The use of AI drastically reduces the technical expertise required to develop functional ICS exploits and enables adversaries to adapt rapidly to defensive measures, according to the alert, which also highlights operations involving the reading of data blocks consistent with prior mapping for future disruptive actions.

It is recommended to immediately carry out an inventory of Siemens S7 assets, verify firmware versions, block TCP port 102 (S7comm) at the perimeter and segment OT networks from corporate systems.

More info

A misconfiguration in Microsoft Power Pages exposes 27 million records from public bodies

Researchers at Fortra have linked the exposure of approximately 27 million records from 13 organisations to an incorrect configuration in Microsoft Power Pages, after the data extortion group ExfilSquad published 382.64 GB of data via torrent. The main theory does not involve either an exploit or ransomware: the affected portals appear to have assigned the ‘Anonymous Users’ role to Dataverse table permissions, allowing unauthenticated visitors to read sensitive records via the portal’s exposed API layer, without the need for malware, lateral movement or credential theft. Identified victims include public authorities and educational institutions, such as Atlanta City Council, the UK Department for Education and the District of Columbia Public Schools, with data including CRM information, support data and, in the case of educational institutions, students’ names, dates of birth and unique identifiers.

Any organisation with Power Pages portals is advised to immediately review table permissions for anonymous access, remove the ‘Anonymous Users’ role from any table that does not explicitly require public read access, and verify from an unauthenticated session that API endpoints do not return Dataverse records.

More info

T-Mobile physically cut a cable to expel Salt Typhoon from its network

Jeff Simon, who was head of security at T-Mobile during the attack and is now the operator’s chief technology officer, has revealed to Bloomberg News that in November 2024 the company put an end to months of intrusion by the Chinese group Salt Typhoon by physically cutting, with a pair of scissors, the cable of a compromised router at a data centre near Bellevue (Washington).

The security team detected that a router that appeared to be switched off was still generating traffic towards T-Mobile’s network; the trail led to a device in Chicago, belonging to another telecoms operator, which had been tampered with to impersonate the original router and thus gain the trust of the system in Bellevue. Simon confirmed that the attackers reached the perimeter infrastructure but did not gain access to core systems or customer data.

Telecoms operators should audit their edge routers for unauthorised access lists, unexpected GRE tunnels, non-standard SSH ports and anomalous TACACS+ traffic on TCP port 49.

More info

Analysis of Cl0p’s exploitation of a critical vulnerability in PTC Windchill

A report by ReliaQuest has analysed the campaign by the Cl0p extortion group, which is actively exploiting CVE-2026-12569 (CVSSv3 9.8), a trusted data deserialisation flaw in PTC Windchill PDMLink and FlexPLM that allows remote code execution without authentication. The attackers deploy a custom-built JSP webshell designed for Windchill’s internal APIs, capable of decrypting credentials from the keystore (LDAP, administration, object storage) and enumerating the technical file repository by querying the product’s own database.

The implant uses a custom HTTP header (X-windchill-req) and GZIP-compressed responses to reduce its visibility, as well as a classloader that executes arbitrary Java bytecode in memory without accessing the disk. The vulnerability is already listed in CISA’s KEV catalogue due to confirmed active exploitation, and the primary targets are manufacturers and industrial engineering organisations, where Windchill centralises product designs and sensitive technical documentation.

Organisations using Windchill or FlexPLM must immediately apply PTC’s emergency patch, restrict access to instances exposed to the internet, and rotate all LDAP, administrative and storage credentials accessible from the compromised instance.

More info

◾ This newsletter is one of the deliverables of our Operational and Strategic Intelligence service. If you are interested in knowing the rest of the Operational and Strategic Intelligence contents included in the service, please contact us →