Weekly Situation Report — 9/7/26

• A Microsoft Exchange vulnerability (CVE-2026-62911) has been disclosed on a dark web forum, with proof-of-concept exploit code also discovered on GitHub.

• New Nightmare-Eclipse proof-of-concept exploits target antivirus and endpoint security vendors, potentially enabling attackers to bypass or compromise security controls.

• Microsoft has warned of “TerminalFix” attacks that deploy reverse tunnels to establish covert remote access to compromised systems.

• SonicWall has warned that multiple SMA1000 zero-day vulnerabilities are being actively exploited in the wild.

1. MS Exchange CVE-2026-62911 disclosed on dark web forum and PoC found in public GitHub

Summary

Exploit code for CVE-2026-62911, a flaw in Microsoft Exchange patched in August’s Patch Tuesday, has been posted to a dark web forum and GitHub. The vulnerability affects Exchange Server 2016, 2019, and Subscription Edition.

Category: Critical Vulnerabilities

Industry: Multiple

Sources

• https://www.ncsc.nl/alerts/ernstige-kwetsbaarheden-in-microsoft-exchange-server

• https://support.microsoft.com/en-us/servicing/os/windows-server/2021/07/kb5005413-mitigating-ntlm-relay-attacks-on-active-directory-certificate-services-ad-cs

• Internal OSec Research

Analyst comments

On a dark web forum, a user disclosed a PoC for CVE-2026-62911 in a post discussing AI-discovered vulnerability research. We also identified a similar public PoC on GitHub published in the past week that matches characteristics of the forum post. Security agencies including NCSC-NL and Shadowserver have separately warned that exploit code is available, consistent with our own findings. Given the code similarities and independent external corroboration, the PoC in our possession is assessed to be genuine.

Analysis of the PoC reveals that the payload is sent to the target Exchange server over port 443, targeting the /Microsoft.Exchange.MailboxReplicationService.ProxyService endpoint. This triggers the exploit, allowing the attacker to authenticate via NTLM relay and drop an .aspx webshell on the vulnerable target.

Actionable guidance

Applying the August patch remediates this issue. Exchange 2016 is end-of-life, so no patch is available. Administrators running it without Extended Security Updates (ESU) should isolate the Exchange server or migrate it to a supported version.

Detect exploitation activity by monitoring Windows Event ID 4624 for suspicious network logons (Logon Type 3). Also monitor for anomalous NTLM authentication patterns targeting the MRSProxy endpoint. Monitor for repeated NTLM challenge-response payloads over SMB port 445, which are indicative of relay attempts. Post-exploitation indicators include unauthorized ASPX file creation, specifically at C:\inetpub\wwwroot\aspnet_client\system_web\shell.aspx. Flag this path via file integrity monitoring.

To prevent exploitation, enable Extended Protection for Authentication (EPA) on IIS to block SOAP header manipulation. Enforce SMB signing to prevent NTLM relay attacks. Disable the MRSProxy service if mailbox replication is not required. Restrict network access to critical Exchange services. Maintain strict patch management. The MRSProxy service can be disabled with the following:

Set-WebServicesVirtualDirectory "<ServerName>\EWS (Default Web Site)" -MRSProxyEnabled $false

2. New Nightmare-Eclipse PoCs disclosed targeting AV vendors

Summary

Nightmare-Eclipse, the researcher behind previous PoC disclosures such as Bluehammer and Shieldbreak, has disclosed three more PoCs. The newly disclosed issues affect anti-virus vendors Kaspersky (HardBreacher), Avast (PrettyPrague), and Crowdstrike (Falcon Flank), with the third affecting Nvidia userland resources (GreenSection).

Category: Critical Vulnerabilities

Industry: Multiple

Sources

• https://www.theregister.com/security/2026/09/03/prolific-microsoft-0-day-hunter-drops-crowdstrike-falcon-exploit-poc/5294318

• https://www.huntress.com/blog/nightmare-eclipse-intrusion

• https://cyberplace.social/@GossiTheDog/117207575150746857

• https://infosec.exchange/@campuscodi@mastodon.social/117206822309873711

• Internal OSec Research

Analyst comments

Nightmare-Eclipse, the researcher responsible for high-profile disclosures of Windows privilege escalation vulnerabilities and those affecting Defender, has disclosed three more PoCs. These affect Kaspersky (HardBreacher), Avast (PrettyPrague), Crowdstrike (FalconFlank), and Nvidia (GreenSection) userland resources.

GreenSection is assessed to be the most impactful of the three if weaponized and exploited in the wild. It has the potential for wide impact, as it would make any Windows device with an Nvidia GPU potentially vulnerable. However, the researcher did not disclose a full working weaponized exploit. The disclosed code causes a crash and demonstrates an out-of-bounds memory write.

HardBreacher, targeting Kaspersky, appears to be patched in the latest Kaspersky versions. We confirmed this in our internal environment, where the PoC failed against updated software. We also tested the Avast-related PoC and saw a similar result, with current Avast versions likely already detecting it. FalconFlank was also verified to be working by external researchers, however much like the previous vendors, will have mitigations in place at the time of this document. Weaponizing GreenSection would require further development before it could be used offensively.

These vulnerabilities are less likely to affect enterprise environments. They will more likely be used by stealer malware targeting individual non-enterprise users running out-of-date software. AV vendors appear to have already deployed detections for HardBreacher and PrettyPrague, suggesting fixes will be in place within a relatively short timeframe given this researcher’s infamy. We have relied on external trusted confirmation of FalconFlank given time constraints. It is likely this will already have detections in place, especially given the current high-profile of the researcher. So far, only a handful of Nightmare-Eclipse’s earlier PoCs (Bluehammer, RedSun, and UnDefend) have been observed used in the wild.

Actionable guidance

Applying the latest updates to Nvidia components and the affected AV/EDR software will likely reduce the impact of these vulnerabilities. For the AV/EDR related vulnerabilities, ensure signature definitions are up to date in order to detect abuse of these issues. For GreenSection, hunt for crashes in OpenGL or Vulkan applications to identify potential exploitation. Hunt for privilege escalation to SYSTEM from userland and access to the object: \BaseNamedObjects\{52813408-3561-4705-820a-2b3b78be92ba}.

3. TerminalFix attacks deploy reverse tunnels

Summary

A new ClickFix variant called TerminalFix uses fake Cloudflare CAPTCHA prompts on compromised sites to trick victims into running PowerShell commands in Windows Terminal. The commands initiate a multi-stage attack that grants attackers reverse-tunnel access to the victim’s internal network for potential lateral movement and data exfiltration.

Category: Threat Actor Activities

Industry: Multiple

Sources

• https://www.bleepingcomputer.com/news/security/microsoft-warns-of-terminalfix-attacks-deploying-reverse-tunnels/

• https://www.microsoft.com/en-us/security/blog/2026/08/28/terminalfix-campaign-deploys-reverse-tunnel-through-multistage-intrusion/

• https://learn.microsoft.com/en-us/shows/inside/windows-x-menu

Analyst comments

TerminalFix is a new ClickFix variant that uses fake Cloudflare CAPTCHA prompts on compromised sites to trick users into running PowerShell commands in Windows Terminal. Unlike typical ClickFix attacks that deliver infostealers, this campaign is a multi-stage intrusion ending in reverse-tunnel access to the victim’s internal network. The fake CAPTCHA prompts the user to execute a PowerShell command that downloads a ZIP archive containing both signed and malicious files. The archive decodes an obfuscated payload directly into memory. Steganography hides additional components inside PNG images retrieved from a C2 server. These components execute additional scripts, establish persistence via scheduled tasks and registry keys, and perform network reconnaissance. The malware includes a custom Python reverse-tunnel module connecting over an encrypted WebSocket with SOCKS5 proxy capabilities. This allows attackers to pivot between internal systems and conduct follow-on activity such as credential theft or ransomware deployment.

This technique is likely designed to bypass Run dialog restrictions in organizations that limit its use for non-IT users. The actor directs the user to open Windows Terminal via Win+X, then either open a PowerShell prompt or press i for an elevated one. This achieves the same result as the Run dialog. Run dialog restrictions are therefore ineffective, and more targeted controls are required, specifically blocking PowerShell and cmd.exe access for non-IT users.

The clearest detection opportunity after the malware establishes itself is through its persistence artifacts. The malware uses common Run keys and scheduled tasks for persistence. Initial access is through compromised web pages. Whether victims are phished or directed via watering hole-like attacks is not currently known.

Actionable guidance

Blocking PowerShell and cmd.exe for non-IT users is among the most effective mitigations against this and similar *Fix-related attack variants. Restricting Win+X broadly is not recommended. Target the terminal applications themselves instead. Blocking PowerShell, cmd.exe, and WMI for standard users will prevent most initial execution if enforced consistently across the organization. If compromise is suspected, examine registry Run keys and scheduled tasks for persistence artifacts established after initial entry.

4. SonicWall warns of actively exploited SMA1000 zero-day flaws

Summary

SonicWall alerted customers about two chained zero-day vulnerabilities in SMA1000 appliances, CVE-2026-83548 and CVE-2026-83549. Both are being actively exploited for remote code execution. SonicWall urges immediate hotfix application.

Category: Known Exploited Vulnerabilities

Industry: Technology

Sources

• https://www.bleepingcomputer.com/news/security/sonicwall-warns-of-actively-exploited-sma1000-zero-day-flaws/

• https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0016

• https://thehackernews.com/2026/08/inc-ransomware-emerges-as-dominant.html

• Internal OSec Research

Analyst comments

SonicWall alerted customers to two critical zero-day vulnerabilities in the SMA1000 Appliance, CVE-2026-83548 in the WorkPlace interface and CVE-2026-83549 in the Management Console. These command injection flaws allow remote code execution on affected devices. The affected models are the SMA1000 6210, 7210, and 8200v. SSL-VPN on SonicWall firewalls and the SMA 100 Series are not impacted. SonicWall confirms active exploitation in the wild and recommends upgrading to the latest hotfix immediately.

Well-funded ransomware groups are the likely threat actors exploiting these vulnerabilities, based on recent intrusion data. In August 2026, INC ransomware exploited previously disclosed SonicWall vulnerabilities in their attacks, suggesting active research against SonicWall devices within these groups.

Exploitation details are currently unknown. However, there is an increase in traffic to SonicWall SMA1000 devices targeting specific endpoints. The two most prominent endpoints observed in public honeypots and our own data are /wcproxy and /workplace/home.action. We were not able to identify traffic directly related to exploiting these specific vulnerabilities. SonicWall has not released additional IOC data.

Actionable guidance

Apply the hotfix released for these two vulnerabilities immediately. Rotate credentials and tokens, particularly those belonging to Administrator accounts. SonicWall also recommends re-imaging and re-deploying virtual SMA1000 deployments. The following SMA1000 models are affected:

SMA1000 6210
SMA1000 7210
SMA1000 8200v