opsecsafe — cyber intelligence

2026-03-13

2026-03-13 09:00Z

HIGH

UEBA in the Real World: Catching Intrusions That Don’t Look Like Intrusions

Sekoia.io·sekoia.io

Sekoia's analysis demonstrates how modern intrusions evade traditional IOC-based detection by leveraging valid credentials and legitimate tools (OAuth, cloud APIs, remote admin utilities) rather than malware. The article presents five real-world attack patterns—credential-based lateral movement, MFA fatigue, OAuth abuse, cloud console misuse, and insider-style exfiltration—that UEBA (User and Entity Behavior Analytics) detects where signature-based rules fail. The core insight is that attackers deliberately blend into normal authentication and administrative workflows, requiring behavioral baselines and contextual correlation rather than artifact-focused detection.

SRFApplicationSRFOsTACTA0004TACTA0001TACTA0007SRFIdentityTACTA0003SRFCloud

Edit Score

2026-03-13

2026-03-13 00:00Z

HIGH

Initial access techniques used by Iran-based threat actors

Sophos X-Ops·news.sophos.comCVE-2018-13379 CVE-2019-5591 CVE-2020-12812 CVE-2021-34473 CVE-2021-26855 CVE-2021-26857 CVE-2021-26858 CVE-2021-27065 CVE-2021-44228

Sophos CTU analysis of Iranian-linked threat groups reveals consistent initial access patterns since 2020: phishing (especially spearphishing with cloud-hosted payloads), rapid exploitation of public-facing vulnerabilities (FortiOS, Exchange ProxyShell, Log4Shell), password spraying against cloud identity platforms, abuse of legitimate RMM tools, and exploitation of default/weak credentials in OT systems. The report documents specific TTPs including multi-step social engineering, payload hosting on trusted cloud services, and immediate post-compromise discovery and persistence actions.

TACTA0001SRFNetworkTACTA0006SRFIdentitySRFCloudVNDMicrosoftVNDFortinetVNDVmware

Edit Score

2026-03-13

2026-03-13 00:00Z

HIGH

March Patch Tuesday visits 15 product families

Microsoft released 84 patches across 15 product families in March 2026, addressing 8 Critical-severity vulnerabilities (none in Windows) and 76 Important-severity issues. Six CVEs are assessed as more likely to be exploited within 30 days, including elevation-of-privilege flaws in Windows kernel, SMB, and accessibility infrastructure, plus Office RCE issues exploitable via preview pane. Two CVEs are publicly disclosed; none are currently known to be under active exploitation.

SRFApplicationSRFOsTACTA0004TACTA0002SRFCloudVNDMicrosoftTYPAdvisorySTGPrivesc

Edit Score

2026-03-12

2026-03-12 21:16Z

CRIT

CVE-2026-3611 — Honeywell Iq4e_firmware: Authentication controls are only enforced after a web user is created via U.htm, which

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-3611

The Honeywell IQ4x building management controller, exposes its full web-based HMI without authentication in its factory-default configuration. With no user module configured, security is disabled by design and the system operates under a System Guest (level 100) context, granting read/write privileges to any party able to reach the HTTP interface. Authentication controls are only enforced after a web user is created via U.htm, which dynamically enables the user module. Becaus CVSSv3.1 10.0 (CRITICAL) · EPSS 48th percentile

CWECWE 306VNDHoneywellTYPVulnerability

10.0

CVSS v3.1

100

Edit Score

2026-03-12

2026-03-12 18:16Z

CRIT

CVE-2025-13462 — Python Python: This could result in a crafted tar archive being misinterpreted by the tarfile module

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-13462

The "tarfile" module would still apply normalization of AREGTYPE (\x00) blocks to DIRTYPE, even while processing a multi-block member such as GNUTYPE_LONGNAME or GNUTYPE_LONGLINK. This could result in a crafted tar archive being misinterpreted by the tarfile module compared to other implementations. CVSSv3.1 9.8 (CRITICAL) · EPSS 6th percentile

CWECWE 434CWECWE 74CWECWE 20TYPVulnerability

9.8

CVSS v3.1

Edit Score

2026-03-12

2026-03-12 17:16Z

CRIT

CVE-2026-21708 — Backup: A vulnerability allowing a Backup Viewer to perform remote code execution (RCE) as the

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-21708

A vulnerability allowing a Backup Viewer to perform remote code execution (RCE) as the postgres user. CVSSv3.1 9.9 (CRITICAL) · EPSS 76th percentile

CWECWE 89VNDBackupTYPVulnerability

9.9

CVSS v3.1

100

Edit Score

2026-03-12

2026-03-12 17:16Z

HIGH

CVE-2026-21672 — A vulnerability allowing local privilege escalation on Windows-based Veeam Backup & Replication servers.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-21672

A vulnerability allowing local privilege escalation on Windows-based Veeam Backup & Replication servers. CVSSv3.1 8.8 (HIGH) · EPSS 28th percentile

CWECWE 538TYPVulnerability

8.8

CVSS v3.1

Edit Score

2026-03-12

2026-03-12 16:16Z

HIGH

CVE-2019-25536 — Netartmedia Real_estate_portal: PHP Real Estate Agency 4.0 contains an SQL injection vulnerability that allows unauthenticated

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2019-25536

Netartmedia PHP Real Estate Agency 4.0 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the features[] parameter. Attackers can send POST requests to index.php with crafted SQL payloads in the features[] parameter to extract sensitive database information or manipulate database queries. CVSSv3.1 8.2 (HIGH)

CWECWE 89VNDNetartmediaTYPVulnerability

8.2

CVSS v3.1

Edit Score

2026-03-12

2026-03-12 16:00Z

HIGH

Leveraging Tailscale Keys

SpecterOps·specterops.io

SpecterOps published a comprehensive red-team tradecraft guide on exploiting compromised Tailscale authentication keys (Trusted Keys and Auth Keys) discovered in CI/CD pipelines. The post details how to provision nodes, enumerate Tailnets, abuse subnet routers and exit nodes for lateral movement, and leverage Tailscale SSH for passwordless access to internal systems and cloud resources.

TACTA0001SRFNetworkTACTA0007SRFIdentitySRFCloudVNDTailscaleTYPResearchTYPTechnique

Edit Score

2026-03-12

2026-03-12 15:16Z

CRIT

CVE-2026-28384 — Canonical Lxd: An improper sanitization of the compression_algorithm parameter in Canonical LXD allows an authenticated, unprivileged

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-28384

An improper sanitization of the compression_algorithm parameter in Canonical LXD allows an authenticated, unprivileged user to execute commands as the LXD daemon on the LXD server via API calls to the image and backup endpoints. This issue affected LXD from 4.12 through 6.6 and was fixed in the snap versions 5.0.6-e49d9f4 (channel 5.0/stable), 5.21.4-1374f39 (channel 5.21/stable), and 6.7-1f11451 (channel 6.0 stable). The channel 4.0/stable is not affected as it contains vers CVSSv3.1 9.9 (CRITICAL) · EPSS 41th percentile

CWECWE 78VNDCanonicalTYPVulnerability

9.9

CVSS v3.1

100

Edit Score

2026-03-12

2026-03-12 15:16Z

CRIT

CVE-2026-21671 — Veeam Veeam_backup_\&_replication: A vulnerability allowing an authenticated user with the Backup Administrator role to perform remote

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-21671

A vulnerability allowing an authenticated user with the Backup Administrator role to perform remote code execution (RCE) in high availability (HA) deployments of Veeam Backup & Replication. CVSSv3.1 9.1 (CRITICAL) · EPSS 56th percentile

CWECWE 94CWECWE 693VNDVeeamTYPVulnerability

9.1

CVSS v3.1

Edit Score

2026-03-12

2026-03-12 15:16Z

CRIT

CVE-2026-21669 — Veeam Veeam_backup_\&_replication: A vulnerability allowing an authenticated domain user to perform remote code execution (RCE) on

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-21669

A vulnerability allowing an authenticated domain user to perform remote code execution (RCE) on the Backup Server. CVSSv3.1 9.9 (CRITICAL) · EPSS 53th percentile

CWECWE 94CWECWE 693VNDVeeamTYPVulnerability

9.9

CVSS v3.1

100

Edit Score

2026-03-12

2026-03-12 15:16Z

HIGH

CVE-2026-21668 — Veeam Veeam_backup_\&_replication: A vulnerability allowing an authenticated domain user to bypass restrictions and manipulate arbitrary files

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-21668

A vulnerability allowing an authenticated domain user to bypass restrictions and manipulate arbitrary files on a Backup Repository. CVSSv3.1 8.8 (HIGH) · EPSS 9th percentile

CWECWE 862CWECWE 693VNDVeeamTYPVulnerability

8.8

CVSS v3.1

Edit Score

2026-03-12

2026-03-12 12:15Z

CRIT

CVE-2026-3060 — Lmsys Sglang: SGLang' encoder parallel disaggregation system is vulnerable to unauthenticated remote code execution through the

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-3060

SGLang' encoder parallel disaggregation system is vulnerable to unauthenticated remote code execution through the disaggregation module, which deserializes untrusted data using pickle.loads() without authentication. CVSSv3.1 9.8 (CRITICAL)

CWECWE 502VNDLmsysTYPVulnerability

9.8

CVSS v3.1

Edit Score

2026-03-12

2026-03-12 12:15Z

CRIT

CVE-2026-3059 — Lmsys Sglang: SGLang's multimodal generation module is vulnerable to unauthenticated remote code execution through the ZMQ

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-3059

SGLang's multimodal generation module is vulnerable to unauthenticated remote code execution through the ZMQ broker, which deserializes untrusted data using pickle.loads() without authentication. CVSSv3.1 9.8 (CRITICAL)

CWECWE 502VNDLmsysTYPVulnerability

9.8

CVSS v3.1

Edit Score

2026-03-12

2026-03-12 02:15Z

HIGH

CVE-2026-3972 — Tenda W3_firmware: The manipulation of the argument funcpara1 results in stack-based buffer overflow.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-3972

A vulnerability was found in Tenda W3 1.0.0.3(2204). Affected by this issue is the function formSetCfm of the file /goform/setcfm of the component HTTP Handler. The manipulation of the argument funcpara1 results in stack-based buffer overflow. The attack can only be performed from the local network. The exploit has been made public and could be used. CVSSv3.1 8.8 (HIGH) · EPSS 39th percentile

CWECWE 787CWECWE 121CWECWE 119VNDTendaTYPVulnerability

8.8

CVSS v3.1

Edit Score

2026-03-12

2026-03-12 01:15Z

HIGH

CVE-2023-43010 — Apple Safari: Processing maliciously crafted web content may lead to memory corruption.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2023-43010

The issue was addressed with improved memory handling. This issue is fixed in iOS 17.2 and iPadOS 17.2, macOS Sonoma 14.2, Safari 17.2, iOS 16.7.15 and iPadOS 16.7.15, iOS 15.8.7 and iPadOS 15.8.7. Processing maliciously crafted web content may lead to memory corruption. CVSSv3.1 8.8 (HIGH)

CWECWE 120CWECWE 787VNDAppleTYPVulnerability

8.8

CVSS v3.1

Edit Score

2026-03-11

2026-03-11 23:00Z

INFO

A Nerd's Life: Weeks of Firmware Teardown to Prove We Were Right

Quarkslab·blog.quarkslab.com

Quarkslab published a detailed firmware reverse-engineering writeup on a JieLi AC6958 smartwatch, documenting weeks of work to decrypt proprietary firmware sections, reverse-engineer the custom Pi32v2 CPU instruction set, and improve Ghidra support for the architecture. The researchers recovered an LFSR-based stream cipher key (0x170f), decrypted FAT filesystem partitions, and significantly extended the Pi32v2 processor module in Ghidra to enable full disassembly and decompilation of the watch's main application.

SRFFirmwareSRFHardwareVNDJieliTYPResearchTYPWriteupSTGDiscoveryTECT1014

Edit Score

2026-03-11

2026-03-11 21:16Z

CRIT

CVE-2025-70041 — CWE: An issue pertaining to CWE-259: Use of Hard-coded Password was discovered in oslabs-beta ThermaKube

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-70041

An issue pertaining to CWE-259: Use of Hard-coded Password was discovered in oslabs-beta ThermaKube master. CVSSv3.1 9.8 (CRITICAL) · EPSS 18th percentile

VNDCweTYPVulnerability

9.8

CVSS v3.1

Edit Score

2026-03-11

2026-03-11 21:16Z

CRIT

CVE-2025-70024 — CWE: An issue pertaining to CWE-89: Improper Neutralization of Special Elements used in an SQL

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-70024

An issue pertaining to CWE-89: Improper Neutralization of Special Elements used in an SQL Command was discovered in benkeen generatedata 4.0.14. CVSSv3.1 9.8 (CRITICAL) · EPSS 20th percentile

CWECWE 89VNDCweTYPVulnerability

9.8

CVSS v3.1

Edit Score

2026-03-11

2026-03-11 21:16Z

CRIT

CVE-2025-66956 — Access: Insecure Access Control in Contact Plan, E-Mail, SMS and Fax components in Asseco SEE

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-66956

Insecure Access Control in Contact Plan, E-Mail, SMS and Fax components in Asseco SEE Live 2.0 allows remote attackers to access and execute attachments via a computable URL. CVSSv3.1 9.9 (CRITICAL) · EPSS 31th percentile

CWECWE 284VNDAccessTYPVulnerability

9.9

CVSS v3.1

100

Edit Score

2026-03-11

2026-03-11 19:16Z

CRIT

CVE-2019-25471 — Leefish File_thingie: FileThingie 2.5.7 contains an arbitrary file upload vulnerability that allows attackers to upload malicious

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2019-25471

FileThingie 2.5.7 contains an arbitrary file upload vulnerability that allows attackers to upload malicious files by sending ZIP archives through the ft2.php endpoint. Attackers can upload ZIP files containing PHP shells, use the unzip functionality to extract them into accessible directories, and execute arbitrary commands through the extracted PHP files. CVSSv3.1 9.8 (CRITICAL)

CWECWE 22VNDLeefishVNDFilethingieTYPVulnerability

9.8

CVSS v3.1

Edit Score

2026-03-11

2026-03-11 17:16Z

HIGH

CVE-2026-20046 — Cisco Ios_xr: A vulnerability in task group assignment for a specific CLI command in Cisco IOS

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-20046

A vulnerability in task group assignment for a specific CLI command in Cisco IOS XR Software could allow an authenticated, local attacker to elevate privileges and gain full administrative control of an affected device. This vulnerability is due to incorrect mapping of a command to task groups within the source code. An attacker with a low-privileged account could exploit this vulnerability by using the CLI command to bypass the task group–based checks. A successful CVSSv3.1 8.8 (HIGH) · EPSS 4th percentile

CWECWE 264VNDCiscoTYPVulnerability

8.8

CVSS v3.1

Edit Score

2026-03-11

2026-03-11 17:16Z

HIGH

CVE-2026-20040 — Cisco Ios_xr: A vulnerability in the CLI of Cisco IOS XR Software could allow an authenticated

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-20040

A vulnerability in the CLI of Cisco IOS XR Software could allow an authenticated, local attacker to execute arbitrary commands as root on the underlying operating system of an affected device. This vulnerability is due to insufficient validation of user arguments that are passed to specific CLI commands. An attacker with a low-privileged account could exploit this vulnerability by using crafted commands at the prompt. A successful exploit could allow the attacker to elevat CVSSv3.1 8.8 (HIGH) · EPSS 7th percentile

CWECWE 78VNDCiscoVNDCliTYPVulnerability

8.8

CVSS v3.1

Edit Score

2026-03-11

2026-03-11 17:16Z

CRIT

CVE-2026-1524 — Neo4j Neo4j: An edgecase in SSO implementation in Neo4j Enterprise edition versions prior to version 2026.02

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-1524

An edgecase in SSO implementation in Neo4j Enterprise edition versions prior to version 2026.02 can lead to unauthorised access under the following conditions: If a neo4j admin configures two or more OIDC providers AND configures one or more of them to be an authorization provider AND configures one or more of them to be authentication-only, then those that are authentication-only will also provide authorization. This edgecase becomes a security problem only if the authenti CVSSv3.1 9.8 (CRITICAL) · EPSS 24th percentile

CWECWE 287CWECWE 863VNDNeo4jVNDSsoTYPVulnerability

9.8

CVSS v3.1

Edit Score

Latest intel// live feed

UEBA in the Real World: Catching Intrusions That Don’t Look Like Intrusions

Initial access techniques used by Iran-based threat actors

March Patch Tuesday visits 15 product families

CVE-2026-3611 — Honeywell Iq4e_firmware: Authentication controls are only enforced after a web user is created via U.htm, which

CVE-2025-13462 — Python Python: This could result in a crafted tar archive being misinterpreted by the tarfile module

CVE-2026-21708 — Backup: A vulnerability allowing a Backup Viewer to perform remote code execution (RCE) as the

CVE-2026-21672 — A vulnerability allowing local privilege escalation on Windows-based Veeam Backup & Replication servers.

CVE-2019-25536 — Netartmedia Real_estate_portal: PHP Real Estate Agency 4.0 contains an SQL injection vulnerability that allows unauthenticated

Leveraging Tailscale Keys

CVE-2026-28384 — Canonical Lxd: An improper sanitization of the compression_algorithm parameter in Canonical LXD allows an authenticated, unprivileged

CVE-2026-21671 — Veeam Veeam_backup_\&_replication: A vulnerability allowing an authenticated user with the Backup Administrator role to perform remote

CVE-2026-21669 — Veeam Veeam_backup_\&_replication: A vulnerability allowing an authenticated domain user to perform remote code execution (RCE) on

CVE-2026-21668 — Veeam Veeam_backup_\&_replication: A vulnerability allowing an authenticated domain user to bypass restrictions and manipulate arbitrary files

CVE-2026-3060 — Lmsys Sglang: SGLang' encoder parallel disaggregation system is vulnerable to unauthenticated remote code execution through the

CVE-2026-3059 — Lmsys Sglang: SGLang's multimodal generation module is vulnerable to unauthenticated remote code execution through the ZMQ

CVE-2026-3972 — Tenda W3_firmware: The manipulation of the argument funcpara1 results in stack-based buffer overflow.

CVE-2023-43010 — Apple Safari: Processing maliciously crafted web content may lead to memory corruption.

A Nerd's Life: Weeks of Firmware Teardown to Prove We Were Right

CVE-2025-70041 — CWE: An issue pertaining to CWE-259: Use of Hard-coded Password was discovered in oslabs-beta ThermaKube

CVE-2025-70024 — CWE: An issue pertaining to CWE-89: Improper Neutralization of Special Elements used in an SQL

CVE-2025-66956 — Access: Insecure Access Control in Contact Plan, E-Mail, SMS and Fax components in Asseco SEE

CVE-2019-25471 — Leefish File_thingie: FileThingie 2.5.7 contains an arbitrary file upload vulnerability that allows attackers to upload malicious

CVE-2026-20046 — Cisco Ios_xr: A vulnerability in task group assignment for a specific CLI command in Cisco IOS

CVE-2026-20040 — Cisco Ios_xr: A vulnerability in the CLI of Cisco IOS XR Software could allow an authenticated

CVE-2026-1524 — Neo4j Neo4j: An edgecase in SSO implementation in Neo4j Enterprise edition versions prior to version 2026.02