F5 Labs bulletin: Flax Typhoon email espionage, exploited SonicWall SMA1000 SSRF, VMware VM escape PoC, critical Citrix NetScaler and Cisco NX-OS RCEs
F5 Labs' weekly threat bulletin of 14 October 2026 covers one espionage campaign and four vulnerability disclosures affecting internet-facing and virtualization infrastructure. An FBI-led joint advisory with international partners attributes long-running cyber espionage to the China-linked, US- and UK-sanctioned contractor Integrity Technology Group, whose activity overlaps with Flax Typhoon, Ethereal Panda and RedJuliett; since at least January 2021 it has targeted government, law enforcement, healthcare and religious organizations in Southeast Asia, Africa and North America. Separately, SonicWall SMA1000 appliances are under active exploitation through CVE-2026-102255, a maximum-severity pre-authentication SSRF; SecurityWeek reports a CVSS score of 10 and that exploitation began within days of public disclosure (securityweek.com). A public PoC now exists for CVE-2026-59346 (CVSS 9.3), a VMXNET3 integer overflow in VMware Workstation and Fusion enabling guest-to-host code execution, while Citrix urges immediate patching of CVE-2026-107406 in NetScaler ADC/Gateway and Cisco has disclosed three CVSS 9.8 NGOAM buffer overflows in NX-OS. Taken together, the bulletin points at edge appliances and hypervisors as the priority patching surface.
Entenda a falha
A vulnerabilidade
The most severe is CVE-2026-102255 (CVSS 10 per SecurityWeek), a pre-authentication SSRF in the Appliance WorkPlace interface of SonicWall SMA1000 models 6210, 7210 and 8200v. A remote, unauthenticated attacker can make the appliance send requests on their behalf to internal functionality. It is under active exploitation and SonicWall has patched it; the articles give no fixed version. Next are three Cisco NX-OS NGOAM stack buffer overflows (CVE-2026-76485, CVE-2026-76486, CVE-2026-76501, CVSS 9.8) on Nexus 3000/9000 in standalone mode, where crafted packets to an IP interface give root code execution. The first needs only NGOAM enabled; the second also needs SRv6 or an NVO; the third needs NGOAM and SRv6. CVE-2026-59346 (CVSS 9.3) is a VMXNET3 integer overflow in VMware Workstation/Fusion 25H2 and 26H1 that allows guest-to-host code execution from a privileged guest; it is fixed in 26H1u1. CVE-2026-107406 is a memory overflow in NetScaler ADC/Gateway, reachable only when configured as a SAML IdP or SP, allowing RCE and DoS; it is fixed in 14.1-73.46, 13.1-64.29 and the FIPS/NDcPP builds. The older CVEs in the story (Bash, ProFTPD, BIND, Struts, Pulse, GitLab, ONLYOFFICE, Strapi)…
Como funciona
For CVE-2026-102255, a request reaches the WorkPlace Extraweb interface of the SMA1000. The appliance forwards it to an internal service, the CouchDB instance listening on 127.0.0.1:5984, which should not be reachable from outside. Observed attempts use an OPTIONS request to get into a CouchDB design document and call its _rewrite function with a default-looking admin credential. The step that goes wrong is the appliance acting as a proxy for external input toward internal functionality. For CVE-2026-59346, a guest sends network data through the VMXNET3 adapter and the host-side vmware-vmx process handles TCP Segmentation Offload. It calculates the segment allocation size with a 32-bit multiplication that overflows, so the buffer is too small and later writes go out of bounds on the host.
Por que é vulnerável
CVE-2026-102255 is a server-side request forgery: the WorkPlace interface does not properly restrict where requests it handles can be directed, so the internal CouchDB service becomes reachable from outside. CVE-2026-59346 is an integer overflow in the size calculation for TCP Segmentation Offload buffers, leading to an undersized allocation and an out-of-bounds write. It bypasses validation added earlier for CVE-2025-41236, so that earlier fix did not cover this path. The Cisco NGOAM flaws are stack-based buffer overflows, and the NetScaler flaw is a memory overflow in the SAML code path. The articles do not detail the root cause or the fixes for these.
Onde está
The articles name components, not files or commits: the Appliance WorkPlace / Extraweb interface on SMA1000, TCP Segmentation Offload handling of the VMXNET3 adapter in the vmware-vmx process, the NGOAM feature in NX-OS, and the SAML IdP/SP function in NetScaler.
Como foi descoberta
The articles do not say who found CVE-2026-102255. They say SonicWall patched it recently and that exploitation attempts were detected, with SecurityWeek reporting exploitation began within days of public disclosure. For CVE-2026-59346, researcher Stan S published a PoC. For the NetScaler flaw, Citrix urges immediate patching and no exploitation is reported. Cisco disclosed the three NGOAM flaws. The articles say nothing about how any of these were originally found.
PoC pública
A public PoC exists for CVE-2026-59346, written by researcher Stan S. It is a Linux guest kernel module that writes crafted descriptors into the VMXNET3 transmit ring, crashing the host vmware-vmx process and powering off the guest. It requires privileged access inside the guest. It is a crash demonstration, not a reported full escape, but it shows the overflow is reachable, so patching to 26H1u1 is urgent because no workarounds exist. The articles give no address for it. For CVE-2026-102255, exploitation attempts are seen in the wild, but no published exploit is mentioned.
Explicação gerada por IA a partir da matéria e dos artigos, em 08/11/2026 11:17.
Detalhes técnicos
Integrity Technology Group operators used a custom Python scanner named MicroScan holding over 1,300 scripts, plus open-source tooling, to exploit CVE-2014-6278 (GNU Bash), CVE-2015-3306 (ProFTPD), CVE-2015-5477 (ISC BIND), CVE-2016-3081 (Apache Struts), CVE-2019-11510 (Pulse Connect Secure), CVE-2021-22205 (GitLab), CVE-2021-3199 (ONLYOFFICE) and CVE-2023-22894 (Strapi). Inside victim networks they ran the EBurst tool to password-spray Microsoft 365 and Exchange accounts, persisted via SoftEther VPN installers renamed conhost.exe or dllhost.exe, and exfiltrated mailbox data with DC.exe, Curlc4.txt and office-cli, even operating a web application that gave unidentified third parties access to stolen email. The group's 200,000-device Raptor Train botnet was disrupted in September 2024.
CVE-2026-102255 affects the Appliance WorkPlace interface of SMA1000 models 6210, 7210 and 8200v and lets a remote, unauthenticated attacker make the appliance issue requests on its behalf. Observed attempts send a crafted OPTIONS request to the WorkPlace Extraweb interface to reach the internal CouchDB service at 127.0.0.1:5984, traverse into a design document, invoke its _rewrite function and supply a Basic Authorization header with admin:admin. Over 400 appliances remain exposed online; these gateways have previously been abused to deploy the custom malware Sou5, OrangeTail and RootRun.
CVE-2026-59346 lies in TCP Segmentation Offload handling of the VMXNET3 adapter inside the host-side vmware-vmx process: a 32-bit multiplication overflows when sizing segment allocations, producing an undersized buffer and an out-of-bounds write, bypassing validation added for CVE-2025-41236. The PoC by researcher Stan S is a Linux guest kernel module that writes crafted descriptors into the VMXNET3 transmit ring, crashing the host process and powering off the guest; exploitation requires privileged access inside the guest. CVE-2026-107406 is a memory overflow in NetScaler ADC/Gateway reachable only when the appliance is configured as a SAML IdP or SP, enabling RCE and DoS; Shadowserver counts over 21,000 internet-exposed NetScaler instances, and no exploitation of this flaw is reported. Cisco's CVE-2026-76485, CVE-2026-76486 and CVE-2026-76501 are stack-based buffer overflows in NGOAM on Nexus 3000 and Nexus 9000 switches in standalone mode, reachable by crafted packets to an IP interface and yielding root code execution; CVE-2026-76485 needs only NGOAM enabled, CVE-2026-76486 additionally SRv6 or a Network Virtualization Overlay, and CVE-2026-76501 both NGOAM and SRv6.
Remediação
Patch SonicWall SMA1000 immediately and restrict WorkPlace and management interfaces to trusted ranges; hunt for OPTIONS requests to 127.0.0.1:5984 and inbound Basic Authorization headers carrying admin:admin. Upgrade VMware Workstation and Fusion 25H2 and 26H1 to 26H1u1 (no workarounds exist); where performance allows, switch guests to an E1000e adapter and watch for vmware-vmx segmentation faults. Upgrade NetScaler to 14.1-73.46, 13.1-64.29, 14.1-73.46 FIPS or 13.1.37.283 FIPS/NDcPP or later. For NX-OS, check exposure with show feature | include ngoam, nve and srv6, apply the Cisco updates, or mitigate with no feature ngoam. Against the Flax Typhoon activity, enforce phishing-resistant MFA on webmail and VPNs, alert on DCSync Active Directory replication from non-domain-controller hosts, audit Microsoft 365 connected applications holding Mail.ReadWrite or Mail.Read.All, block dns.studiocloud[.]xyz and natcloudservice[.]com, and detect live700_v1.exe, DC.exe and renamed SoftEther installers.
Linha do tempo
-
F5 Labs bulletin: Flax Typhoon email espionage, exploited SonicWall SMA1000 SSRF, VMware VM escape PoC, critical Citrix NetScaler and Cisco NX-OS RCEs
ler a análise desta fonte ocultar
F5 Labs' weekly threat bulletin of 14 October 2026 covers one espionage campaign and four vulnerability disclosures affecting internet-facing and virtualization infrastructure. An FBI-led joint advisory with international partners attributes long-running cyber espionage to the China-linked, US- and UK-sanctioned contractor Integrity Technology Group, whose activity overlaps with Flax Typhoon, Ethereal Panda and RedJuliett; since at least January 2021 it has targeted government, law enforcement, healthcare and religious organizations in Southeast Asia, Africa and North America. Separately, SonicWall SMA1000 appliances are under active exploitation through CVE-2026-102255, a maximum-severity pre-authentication SSRF; SecurityWeek reports a CVSS score of 10 and that exploitation began within days of public disclosure (securityweek.com). A public PoC now exists for CVE-2026-59346 (CVSS 9.3), a VMXNET3 integer overflow in VMware Workstation and Fusion enabling guest-to-host code execution, while Citrix urges immediate patching of CVE-2026-107406 in NetScaler ADC/Gateway and Cisco has disclosed three CVSS 9.8 NGOAM buffer overflows in NX-OS. Taken together, the bulletin points at edge appliances and hypervisors as the priority patching surface.
Technical Details
Integrity Technology Group operators used a custom Python scanner named MicroScan holding over 1,300 scripts, plus open-source tooling, to exploit CVE-2014-6278 (GNU Bash), CVE-2015-3306 (ProFTPD), CVE-2015-5477 (ISC BIND), CVE-2016-3081 (Apache Struts), CVE-2019-11510 (Pulse Connect Secure), CVE-2021-22205 (GitLab), CVE-2021-3199 (ONLYOFFICE) and CVE-2023-22894 (Strapi). Inside victim networks they ran the EBurst tool to password-spray Microsoft 365 and Exchange accounts, persisted via SoftEther VPN installers renamed
conhost.exeordllhost.exe, and exfiltrated mailbox data withDC.exe,Curlc4.txtandoffice-cli, even operating a web application that gave unidentified third parties access to stolen email. The group's 200,000-device Raptor Train botnet was disrupted in September 2024.CVE-2026-102255 affects the Appliance WorkPlace interface of SMA1000 models 6210, 7210 and 8200v and lets a remote, unauthenticated attacker make the appliance issue requests on its behalf. Observed attempts send a crafted
OPTIONSrequest to the WorkPlace Extraweb interface to reach the internal CouchDB service at127.0.0.1:5984, traverse into a design document, invoke its_rewritefunction and supply a Basic Authorization header withadmin:admin. Over 400 appliances remain exposed online; these gateways have previously been abused to deploy the custom malware Sou5, OrangeTail and RootRun.CVE-2026-59346 lies in TCP Segmentation Offload handling of the VMXNET3 adapter inside the host-side
vmware-vmxprocess: a 32-bit multiplication overflows when sizing segment allocations, producing an undersized buffer and an out-of-bounds write, bypassing validation added for CVE-2025-41236. The PoC by researcher Stan S is a Linux guest kernel module that writes crafted descriptors into the VMXNET3 transmit ring, crashing the host process and powering off the guest; exploitation requires privileged access inside the guest. CVE-2026-107406 is a memory overflow in NetScaler ADC/Gateway reachable only when the appliance is configured as a SAML IdP or SP, enabling RCE and DoS; Shadowserver counts over 21,000 internet-exposed NetScaler instances, and no exploitation of this flaw is reported. Cisco's CVE-2026-76485, CVE-2026-76486 and CVE-2026-76501 are stack-based buffer overflows in NGOAM on Nexus 3000 and Nexus 9000 switches in standalone mode, reachable by crafted packets to an IP interface and yielding root code execution; CVE-2026-76485 needs only NGOAM enabled, CVE-2026-76486 additionally SRv6 or a Network Virtualization Overlay, and CVE-2026-76501 both NGOAM and SRv6.Remediation
Patch SonicWall SMA1000 immediately and restrict WorkPlace and management interfaces to trusted ranges; hunt for
OPTIONSrequests to127.0.0.1:5984and inbound Basic Authorization headers carryingadmin:admin. Upgrade VMware Workstation and Fusion 25H2 and 26H1 to 26H1u1 (no workarounds exist); where performance allows, switch guests to an E1000e adapter and watch forvmware-vmxsegmentation faults. Upgrade NetScaler to 14.1-73.46, 13.1-64.29, 14.1-73.46 FIPS or 13.1.37.283 FIPS/NDcPP or later. For NX-OS, check exposure withshow feature | include ngoam,nveandsrv6, apply the Cisco updates, or mitigate withno feature ngoam. Against the Flax Typhoon activity, enforce phishing-resistant MFA on webmail and VPNs, alert on DCSync Active Directory replication from non-domain-controller hosts, audit Microsoft 365 connected applications holdingMail.ReadWriteorMail.Read.All, blockdns.studiocloud[.]xyzandnatcloudservice[.]com, and detectlive700_v1.exe,DC.exeand renamed SoftEther installers.