New Exploitation Signals Put Oracle, GitLab, and Zimbra in Focus

By SAFE Threat Research Team

This week’s exploitation activity spans enterprise middleware, development platforms, collaboration software, remote-access infrastructure, and AI tooling. Oracle HTTP Server and WebLogic Proxy CVE-2026-21962 moved into active exploitation, GitLab CVE-2026-19478 was targeted shortly after disclosure, and exploitation of Zimbra CVE-2026-73570 is providing unauthenticated attackers with a path to command execution on affected mail servers.

TrueConf CVE-2026-72529 and CVE-2026-72530 were tied to a Head Mare intrusion chain that progressed from server exploitation to SYSTEM-level access and trojanized client distribution. Microsoft IKE CVE-2026-33824 also moved into confirmed exploitation, putting Windows systems providing VPN services at risk of remote code execution while MLflow CVE-2026-64849 exposes an SSRF path from AI infrastructure into internal services and cloud metadata. Newly reported exploitation of miniOrange SAML flaws further extends this week’s activity into authentication infrastructure.

Vulnerability Landscape

NVD published 3,491 CVEs this week, including 1,816 rated critical or high severity. Public exploit or proof-of-concept code was available for 64 vulnerabilities, while 5 showed stronger weaponized-exploit signals.

The disclosure numbers describe the size of the vulnerability landscape, but the vulnerabilities requiring immediate attention represent a much smaller subset. Exploitation evidence, external reachability, the privileges available after compromise, and the role of the affected system within the environment materially change remediation priority.

Trending Vulnerabilities

15 CVEs showed confirmed real-world exploitation signals this week, including 3 newly published vulnerabilities and 12 pre-existing issues.

The larger share of activity again came from vulnerabilities that were already known. Oracle CVE-2026-21962 gained urgency after new exploitation evidence emerged, while other cases surfaced additional campaign context showing how attackers were using previously disclosed weaknesses in operational environments.

At the same time, GitLab demonstrates how quickly the opposite can occur: exploitation activity followed disclosure within days. Vulnerability priority therefore cannot remain fixed at the point of publication. It needs to change as exploit availability, observed exploitation, exposure, and post-compromise behavior evolve.

Top CVEs to Watch

Oracle CVE-2026-21962: Active Exploitation Targets HTTP Server and WebLogic Proxy Infrastructure

CVE-2026-21962 is an improper-access-control vulnerability affecting Oracle HTTP Server and the Oracle WebLogic Server Proxy Plug-in. An unauthenticated attacker with HTTP access can compromise affected deployments without credentials. CISA added the vulnerability to its Known Exploited Vulnerabilities catalog on August 24 after confirming active exploitation, months after Oracle originally addressed the issue.

The vulnerability is especially relevant where Oracle HTTP Server or WebLogic proxy components form an externally reachable front end to enterprise applications. These systems frequently sit at a trust boundary between internet-facing HTTP traffic and internal application infrastructure, increasing the value of successful exploitation beyond the exposed web tier itself.

Organizations should identify affected Oracle HTTP Server and WebLogic Proxy deployments, prioritize externally accessible instances, and apply Oracle’s remediation. Systems that remained exposed during the exploitation window should also be reviewed for anomalous HTTP activity, unauthorized application changes, unexpected processes, and evidence of access extending beyond the proxy layer.

GitLab CVE-2026-19478: Exploitation Follows Disclosure Within Days

CVE-2026-19478 is a critical code-injection vulnerability affecting self-managed GitLab CE and EE. An unauthenticated attacker can abuse a GraphQL directive to remotely modify or delete public projects and user data. Affected branches include GitLab 18.2 before 18.11.11, 19.0 before 19.0.8, 19.1 before 19.1.6, and 19.2 before 19.2.4.

The vulnerability moved rapidly from disclosure to observed exploitation. For enterprises, the risk extends beyond availability of individual repositories. A compromised source-code management platform can undermine repository integrity and affect development and CI/CD trust relationships. Organizations should patch self-managed GitLab instances immediately and review previously exposed systems for unexpected GraphQL activity, project modifications, deleted repositories, maintainer changes, and inconsistencies between repository state and downstream build or deployment records.

Zimbra CVE-2026-73570: Active SMTP-to-Command-Execution Campaign Targets Mail Servers

CVE-2026-73570 is an OS command-injection vulnerability affecting Zimbra Collaboration Suite before version 10.1.20 when the optional zimbra-snmp functionality is in use. Improper sanitization during SNMP notification processing allows an unauthenticated attacker to send specially crafted SMTP requests that can execute arbitrary operating-system commands as the zimbra user.

CERT Polska reported an ongoing campaign exploiting the vulnerability and published host-level hunting guidance. Its analysis recommends examining /var/log/zimbra.log for malicious service-status changes and identifying files recently created by the zimbra account under Jetty web application directories and /tmp. CISA subsequently changed the exploitation status to active and added CVE-2026-73570 to KEV on August 21.

Organizations should upgrade to Zimbra 10.1.20 and determine whether vulnerable SNMP notification functionality was enabled. Because successful exploitation results in command execution on a mail server, previously exposed systems should be assessed for web shells, unexpected files and processes, persistence, credential access, and activity involving mail data or adjacent internal systems.

TrueConf Server CVE-2026-72529 and CVE-2026-72530: Head Mare Chains Pre-Auth Exploitation Into SYSTEM Access

CVE-2026-72529 and CVE-2026-72530 form an exploitation chain affecting vulnerable TrueConf Server deployments reachable over port 4307/TCP. The first vulnerability allows an unauthenticated remote attacker to invoke an undocumented server function and execute an arbitrary script. The second allows that script to escape TrueConf’s isolated execution environment and execute code on the underlying Windows host. Both vulnerabilities have been added to CISA’s Known Exploited Vulnerabilities catalog.

The exploitation is tied to a broader intrusion chain rather than opportunistic probing alone. In July, the Head Mare threat group compromised a TrueConf server using the two vulnerabilities, reached NT AUTHORITY\SYSTEM, and replaced legitimate TrueConf client installers hosted on the server with trojanized packages that deployed the PhantomCore backdoor. The campaign effectively turned a compromised collaboration server into a downstream malware-delivery mechanism for users downloading its client software.

Organizations running TrueConf should patch affected servers and treat previously reachable systems as potential compromise candidates. Investigation should extend beyond the vulnerable service to web shells, unexpected SYSTEM-level execution, modified application installers, credential access, and outbound communications associated with post-exploitation tooling.

Microsoft IKE CVE-2026-33824: Active RCE Targets VPN-Facing Windows Infrastructure

CVE-2026-33824 is a double-free vulnerability in the Windows Internet Key Exchange Extension that allows an unauthenticated network attacker to execute code remotely. CISA classifies exploitation as active, automatable, and capable of total technical impact, and added the vulnerability to KEV on August 18.

Recent threat intelligence provides additional evidence beyond the KEV designation. A Chinese-speaking threat actor conducting manual exploitation campaigns was observed sending reverse-shell callbacks against three IKE VPN endpoints vulnerable to CVE-2026-33824. The activity was part of a broader operation combining conventional exploitation with AI-assisted vulnerability research and targeting.

The enterprise priority comes from the position of the vulnerable service: IKE commonly supports remote-access and VPN infrastructure at the network edge. Organizations should prioritize exposed Windows systems providing affected IKE functionality, deploy Microsoft’s security update, and investigate previously vulnerable endpoints for suspicious inbound traffic followed by unexpected outbound connections or process execution.

MLflow CVE-2026-64849: Active SSRF Creates a Path Into Cloud Metadata and Internal Services

CVE-2026-64849 affects MLflow versions before 3.15.0 and is exploitable through the unauthenticated /api/2.0/mlflow/webhooks/{id}/test endpoint. MLflow validates the initial webhook URL, but subsequent redirects can be followed and hostnames re-resolved without preserving the validated destination. An attacker can therefore redirect requests toward internal services or cloud metadata endpoints and receive the resulting response body.

CISA now classifies exploitation as active and has added the vulnerability to KEV. The impact is particularly relevant in enterprise AI and cloud environments: MLflow servers may have network reachability unavailable to an external attacker, while access to instance metadata or internal APIs can expose credentials, service information, or additional attack paths.

Organizations should upgrade to MLflow 3.15.0 or later, restrict access to tracking and webhook interfaces, and review previously exposed instances for abnormal requests to link-local metadata addresses, localhost, or internal network destinations.

miniOrange CVE-2026-61979 and CVE-2026-15981: Exploitation Chains SAML Flaws for WordPress Admin Access

CVE-2026-61979 and CVE-2026-15981 are authentication-bypass vulnerabilities in the miniOrange SAML 2.0 Single Sign On plugin that can allow an unauthenticated attacker to forge SAML responses and authenticate as an existing WordPress user, including an administrator. The flaws affect SAML signature validation, including misuse of the IdP’s public key as an HMAC secret and incorrect handling of signature-verification failures.

Active exploitation has been observed for these vulnerabilities, including successful compromise of a paid miniOrange edition that resulted in a WordPress administrator session. Broader scanning and exploitation activity has also been detected against vulnerable deployments.

The exposure is notable because miniOrange distributes multiple paid editions under the same plugin family, some of which were not covered by the original public advisories or normal WordPress update notifications. Organizations should identify the exact edition and version deployed, apply the applicable fix, and review exposed sites for suspicious SAML logins, unexpected administrator sessions, and unauthorized account changes.

On the Radar: FortiWeb CVE-2026-26035 – Pre-Auth Administrative Access Under Specific RADIUS Configurations

CVE-2026-26035 is a critical improper-authentication vulnerability affecting multiple FortiWeb branches. Under affected configurations, a remote unauthenticated attacker can log in to the FortiWeb GUI or CLI using arbitrary credentials. CISA currently records exploitation as none, but assesses the vulnerability as automatable with total technical impact.

The vulnerable path depends on Remote RADIUS-type administrator configuration; disabling the Wildcard option is an available interim mitigation. Given FortiWeb’s network-edge position and the level of access provided by successful exploitation, this is worth tracking closely even without confirmed exploitation at this time.

What Security Teams Should Prioritize

• Prioritize confirmed exploitation on reachable systems. Oracle, GitLab, Zimbra, TrueConf, Microsoft IKE, MLflow, and the exploited miniOrange deployments should move ahead of vulnerabilities carrying comparable severity but no current exploitation evidence.
• Separate remediation from compromise assessment. Patching prevents further exploitation but does not remove access already established by an attacker. Systems that were vulnerable and reachable during an exploitation window should be investigated using the attack-specific behaviors associated with each vulnerability.
• Account for downstream access. Give additional priority to vulnerabilities affecting identity infrastructure, VPN services, collaboration platforms, source-code systems, middleware, and AI services that can provide access to other applications, credentials, data, or internal network resources.
• Validate exposure and configuration before treating every affected asset equally. Some vulnerabilities depend on specific services or configurations. Internet reachability, vulnerable functionality, application role, and compensating controls can materially change whether a finding represents an exploitable path.

The vulnerability backlog is continuously changing even when the underlying CVEs do not. New exploitation evidence can turn an older finding into an immediate remediation priority, while asset context and effective controls can reduce the urgency of another vulnerability with the same severity score.

From Findings to Fixes at Machine Speed

That continuous reprioritization is where the SAFE CTEM AI Co-Worker changes the operating model. Instead of asking teams to manually correlate scanner findings with threat intelligence, exposure, business context, exploitability, and controls, it orchestrates specialized AI agents across the CTEM lifecycle to continuously determine what matters and what should happen next.

SAFE CTEM brings together threat activity, exploitability, reachability, business impact, and compensating controls to dynamically prioritize exposures. It can then validate whether an exposure is actually reachable and exploitable before mobilizing remediation workflows, helping teams move from a growing vulnerability backlog to prioritized, validated action.

Learn how the SAFE CTEM AI Co-Worker moves exposures from findings to fixes at machine speed.