Russian hackers, part of the state-backed threat group APT28, have been exploiting a stored cross-site scripting (XSS) vulnerability in the Zimbra Collaboration Suite (ZCS) to gain remote code execution (RCE) and compromise the Zimbra server and target's email account. The Cybersecurity and Infrastructure Security Agency (CISA) added the vulnerability to its catalog of vulnerabilities exploited in the wild and ordered Federal Civilian Executive Branch (FCEB) agencies to secure their servers within two weeks.
What Happened
A critical Telnet vulnerability, tracked as CVE-2026-32746, has been discovered in GNU inetutils telnetd, a widely deployed implementation of the Telnet remote access protocol. The vulnerability enables attackers to take full control of affected systems before authentication even kicks in. The flaw is caused by a buffer overflow issue in the telnetd LINEMODE Set Local Characters (SLC) handler triggered during Telnet protocol negotiation.
Meanwhile, Ubiquiti has patched two vulnerabilities in the UniFi Network Application, including a maximum-severity flaw that may allow attackers to take over user accounts. The vulnerability, tracked as CVE-2026-22557, impacts UniFi Network application version 10.1.85 and earlier and is addressed in versions 10.1.89 or later.
Why It Matters
These vulnerabilities highlight the importance of keeping software up to date and the need for robust security measures to prevent privilege escalation. Attackers are increasingly targeting machine identities and authenticated session artifacts in addition to traditional username and password combinations and personally identifiable information (PII). According to SpyCloud's 2026 Identity Exposure Report, there has been a 23% increase in recaptured identity data, totaling 65.7B distinct identity records.
What Experts Say
"We're witnessing a structural shift in how identity is exploited," said Trevor Hilligoss, Chief Intelligence Officer at SpyCloud. "Attackers are no longer just targeting credentials. They're stealing authenticated access, including API keys, session tokens, and machine identities."
Key Numbers
- **9.8: CVSS rating of the critical Telnet vulnerability
- **10.1.85: affected UniFi Network application version
Key Facts
- Who: Russian hackers, part of the state-backed threat group APT28
- What: Exploiting a stored cross-site scripting (XSS) vulnerability in the Zimbra Collaboration Suite
- When: Added to CISA's catalog of vulnerabilities exploited in the wild
- Where: Ukrainian government entities
- Impact: Remote code execution (RCE) and compromise of the Zimbra server and target's email account
What to Watch
As these vulnerabilities are addressed, it's essential to remain vigilant and prioritize robust security measures to prevent privilege escalation and protect against emerging threats.