Signal Brief #2: N-central takeover, TeamCity exploitation and exposed management planes

Analytical brief

Key findings

• Remote management, CI/CD and load-balancing systems dominate the urgent queue because compromise can provide control beyond the vulnerable server itself.
• N-central shows why installing the first hotfix is not the same thing as closing an incident: CVE-2026-18577 followed an incomplete fix and required additional mitigation.
• The Adform case shows that a trusted browser-side dependency can modify transaction data without installing persistent malware on the visitor's device.

Scope

Defender-relevant developments added to CISA KEV or materially updated between 3 and 9 August 2026, plus one independently analysed supply-chain incident.

Limitations

This is a prioritisation brief, not a complete threat landscape. Exposure, affected versions, vendor guidance and compromise evidence must be verified in each environment.

This week is mostly about systems that defenders use to control other systems. Remote monitoring, CI/CD and load-balancing platforms are useful precisely because they have reach. That same reach becomes the attacker’s multiplier when the management plane is left exposed.

Vulnerabilities to triage

CRITICAL · KNOWN EXPLOITED · INCOMPLETE FIX

CVE-2026-18577 and CVE-2026-18556: N-able N-central

Affected surface

N-central remote monitoring and management servers

Attack result

Authentication bypass and account takeover

CISA added both authentication-bypass vulnerabilities to KEV during the week. CVE-2026-18577 represents an alternate path left after the earlier CVE-2026-18556 fix. That distinction matters because an N-central compromise is not confined to one web application. The platform is designed to administer downstream endpoints.

Do now: follow N-able’s latest guidance and deploy the current additional mitigation, not a superseded first hotfix. Confirm the installed build, reduce internet exposure, review newly created or modified accounts, remote sessions, scripts and activity targeting high-value systems. Treat an exposed, unpatched server as an incident-scoping problem.

Read N-able's Hotfix 2 notice → · CISA KEV entry →

CRITICAL · KNOWN EXPLOITED · UNAUTHENTICATED RCE

CVE-2026-9198: IBM Langflow

Affected surface

Default Langflow deployments

Attack result

Code execution without authentication

CISA describes an unauthenticated code-injection path leading to full remote code execution on default deployments. An AI workflow builder is still a server with credentials, integrations and access to data. Calling it an “AI tool” does not make ordinary exposure management optional.

Do now: identify reachable Langflow instances, apply IBM’s fixed release guidance, remove unnecessary public access and review process execution, outbound connections, secrets and workflow changes. If the service was exposed before remediation, patching alone does not answer whether it was used.

Read the IBM security bulletin → · CISA KEV entry →

CRITICAL · ACTIVE EXPLOITATION · CI/CD

CVE-2026-63077: JetBrains TeamCity

Affected surface

TeamCity On-Premises reachable over HTTP(S)

Attack result

Unauthenticated operating-system command execution

JetBrains now reports active and attempted exploitation against unpatched servers. The flaw is reached through the agent polling protocol. Successful exploitation can expose stored credentials, alter server state and undermine build artifacts or downstream pipelines.

Do now: upgrade to 2025.11.7 or 2026.1.3, or apply the security patch plugin where an immediate upgrade is impossible. Search logs for com.thoughtworks.xstream.converters.ConversionException, review unauthorized agents, especially names beginning with scan, and investigate credentials available to the server and its builds.

Read JetBrains' exploitation update → · CISA KEV entry →

CRITICAL · KNOWN EXPLOITED · EDGE INFRASTRUCTURE

CVE-2026-8037: Progress Kemp LoadMaster

Affected surface

LoadMaster GA 7.2.63.1 and earlier; LTSF 7.2.54.17 and earlier

Attack result

Pre-authentication command injection

The vulnerability permits arbitrary command execution through unsanitised input in multiple command endpoints. Load balancers live in a particularly useful part of the network: externally reachable, trusted and positioned in front of applications defenders actually care about.

Do now: apply the latest Progress fix, restrict administrative access and review appliance logs, configuration changes, new accounts, unexpected outbound traffic and signs of follow-on access to systems behind the load balancer.

Read the Progress bulletin → · CISA KEV entry →

HIGH PRIORITY · KNOWN EXPLOITED · CLUSTER SECURITY

CVE-2026-34486: Apache Tomcat EncryptInterceptor bypass

Affected condition

Tomcat clustering using the affected EncryptInterceptor implementation

Why it matters

A prior security fix could be bypassed

Apache states that an error in the CVE-2026-29146 fix allowed EncryptInterceptor protection to be bypassed. CISA also notes that the condition can be chained with CVE-2025-24813. This one is configuration-sensitive, so the useful question is not simply “do we run Tomcat?” but “do we use the affected clustering path, on which versions, across which trust boundary?”

Do now: inventory Tomcat clusters and versions, move to the fixed release for the maintained branch, verify EncryptInterceptor configuration and keep cluster traffic off untrusted networks.

Read Apache Tomcat's vulnerability record → · CISA KEV entry →

Development worth watching

WATCH · SOFTWARE SUPPLY CHAIN · BROWSER-SIDE IMPACT

Adform’s shared JavaScript became a crypto clipper

The compromised trackpoint-async.js did not need to install malware on every visitor. While an affected page was open, the appended code could replace Bitcoin and Ethereum addresses in page text, form fields and clipboard-related events. My analysis recovered four payload variants and found 83 exact-hash observations across 59 hosts. Fifty-five hosts received at least one variant containing valid replacement wallets; four only received the early variant with invalid address strings.

Do now: identify where the script was loaded, search cached and edge-served responses beyond the central incident window, preserve affected JavaScript and browser evidence, and review cryptocurrency workflows that trusted browser-rendered addresses. A clean origin response today does not prove every intermediary cache was clean yesterday.

Read the complete HECAVEX investigation → · Read Adform's incident update →

Bottom line

Start with reach and blast radius. N-central, TeamCity and LoadMaster can affect far more than the first compromised process. Confirm the latest fix actually installed, then look backwards for exploitation instead of declaring victory at the end of an upgrade wizard. For the Adform incident, include browser-side dependencies and stale caches in the investigation scope.

All vulnerability priorities above were present in CISA KEV by the stated information cut-off. Vendor guidance and exploitation details can change after publication.