Entra ID CVE-2026-69836 CVSS 10.0: unauthenticated RCE on cloud identity infrastructure confirmed exploited, Microsoft patched server-side, no customer action required but investigation is      GitLab CVE-2026-19478 now confirmed exploited: WatchTowr honeypots detect first in-the-wild attempts, NSA and CISA publish joint advisory, hunt for @gl_introduced in web logs      Operation CameraSwarm: 14,530 Dahua cameras compromised June to July, attackers left a 407MB working directory exposed online reconstructing the entire campaign      Entra ID CVE-2026-69836 CVSS 10.0: unauthenticated RCE on cloud identity infrastructure confirmed exploited, Microsoft patched server-side, no customer action required but investigation is      GitLab CVE-2026-19478 now confirmed exploited: WatchTowr honeypots detect first in-the-wild attempts, NSA and CISA publish joint advisory, hunt for @gl_introduced in web logs      Operation CameraSwarm: 14,530 Dahua cameras compromised June to July, attackers left a 407MB working directory exposed online reconstructing the entire campaign     
CyberSipTM
Intelligence without the noise
Issue No. 114
August 21, 2026
3 items · past 24h
<5 min read
Today's picture

Microsoft confirmed active exploitation of CVE-2026-69836, a CVSS 10.0 deserialization flaw in Entra ID that allowed an unauthenticated attacker to execute arbitrary code on the cloud identity platform authenticating access to Microsoft 365, Azure, and every third-party application connected through Entra, with Microsoft having deployed a server-side fix before disclosure and stating no customer action is required, but disclosing no timeline, no actor, and no scope for the exploitation. GitLab CVE-2026-19478, the CVSS 9.4 GraphQL code injection first covered in Issue 111, moved to confirmed active exploitation today after WatchTowr honeypots detected the first in-the-wild attempts, with the NSA and CISA publishing a joint advisory naming @gl_introduced as the specific log indicator to hunt and the 18.2 through 18.10 branch gap still unresolved. Hunt.io disclosed Operation CameraSwarm, a campaign that compromised 14,530 Dahua IP cameras between June 17 and July 22, 2026, using credential attacks, authentication bypass flaws, and a peer-to-peer relay technique, reconstructed in full detail from a 407MB exposed working directory the attackers left online containing their tooling, logs, and shell history.

Today's intelligence
3 items
01 CriticalMicrosoft Entra IDCloud Identity RCE
Entra ID had a CVSS 10.0 unauthenticated RCE that was exploited in the wild before Microsoft disclosed it, with no customer action required but no scope details published
CVE-2026-69836 is a deserialization flaw in the platform that authenticates access to Microsoft 365, Azure, and every connected third-party application. An unauthenticated attacker could execute code on Entra's backend without any user interaction. Microsoft patched it server-side and disclosed it for transparency. The patch is already applied. The investigation is not.
CVECVE-2026-69836
CVSS 10.0
TypeDeserialization RCE
CWE-502
Unauthenticated
PatchedServer-side by
Microsoft before
disclosure
Customer actionNone required
for patching
ExploitationConfirmed in wild
No timeline/actor
disclosed
Microsoft disclosed CVE-2026-69836 on August 20, 2026, confirming that the vulnerability had already been exploited in the wild and that Microsoft had already deployed the fix to Entra ID's infrastructure before public disclosure. The vulnerability is a deserialization of untrusted data flaw classified under CWE-502 in Microsoft Entra ID, the cloud-based identity and access management platform formerly known as Azure Active Directory. Entra ID is the authentication and authorization backbone for Microsoft 365, Azure services, and any third-party application that uses Entra for single sign-on or OAuth integration. The flaw allowed an unauthenticated remote attacker to send specially crafted serialized data to a vulnerable Entra ID endpoint. Without adequate validation of the incoming data, the service reconstructed the malicious object, enabling the attacker to execute arbitrary code in the context of the affected service. No authentication was required. No user interaction was required. The CVSS score is 10.0, the maximum possible. Microsoft's advisory states the vulnerability has been fully mitigated and that there is no action for customers to take regarding patching. Microsoft has not disclosed when exploitation began, how long it was active, who was behind it, how many tenants were affected, or what the attacker did with code execution on Entra's backend. Microsoft has also not disclosed whether the code execution could be used to access tenant data, manipulate authentication tokens, alter access policies, or perform any specific action against connected Microsoft 365 or Azure environments. The disclosure exists under Microsoft's cloud service CVE transparency policy, which surfaces exploited flaws even when the fix is infrastructure-side, so customers can investigate whether they were affected.
Entra ID is not an endpoint. It is the identity control plane for the entire Microsoft cloud ecosystem. An attacker with code execution on Entra's backend is operating in the system that issues, validates, and revokes the authentication tokens that control access to every Microsoft 365 mailbox, SharePoint site, Teams channel, Azure resource, and third-party application integrated through the platform. Microsoft has confirmed exploitation occurred. Microsoft has not confirmed what the attacker did with that code execution access. The absence of information about scope, timing, and actor is not evidence of limited impact. It is the current limit of what Microsoft has chosen to disclose. For security teams at organizations that use Entra ID, the investigative question is whether there is any signal in their tenant's sign-in logs, conditional access logs, or token issuance logs from before the fix was deployed that is consistent with unauthorized access or token manipulation. Microsoft's disclosure was transparently motivated: the fix is in, but the breach investigation for any tenant that was affected during the exploitation window is still open.
Microsoft's cloud CVE transparency policy is worth understanding in its own right. When Microsoft discloses a CVE for a cloud service that has already been patched server-side, the advisory is specifically for customer awareness and investigation, not for remediation. The practical implication is that the typical workflow of receiving a CVE, identifying affected systems, and deploying a patch does not apply. The work for this disclosure is in the investigation: reviewing Entra sign-in and audit logs for anomalous token issuance, access policy changes, or service principal activity during the window before the fix; checking whether any enterprise application or service principal permissions changed unexpectedly; and reviewing conditional access policy changes in the Entra audit log. Microsoft Entra logs are accessible through the Entra admin center and through Microsoft Sentinel or any SIEM connected to Entra's diagnostic settings. The specific log query to run is against Entra's AuditLogs and SignInLogs tables for changes to service principals, application registrations, and conditional access policies during the period before today's disclosure.
  • Review Entra ID audit logs for unexpected changes to service principals, application registrations, OAuth permissions, and conditional access policies. Focus the review on the period before today's disclosure, as the exploitation predated the fix. Access these logs through the Entra admin center under Monitoring and Health, Audit Logs, or through a connected SIEM using the AuditLogs table in Microsoft Sentinel.
  • Review Entra sign-in logs for anomalous authentication patterns: sign-ins from unexpected locations or IP addresses, successful sign-ins for accounts that should not have been active, or sign-ins with unusual token scopes or claims. Token manipulation is a plausible exploitation outcome for code execution on the Entra backend, and sign-in logs would surface token-based access even if the manipulation itself leaves no Entra-side record.
  • Ensure Entra diagnostic settings are configured to export sign-in and audit logs to a Log Analytics workspace or SIEM with adequate retention. If logs are not currently being exported with sufficient retention, the investigative window for this incident may already be closed. Configuring log export going forward ensures future incidents can be investigated with appropriate history.
The patch is in. Microsoft applied it before telling anyone. The exploitation already happened. What Microsoft has not disclosed is what the attacker did, how long they had access, or how many tenants were affected. Review the Entra audit and sign-in logs for the period before today. The investigation window is open now and may not stay that way.
02 HighGitLab CVE-2026-19478Now Exploited
GitLab CVE-2026-19478 is now confirmed exploited: WatchTowr honeypots detected the first attacks and NSA and CISA published a joint advisory today
This updates Issue 111. WatchTowr's honeypots caught the first in-the-wild exploitation attempts for the CVSS 9.4 GraphQL code injection. The NSA and CISA joint advisory names @gl_introduced as the specific directive to hunt in web server logs. Patch is available for most versions. The 18.2 through 18.10 branch gap is still open.
CVECVE-2026-19478
CVSS 9.4
ExploitationConfirmed today
WatchTowr honeypots
Joint advisoryNSA + CISA
August 21, 2026
Log indicatorHunt for
@gl_introduced
in web server logs
Branch gapNo patch for
18.2–18.10
WatchTowr's honeypot network detected the first confirmed in-the-wild exploitation attempts targeting CVE-2026-19478 in GitLab as of August 21, 2026. GitLab issued its emergency patch on August 17, four days ago. This brief covered the vulnerability in Issue 111, at which point no exploitation had been confirmed. The NSA and CISA published a joint advisory on August 21 covering CVE-2026-19478, providing specific detection guidance and recommending immediate remediation for all self-managed GitLab instances. The joint advisory names the specific GraphQL directive involved in the attack as @gl_introduced, which was the detail under a 90-day technical embargo since the August 17 patch. With exploitation now confirmed and the joint advisory publishing this indicator, WatchTowr's principal security researcher Jake Knott recommended that unpatched organizations immediately audit web server logs for requests containing @gl_introduced and identify any signs of probing or exploitation. Knott noted that the flaw enables unauthenticated attackers to delete public GitLab projects, rewrite their state, or manipulate merge records with a single HTTP request, and that WatchTowr was able to demonstrate the vulnerability within minutes using the advisory details and patch diffing. The 18.2 through 18.10 branch gap remains unresolved. GitLab has not published a patch for those versions. No specific attribution for the exploitation attempts has been published.
GitLab is the central version control and CI/CD platform for many enterprise software development operations. Confirmed exploitation of a vulnerability that allows unauthenticated project deletion or modification is a supply chain risk: an attacker who can delete or alter a public GitLab repository can remove release artifacts, corrupt source history, or replace legitimate code with malicious content in a repository that downstream developers and automated systems pull from. The four days between patch publication and first confirmed exploitation is consistent with the pattern WatchTowr flagged when it noted the flaw could be demonstrated within minutes from advisory details. That window was always going to close quickly, and it did. Organizations running self-managed GitLab instances on any version before the patched releases and on the unpatched 18.2 through 18.10 branch range should operate on the assumption that their instances have been probed, even if not yet confirmed as compromised.
The NSA and CISA joint advisory on a GitLab vulnerability is an indicator of how seriously the agencies assess the supply chain risk from CVE-2026-19478. Joint advisories from both agencies on a single product vulnerability are not routine. The previous joint NSA/CISA advisory on a version control platform vulnerability, covering a Bitbucket Server issue in 2023, preceded widespread exploitation that affected multiple government contractors and critical infrastructure operators. The @gl_introduced log indicator is actionable now. Any self-managed GitLab instance should have its web server access logs reviewed for requests containing this string from August 17 onward. The presence of such requests confirms active probing and potentially successful exploitation depending on the GitLab version running at the time of the request. Organizations on the 18.2 through 18.10 branches with no available patch should restrict unauthenticated external access to the /api/graphql endpoint as the highest-priority interim control.
  • Audit web server access logs on all self-managed GitLab instances for requests containing @gl_introduced from August 17 onward. This is the specific GraphQL directive used in the CVE-2026-19478 attack. Requests containing this string in the request body indicate probing or exploitation attempts, and the response codes in those log entries indicate whether they were successful against the instance's version.
  • Apply the GitLab patch if not yet done: upgrade to 19.2.4, 19.1.6, 19.0.8, or 18.11.11. Organizations on the 18.2 through 18.10 branch range with no available patch should immediately restrict unauthenticated external access to /api/graphql at the web server, reverse proxy, or WAF level as the highest-priority interim control. Consider temporarily pulling internet-facing instances behind a VPN until the version upgrade is complete.
  • Review the GitLab repository activity logs for all public projects on self-managed instances for unexpected deletion, modification, or merge record changes since August 17. Confirmed exploitation at other organizations does not confirm compromise of your instance, but repository audit logs will surface any unauthorized changes if they occurred.
Four days from patch to confirmed exploitation. WatchTowr caught the first attempts. NSA and CISA published a joint advisory today. Hunt @gl_introduced in your GitLab web server logs from August 17 onward. Patch or restrict the GraphQL endpoint. The 18.2 through 18.10 branch gap still has no fix.
03 HighDahua CamerasOperation CameraSwarm
Operation CameraSwarm compromised 14,530 Dahua cameras in five weeks and accidentally left a 407MB working directory online that documented the entire campaign
Hunt.io found the attackers' own working directory exposed on their infrastructure: 2,616 files across 234 subdirectories, including tooling, logs, and shell history, which reconstructed the campaign from start to finish. The attackers used credential attacks, two authentication bypass CVEs, and a peer-to-peer relay technique. 1,923 cameras received a persistent backdoor account.
CampaignOperation CameraSwarm
Hunt.io
DevicesDahua IP cameras
Compromised14,530 cameras
Jun 17–Jul 22, 2026
Backdoored1,923 with
persistent account
P2P relay283 via Dahua's
P2P cloud feature
Hunt.io researchers disclosed Operation CameraSwarm on August 21, 2026, a campaign targeting Dahua IP cameras that ran from June 17 through July 22, 2026. Dahua is a major Chinese manufacturer of IP cameras used in physical security, surveillance, and monitoring deployments worldwide. The campaign was not discovered through traditional threat intelligence channels. Instead, Hunt.io found an exposed working directory on the attackers' own infrastructure, an open web-accessible directory containing 407MB of data spread across 2,616 files in 234 subdirectories. The exposed data included attack tooling, session logs, shell history, campaign records, and configuration files that allowed Hunt.io to reconstruct the campaign in detail. The attackers used three entry methods: credential attacks against cameras with default or weak passwords, exploitation of two authentication bypass vulnerabilities in Dahua products, and a peer-to-peer relay technique that abused Dahua's own P2P cloud connectivity feature. The P2P feature is designed to allow remote access to cameras through Dahua's cloud relay without opening ports, which means cameras reachable through this method are accessible even if they are not directly internet-exposed. Of the 14,530 cameras reached during the campaign, 1,923 were configured with a persistent backdoor administrative account during the operation and 283 were accessed specifically through the P2P relay path. Compromised cameras were concentrated in Ukraine and Russia, according to Hunt.io's geographic analysis of the campaign records. The specific Dahua authentication bypass CVEs used were not named in the initial disclosure but are described as two separate flaws documented in the working directory. Hunt.io recommended that Dahua camera operators install corresponding fix software or newer firmware, disable the P2P feature where it is not actively required, and verify firmware against the vendor's download site to ensure it has not been tampered with.
Dahua cameras are deployed in physical security systems at commercial facilities, government buildings, critical infrastructure sites, and transportation hubs worldwide. A compromised Dahua camera is not just a network entry point. It is a physical surveillance device that gives an attacker access to the camera's video feed, pan and tilt controls if present, and in many deployments, the ability to move within the network segment where the camera sits. The persistent backdoor account installed on 1,923 cameras means those devices remain under attacker control regardless of credential rotation unless the firmware is updated and the backdoor account is removed. The P2P relay finding is separately significant: cameras accessed through Dahua's P2P cloud feature are reachable without any externally open ports, meaning network scans that check for internet-exposed cameras will not surface the P2P-accessible devices as exposed. Organizations that believe their Dahua cameras are protected from external access because they are not directly internet-exposed may have accessible cameras through the P2P path.
The exposed working directory is operationally significant beyond documenting this specific campaign. It represents an attacker operational security failure that provided defenders with a complete reconstruction of how the campaign was conducted, what tools were used, which specific CVEs were exploited, and how persistence was maintained. This class of OPSEC failure, specifically an exposed web-accessible directory on attacker infrastructure, has produced some of the most detailed threat intelligence reports of the past five years. For defenders, the lesson is not only about the specific Dahua campaign. It is that attacker infrastructure itself can be a source of intelligence when it is improperly secured. Hunt.io's disclosure of the full campaign reconstruction from a single exposed directory demonstrates that proactive scanning of known attacker infrastructure can surface campaign details that internal network telemetry would not have captured until after the fact.
  • Update all Dahua camera firmware to the latest version available on Dahua's official download site. Verify firmware integrity against the vendor's published hash before installing. If cameras are running firmware that predates the authentication bypass patches documented in Hunt.io's research, treat those devices as potentially compromised until updated.
  • Audit all Dahua camera administrative accounts for unexpected entries. The persistent backdoor account installed on 1,923 cameras in this campaign would appear as an additional administrative account in the camera's user management settings. Review and remove any accounts that were not explicitly created by your organization.
  • Disable the Dahua P2P cloud connectivity feature on all cameras where it is not actively required for legitimate remote access. The P2P feature provides network access to cameras without externally open ports, which means network perimeter controls do not block it. Disabling P2P where unused removes this access path. Check camera settings under the remote access or network configuration section for the P2P or cloud connectivity option.
The attackers left their entire working directory exposed online. Hunt.io found it and reconstructed the campaign from their own logs. 14,530 cameras compromised. 1,923 backdoored. 283 reached through the P2P cloud relay that bypasses external port scans. Update the firmware, audit the accounts, and disable P2P where you do not need it.
Cross-source standouts
01
Entra ID and the new category of cloud CVE: confirmed exploitation with no customer remediation and no scope disclosure
CVE-2026-69836 represents a category of vulnerability disclosure that has become more common as major cloud providers adopt transparency policies for cloud-infrastructure CVEs. The traditional vulnerability response cycle, receive advisory, identify affected systems, deploy patch, verify, close, does not apply. Microsoft has already applied the fix. Customers cannot patch something they do not control. What the disclosure creates is an investigative obligation without a corresponding remediation action. The absence of customer remediation steps should not be read as evidence that the impact was limited. It means the impact assessment is entirely dependent on whether customers can find signals in their own tenant logs from a period when they did not know they were at risk. This is a structurally difficult situation: the investigation window is the period before the disclosure, the signals are in logs that may not have been retained or exported, and Microsoft has disclosed only that exploitation occurred without specifying what the attacker did or could have done with unauthenticated code execution on the identity control plane. The September 2025 Entra ID privilege escalation flaw, CVE-2025-55241 reported by researcher Dirk-jan Mollema, gave attackers complete access to any Microsoft Entra ID tenant in the world. CVE-2026-69836's exploitation at CVSS 10.0 is a more severe class of impact. The investigation question for any organization using Entra ID is whether their tenant was one of the ones in the exploitation window, and whether they have the log retention to find out.
02
GitLab CVE-2026-19478 and the closing window: four days from patch to confirmed exploitation on a flaw demonstrable in minutes
Issue 111 covered CVE-2026-19478 on August 18 and noted WatchTowr's observation that the vulnerability could be demonstrated within minutes using the advisory details and patch diffing, with no public exploit code. Issue 114 covers its confirmed exploitation on August 21, four days later. The timeline is consistent with what WatchTowr and this brief have documented repeatedly throughout August: the gap between a patched vulnerability's advisory publication and the first exploitation attempts is measured in days and sometimes hours, not weeks. For self-managed GitLab instances in the 18.2 through 18.10 branch range with no available patch, the four-day window has already elapsed. Those instances should be treated as having been under active attack since August 17 without any technical protection. The NSA and CISA joint advisory, and the specific @gl_introduced log indicator it names, provides the first concrete detection signal for whether exploitation was attempted or successful on a specific instance. Any organization in that branch range that has not yet restricted the /api/graphql endpoint, audited web server logs, or begun the version upgrade process has been operating without effective protection against a confirmed, actively exploited critical vulnerability for four days. The appropriate next action is not to note this and plan for next week's maintenance window. It is to restrict the endpoint today.
Still watching
Days 2–5
ShieldBreak CVE-2026-69414 (Issue 113 · Defender patch bypass, no patch available) — low privilege to SYSTEM on fully patched Windows 10, 11, and Server 2025. No patch available. Microsoft investigating. Monitor MSRC for update. Apply defense-in-depth controls. Update endpoint detection for CVE-2026-69414 indicators specifically, not RoguePlanet detections.
Day 2
Ray CVE-2025-62593 (Issue 111 · CISA KEV, federal deadline passed August 20) — upgrade to Ray 2.52.0 and restrict ports 8265 and 8000. For clusters accessible before August 20, audit job history and rotate AI provider keys and cloud credentials. Network isolation is required beyond the patch.
Day 4
GeoServer zero-day (no CVE, no patch) (Issue 108 · active probing, jsonArrayContains SQL injection) — no patch available as of August 21. Restrict public access to WFS endpoints. Limit SQL Server backend permissions to block xp_cmdshell. Monitor logs for SQL injection patterns since August 12.
Day 7+
M365 Copilot prompt injection (Issue 98 · Hakon Maloy, reported March 7, 2026) — no CVE, no patch, 167 days. CoSnitch, SearchLeak, and Reprompt were all patched; the enterprise Copilot prompt injection path documented in Issue 98 remains open. Scope Copilot connector access tightly and treat Copilot memory as a potential persistence mechanism.
Day 7+