BartoszMazurczak.pl

Security Weekly #Sep 07, 2026: MikroTik, VMware Workstation, Cisco Nexus and SonicWall

·

#
Cybersecurity weekly cover — critical CVEs for VMware vCenter, TeamCity, Fortinet and Palo Alto, Aug 25 2026

The week opens with one message dominating the Monday morning logs and security bulletins: a flaw in MikroTik’s SSH key handling. CERT Polska confirmed active exploitation in the wild, and the attack vector relies on bypassing public key verification. Beyond MikroTik, Broadcom patched a virtual machine escape in VMware Workstation and Fusion, Cisco shipped a critical fix for Nexus 9000 switches built on Silicon One, and a fresh 0-day chain landed in CISA KEV for SonicWall SMA 1000 VPN gateways. Behind all of that, JetBrains published an official notice about its own Cadence environment being breached through an unpatched TeamCity server.

Below I gathered the most important technical details, affected versions, and the steps worth doing today in your environment.

1. MikroTik RouterOS: remote device takeover via exposed SSH port (CVE-2026-67276, CVE-2026-86060)

CERT Polska published a warning about a campaign running since September 2 that targets MikroTik routers with SSH service exposed to the Internet. The attackers chain two vulnerabilities (researchers dubbed the pair MikroTrick) and obtain full administrative access to the device without knowing the password or holding the private key.

  • CVE-2026-67276: a flaw in the verification of the RSA public key during SSH login. RouterOS did not compare the full key modulus assigned to the account. As a result, an attacker who knew the username and the public part of that user’s key could generate a matching replacement key and log in without holding the legitimate private key.
  • CVE-2026-86060: a parsing flaw for usernames that start with a disallowed character in the SSH subsystem. It allows privilege escalation and immediate acquisition of a session with full RouterOS administrator rights.

Affected versions:

  • RouterOS v6: from 6.0.0 up to versions below 6.49.21.
  • RouterOS v7 (long-term): from 7.0.0 up to versions below 7.23.4 (recommend 7.23.5 because of the DHCPv6 regression fix).
  • RouterOS v7 (stable): from 7.24 up to versions below 7.24.2.
  • Development channel: fixed in 7.25beta3.

What to do:

  1. Update RouterOS to 6.49.21 (v6 branch), 7.23.5 (long-term) or 7.24.2 (stable).
  2. If you cannot update the router immediately, block public access to management ports in the firewall (/ip service disable ssh, and also www, www-ssl and bandwidth-test) or restrict access to trusted IP addresses only.
  3. Check device state with /system/device-mode/print (a Flagged status means RouterOS internal mechanisms detected suspicious modifications).
  4. Review the logs and account list for unknown users (in particular accounts named ops or entries containing the string ssh:-2@).

Source: CERT Polska | Sekurak

2. VMware Workstation and Fusion: VM escape to host system (CVE-2026-59346, CVSS 9.3)

Broadcom published security advisory VMSA-2026-0019 that closes a critical flaw in the desktop hypervisors VMware Workstation and VMware Fusion.

  • CVE-2026-59346 (CVSS 9.3): an integer overflow in the VMXNET3 virtual network card handling. A local user with administrator rights inside the virtual machine (guest) can use this flaw to execute arbitrary code on the physical machine (host).
  • CVE-2026-59347 (CVSS 8.1): a stack buffer overflow in the HGFS (Host-Guest File System) module that lets the virtual machine administrator execute code in the context of the VMX process running on the host.

Affected versions: VMware Workstation 25H2 and 26H1; VMware Fusion 25H2 and 26H1.

What to do: install the update to VMware Workstation 26H1u1 or VMware Fusion 26H1u1. The vendor has no temporary workarounds for this vulnerability.

Source: Broadcom Advisory VMSA-2026-0019

3. Cisco Nexus 9000 (Silicon One): remote code execution as root (CVE-2026-20212, CVSS 9.8)

Cisco published a security advisory covering Nexus 9000 series switches based on the Cisco Silicon One architecture.

CVE-2026-20212 (CVSS 9.8): the flaw stems from the fact that TCP ports 43210 and 43211 are accessible by default in the default L3 VRF. A remote, unauthenticated attacker can connect to those ports and send crafted data that the switch operating system executes with root privileges. Sending malformed packets can also crash the S1HAL process and trigger a full switch reload.

Affected devices: Cisco Nexus 9000 models with Silicon One ASICs running Cisco NX-OS.

What to do:

  1. Apply the updated NX-OS software packages published by Cisco.
  2. As a temporary mitigation, configure Control Plane Policing (CoPP) or access control lists (ACLs) that block inbound traffic to TCP ports 43210 and 43211 from untrusted network segments.

Source: Cisco Security Advisory cisco-sa-n9k-s1-rce-EH8dEtr

4. SonicWall SMA 1000: unauthenticated RCE 0-day chain in CISA KEV (CVE-2026-83548, CVE-2026-83549)

CISA added two vulnerabilities in Secure Mobile Access (SMA) 1000 series devices to the Known Exploited Vulnerabilities catalog. SonicWall confirmed that these flaws were targeted by attackers before patches shipped.

  • CVE-2026-83548 (CVSS 10.0): a Server-Side Request Forgery (SSRF) flaw that can be triggered without authentication through the device management interface.
  • CVE-2026-83549 (CVSS 9.8): an OS command injection vulnerability. Chaining it with the SSRF flaw lets the attacker execute arbitrary system commands on the VPN gateway without holding any credentials.

Affected devices: SMA 6210 and 7210 models, plus the 8200v virtual instances, on the 12.4.3 and 12.5.0 release branches.

What to do: install the official platform patches (hotfix 12.4.3-03526 or hotfix 12.5.0-02952) and make sure the device management interfaces are not exposed directly to the open Internet.

Source: SonicWall Security Advisory SNWLID-2026-0016 | CISA KEV

5. JetBrains incident: Cadence environment compromised through unpatched TeamCity

Worth flagging: JetBrains disclosed a security incident in which attackers used a known remote code execution flaw in an unpatched TeamCity instance to break into the JetBrains Cadence development environment and exfiltrate AWS cloud credentials. JetBrains asked all Cadence users to immediately revoke and rotate any API keys and secrets used by CI/CD jobs. Another reminder that build servers exposed without current patches are target number one for ransomware and espionage groups.

Source: The Hacker News

What to do today

  1. Check MikroTik devices on the network edge: update RouterOS routers managed over SSH to 7.23.5 / 7.24.2 / 6.49.21. Verify the user list and /system/device-mode/print state.
  2. Block TCP ports 43210/43211 on Cisco Nexus switches: if your infrastructure includes Nexus 9000 devices with Silicon One ASICs, deploy CoPP/ACL rules and schedule the NX-OS update.
  3. Update workstations running VMware Workstation / Fusion: version 26H1u1 fixes the VM-to-host escape through the VMXNET3 adapter.
  4. Apply the hotfix on SonicWall SMA 1000 gateways: 6210, 7210 and 8200v devices need the 12.4.3-03526 or 12.5.0-02952 patch right away.
  5. Rotate keys in your CI/CD pipelines: if you use JetBrains Cadence or external TeamCity integrations, review token scopes and rotate cloud credentials.
Avatar photo

Autor

Bartek