Exploitation ReportSeptember 4, 2026

Executive Summary

Active exploitation campaigns are targeting critical vulnerabilities across WordPress ecosystems, enterprise networking equipment, and widely deployed client software. Over 440,000 exploit attempts have been recorded against Super Forms and Elementor Pro plugins, with CVE-2026-32475 in Elementor Pro actively delivering webshells to compromise WordPress sites. Google has patched an actively exploited V8 type confusion zero-day (CVE-2026-85046) in Chrome, while Cisco has addressed a critical unauthenticated RCE (CVE-2026-20212) affecting ten Nexus 9000 switch models. These incidents demonstrate rapid weaponization of high-severity flaws across both web applications and infrastructure hardware.

Simultaneously, multiple zero-day and undisclosed vulnerabilities are emerging in security and productivity tools. A proof-of-concept for FalconFlank—a privilege escalation in CrowdStrike Falcon Sensor—has been publicly released, while NSO Group's Pegasus spyware leveraged an iMessage zero-click exploit to infect a Serbian activist's iPhone. Plex has issued urgent update advisories for multiple undisclosed flaws across its media server and desktop clients, with CVE identifiers still pending. Threat actors are also abusing legitimate software such as Node.js runtime for malware delivery in targeted campaigns against government, technology, and hospitality sectors since February 2026.

Threat actor activity shows increased sophistication in both automated and targeted operations. The Shai-Hulud infostealer worm has expanded its credential-harvesting scope to 469 locations across developer environments, CI/CD pipelines, and AI tool configurations. The "Phantom Deal" campaign conducts detailed reconnaissance for business email compromise via fake M&A scenarios, while an RMM phishing operation spanning 46 countries now targets the United States as its primary victim. Supply chain compromise of Coder's registry infrastructure delivered malicious Terraform modules, and the BraZetsu framework commercializes access to compromised Windows hosts through an Initial Access Broker marketplace model.

Active Exploitation Details

−CVE-2026-32475 - Elementor Pro WordPress Plugin RCECriticalActive exploitationPatchCVE-2026-32475#

−CVE-2026-14894 - Super Forms WordPress Plugin File UploadCriticalActive exploitationPatchCVE-2026-14894#

−CVE-2026-85046 - Chrome V8 Type Confusion Zero-DayHighActive exploitationPatchCVE-2026-85046#

−CVE-2026-20212 - Cisco Nexus 9000 Unauthenticated RCECriticalObservedPatchCVE-2026-20212#

−FalconFlank - CrowdStrike Falcon Sensor Privilege EscalationHighPotentialInvestigate#

−Pegasus iMessage Zero-Click ExploitCriticalActive exploitationMonitor#

−Plex Multiple Undisclosed Security FlawsSeverity unknownStatus unknownPatch#

−HPE ArubaOS-CX Critical RCECriticalObservedPatch#

Affected Systems and Products

• Elementor Pro WordPress Plugin: Versions prior to the patched release containing fix for CVE-2026-32475; WordPress sites with Elementor Pro installed.
• Super Forms – Drag & Drop Form Builder WordPress Plugin: Versions vulnerable to CVE-2026-14894; WordPress sites using the Super Forms plugin.
• Google Chrome: Versions prior to 152.0.7977.82 across Windows, macOS, and Linux platforms.
• Cisco Nexus 9000 Series Switches: 10 Silicon One-based models including N9K-C9316D-GX, N9K-C9324D-GX2A, N9K-C9324D-GX2B, N9K-C9336C-FX2, N9K-C9348D-GX2A, N9K-C9348D-GX2B, N9K-C9364C-GX, N9K-C9324D-GX2A, N9K-C9324D-GX2B, and N9K-C9316D-GX.
• Cisco IOS XR: Multiple versions across Cisco routing platforms; 7 umbrella CVEs addressed in hardening release with no workaround for any version.
• CrowdStrike Falcon Sensor: Versions containing the vulnerable "office malicious macros remediation" feature; Windows endpoints with Falcon Sensor deployed.
• Apple iOS/iMessage: iPhone devices targeted by NSO Group's Pegasus spyware via zero-click iMessage exploit; specific iOS versions not disclosed.
• Plex Media Server: Versions prior to 1.43.3 across all supported platforms (Windows, macOS, Linux, NAS devices).
• Plex Desktop: Versions prior to 1.115.0 on Windows and macOS.
• HPE ArubaOS-CX: Network switches running vulnerable versions of ArubaOS-CX; specific version details in HPE security advisory.

Attack Vectors and Techniques

• Unauthenticated File Upload to RCE: Attackers exploit missing file type validation in WordPress plugins (Super Forms CVE-2026-14894, Elementor Pro CVE-2026-32475) to upload malicious PHP webshells, achieving remote code execution without authentication.
• Browser Engine Zero-Day Exploitation: Type confusion in Chrome's V8 JavaScript engine (CVE-2026-85046) exploited via crafted web content to achieve remote code execution and sandbox escape.
• Network Device Unauthenticated RCE: Root-level code execution on Cisco Nexus 9000 switches (CVE-2026-20212) without authentication, enabling infrastructure compromise.
• Security Agent Privilege Escalation: Abuse of CrowdStrike Falcon Sensor's "office malicious macros remediation" feature (FalconFlank) for local privilege escalation to SYSTEM.
• Zero-Click Mobile Exploitation: iMessage zero-click exploit delivering Pegasus spyware without user interaction, targeting high-value individuals.
• Living-off-the-Land with Node.js: Threat actors leverage the trusted Node.js runtime (node.exe) as a malware delivery mechanism, exploiting its legitimate presence and capabilities to evade detection in targeted attacks against government, technology, and hospitality sectors since February 2026.
• Infostealer Credential Harvesting at Scale: Shai-Hulud worm variant scans 469 credential locations across developer environments, CI/CD tooling, cloud configurations, and AI tool configs—expanded from 189 paths in earlier variants.
• Supply Chain Compromise: Attackers compromised Coder's Cloudflare infrastructure to inject unauthorized registry servers delivering malicious Terraform modules containing credential-stealing code.
• Business Email Compromise via Social Engineering: "Phantom Deal" campaign conducts detailed company reconnaissance to craft convincing fake M&A communications targeting midlevel employees for financial fraud.
• RMM Phishing with Tax-Themed Lures: Phishing campaign using Remote Monitoring and Management (RMM) tools and Canada Revenue Agency tax form lures, expanded to 46 countries with 45% targeting the United States (601 observed cases).
• Commercialized Access Brokerage: BraZetsu malware framework converts compromised Windows hosts into inventoried assets for Initial Access Brokers, featuring a comprehensive toolkit beyond standard infostealer capabilities.

Threat Actor Activities

• NSO Group: Deployed Pegasus spyware via iMessage zero-click exploit against a Serbian student movement member; confirmed by Citizen Lab and SHARE Foundation analysis showing high-confidence indicators of compromise.
• Shai-Hulud Operators: Evolved infostealer worm to harvest credentials from 469 locations across developer environments, CI/CD pipelines, cloud configurations, and AI tool configurations—representing a 148% increase from earlier 189-path variants.
• Phantom Deal Campaign Operators: Conduct extensive reconnaissance on target companies to execute highly convincing fake merger and acquisition scams, targeting midlevel employees to initiate fraudulent financial transfers.
• RMM Phishing Campaign Operators: Run a multi-national phishing operation spanning 46 countries using RMM tools and tax-themed lures (initially CRA forms), with the United States as the top target at 45% of observed activity; 601 cases linked by ANY.RUN research.
• Coder Registry Compromise Actors: Compromised Coder's Cloudflare infrastructure to inject malicious registry servers distributing trojanized Terraform modules with credential-stealing payloads—a supply chain attack targeting infrastructure-as-code workflows.
• BraZetsu Framework Operators/Initial Access Brokers: Utilize the Python-based BraZetsu malware framework to convert compromised Windows hosts into commercialized inventory for access brokering, providing a master toolkit that goes beyond standard infostealer functionality.
• Chaotic Eclipse (INFINITE NIGHTMARE/MSNightmare/Nightmare-Eclipse): Security researcher who publicly released the FalconFlank proof-of-concept exploit for a zero-day privilege escalation in CrowdStrike Falcon Sensor.
• Unidentified Actors - WordPress Mass Exploitation: Conducting large-scale exploitation attempts (440,000+) against Super Forms (CVE-2026-14894) and Elementor Pro (CVE-2026-32475) vulnerabilities across WordPress installations.