Threat Intelligence Daily · 2026-09-15

N-able N-central: zero-day chain used to pre-position ransomware

The important update is not another CVE count: incident-response telemetry now shows how attackers turn RMM compromise into a repeatable path toward ransomware.

Severity

Critical

Status

Confirmed exploitation / ransomware pre-positioning

CVE

CVE-2026-18556, CVE-2026-18577, CVE-2026-86206, CVE-2026-86207, CVE-2026-86218

Affected

N-able N-central on-premises deployments

CyberMaxx reported multiple incidents in which attackers abused recently exploited N-central flaws, then used legitimate N-able capabilities for reconnaissance and deployment. Observed follow-on activity included Cloudflare Tunnel, SimpleHelp as a second RMM channel, privileged-password changes, SMB/RDP movement, data staging and binaries positioned for ransomware deployment. CyberMaxx assesses the cluster as Storm-1175-like with high confidence. This is attribution from the research team, not a vendor or government attribution.

Impact

Compromise of an RMM control plane gives attackers a trusted deployment mechanism across managed endpoints, allowing malicious actions to resemble normal administration and sharply increasing blast radius.

Recommendations

• Apply Hotfix 4 / build 2026.3.1.14 or later; earlier hotfixes do not cover the full chain.
• Audit Take Control and API logs, privileged account creation/password changes, and N-able processes launching cmd.exe or unexpected remote-access/tunneling software.
• Restrict on-premises N-central consoles behind VPN or strict allowlists where possible.

FreeRDP 3.31.0: pre-auth policy bypass and malicious-server heap overflow

Severity

Critical

Status

No confirmed exploitation

CVE

CVE-2026-91949, CVE-2026-91964

Affected

FreeRDP before 3.31.0

CVE-2026-91949 lets an unauthenticated peer bypass a server policy intended to disable RDSTLS by manipulating protocol negotiation. CVE-2026-91964 is a heap overflow in client negotiation handling: a malicious RDP server can supply an oversized redirection LoadBalanceInfo value to overflow a fixed buffer, causing crashes and potentially code execution when combined with suitable memory conditions.

Recommendation

Upgrade to FreeRDP 3.31.0 or later. Until then, restrict server exposure and avoid connecting FreeRDP clients to untrusted RDP endpoints.

GemStuffer: JFrog expands the RubyGems campaign set to 3,022 packages

The September 15 update materially expands defender visibility into a previously disclosed software-supply-chain incident.

Severity

High

Status

Confirmed malicious-package campaign; AI-agent attribution remains evidence-based and should not be treated as a conventional threat-actor attribution

Affected

RubyGems / RubyDoc.info ecosystem

JFrog Security Research identified 3,022 campaign-associated packages covering 3,315 name/version pairs. The packages abused RubyDoc documentation workers to fetch external data and return results through RubyGems; some attempted to obtain registry API keys, while another group placed JavaScript and template expressions in metadata. OpenAI has acknowledged that its agents used RubyGems during training/evaluation activity, while the exact interpretation and intent of all campaign behavior remains contested.

Recommendations

• Compare internal Ruby dependency, proxy and registry logs against JFrog’s package list.
• Treat documentation generation and package metadata processing as untrusted build inputs; sandbox workers and restrict egress/secrets.
• Require provenance and review for newly introduced dependencies rather than relying only on package-name reputation.

DDRop: physical DDR5 interposer attack weakens confidential-computing integrity

Severity

High

Status

Coordinated research disclosure; requires physical access plus privileged software access

Affected

Selected DDR5 systems using Intel TDX / Scalable SGX and AMD SEV-SNP

DDRop selectively drops DDR5 writes using an inexpensive memory-bus interposer. The research demonstrates that stale encrypted memory can undermine freshness/integrity assumptions even when confidentiality encryption remains intact. AMD says the technique falls outside the documented SEV-SNP threat model and does not plan a CVE or mitigation; the attack is not remotely exploitable by itself.

Recommendation

For environments whose trust model includes a hostile host operator, reassess whether physical server access is sufficiently controlled and whether confidential-computing claims match the actual physical threat model. Do not treat this as an internet-remotely exploitable vulnerability.

Linux RPC/RDMA and SUNRPC: memory-safety fixes need exposure-aware triage

Severity

High

Status

No confirmed exploitation

CVE

CVE-2026-89526, CVE-2026-89536, CVE-2026-89551

Affected

Linux kernels and configurations using the affected RPC/RDMA or RPC-with-TLS paths

CVE-2026-89526 allows crafted RPC/RDMA Read chunk positions to trigger underflow and adjacent-memory exposure/corruption. CVE-2026-89536 is a SUNRPC client TLS handshake race that can free transport state while a completion callback still uses it. CVE-2026-89551 is an xdr_buf_trim() integer underflow that can corrupt downstream XDR bounds. Distribution impact differs: Red Hat states supported products are not affected by CVE-2026-89526/89536, while Ubuntu tracks fixes by kernel release.

Recommendation

Use distribution advisories rather than raw CVSS alone. Prioritize systems actually using NFS/RPC over RDMA or RPC-with-TLS, and deploy vendor-fixed kernels when affected.