Volexity reports China-linked UTA0560 and JungleBamboo chained Chrome zero-day CVE-2026-85046 with kernel flaws to spy on NGOs.
Volexity documented campaigns detected on September 1, 2026, in which China-linked actors UTA0560 and JungleBamboo (APT31) chained CVE-2026-85046 (V8 type confusion), CVE-2026-87491 (WebAssembly sandbox escape), and CVE-2026-85880 (Windows kernel privilege escalation in RtlpCreateServerAcl). Victims were lured via links on legitimate U.S. university sites vulnerable to reflected XSS, then served hidden exploit iframes behind a donation-form image. Although a V8 fix had landed in Chromium's source after private August reporting, Chrome had not yet shipped it, creating a patch gap the actors exploited. The two groups installed distinct payloads: UTA0560 delivered the GRIMWEDGE JScript backdoor via DLL side-loading, while JungleBamboo used the SUPERSTOMP loader to install the LONGTALE credential-stealing Chrome extension disguised as Google Gemini.
Espionage actors use the BlueMoon exploit kit to chain Chrome V8 and Windows kernel zero-days via spear phishing, gaining full admin on unpatched endpoints.
Proofpoint, working with Google Threat Intelligence Group, Microsoft Threat Intelligence Center and Volexity, reports that the BlueMoon exploit kit chains V8 type confusion CVE-2026-85046, V8 sandbox escape CVE-2026-87491 and Windows kernel LPE CVE-2026-85880, all rated high severity. The V8 flaws were fixed in upstream Chromium source but had not yet reached Chrome stable releases, creating a patch gap that attackers reverse-engineered and weaponized. A China-aligned state-sponsored actor used the kit from August 28 against a small number of US NGOs, mining and commodity trading firms via rapport-building spear phishing, and within days several mostly China-linked espionage clusters adopted BlueMoon. The chain yields full Windows admin privileges from a single phishing click; defenders should patch Chrome and Windows, apply Proofpoint detections and hunt for leftover artifacts.
Multiple China-linked espionage groups share the BlueMoon exploit kit chaining Chrome V8 zero-days and a Windows ALPC LPE to deploy backdoors.
Proofpoint and Volexity report that multiple espionage clusters share the BlueMoon exploit kit, chaining Chrome V8 zero-days CVE-2026-85046 and CVE-2026-87491 with the Windows ALPC local privilege escalation CVE-2026-85880. Proofpoint observed spearphishing use since August 28 by JungleBamboo (APT31), while Volexity saw UTA0560 targeting NGOs from September 1; UNK_LateNight hit US aerospace/defense with ShadowPad and UNK_DoubleCheck targeted Vietnamese manufacturers. The kit's maintainers reverse-engineer public Chromium fixes before stable Chrome releases, and Proofpoint suspects the ALPC exploit has existed since 2025.
Proofpoint reports four nation-state actors, mostly China-nexus, adopted the BlueMoon Chrome and Windows zero-day exploit kit within 12 days, targeting US organizations.
Proofpoint tracked an exploit kit dubbed BlueMoon that chains CVE-2026-85046, a Chrome V8 type-confusion bug, with an unnamed V8 sandbox escape and CVE-2026-85880, a Windows kernel privilege escalation using ALPC and the Windows Notification Facility. The first observed use was by China-nexus TA412 (APT31, Violet Typhoon, JungleBamboo) on August 28, 2026 against US NGOs, mining companies, and commodity trading firms, followed by UNK_LateNight targeting US aerospace and defense companies on September 2. Both V8 bugs were patch-gap zero-days: the fix was committed to Chromium on August 7 but reached stable Chrome on September 3, enabling rapid weaponization from public patches. TA412's post-exploitation payload, GemStone, is a malicious browser extension posing as an AI-powered Google Gemini companion that captures keystrokes, cookies, screenshots, and browsing history via a Cloudflare Worker C2.
Microsoft's September 2026 Patch Tuesday fixes a record 966 flaws, including two Windows zero-days actively exploited to gain SYSTEM privileges.
Microsoft's September 2026 Patch Tuesday addresses a record 966 vulnerabilities, including 105 rated Critical, 81 of them remote code execution bugs. Two zero-days were actively exploited: a Windows Update Stack link-following flaw and a Windows ALPC heap-based buffer overflow, both allowing local elevation to SYSTEM privileges. The ALPC flaw was reported by Volexity and Proofpoint researchers, while the Update Stack flaw was credited to Romain Deperne and the Microsoft Threat Intelligence Centre. Microsoft shared no details on how the flaws were exploited in attacks.
Unauthenticated Confluence RCE CVE-2022-26134 was exploited in the wild; Volexity observed intrusions and Cerber ransomware on unpatched servers.
Volexity identified exploitation of CVE-2022-26134, an unauthenticated remote code execution vulnerability in Atlassian Confluence Server and Data Center, during Memorial Day weekend 2022, with Atlassian issuing a patch. Cortex Xpanse found 19,707 potentially affected Confluence instances, concentrated in the US, Germany, China, and Russia, plus 1,251 end-of-life versions exposed. Unit 42 and Cortex Managed Threat Hunting observed successful exploitation leading to reconnaissance commands and a Cerber ransomware deployment that was blocked by Cortex XDR. A public PoC has increased exploitation risk.
Actively Exploited V8 Type Confusion in Google Chrome (CVE-2026-85046)
Google Chrome versions prior to 152.0.7977.82 contain a type confusion flaw (CWE-843) in the V8 JavaScript engine, which mishandles object types during engine operations (public proof-of-concept writeups indicate it is reachable through array sorting and WebAssembly-related code paths). A remote attacker triggers the flaw simply by getting a user to open a crafted HTML page, with no privileges or authentication required. Successful exploitation lets the attacker execute arbitrary code inside the browser's sandbox, and public reporting shows it being chained with Windows zero-days (the 'BlueMoon' exploit kit) by Chinese espionage groups for broader compromise. Any user of an unpatched Chrome or another build embedding the affected V8 engine is exposed. The vulnerability is a zero-day that was actively exploited in the wild before patching, was added to CISA's KEV on 2026-09-04, and has five public proof-of-concept references.
· Google Chrome prior to 152.0.7977.82 · Google Chromium V8 V8 engine versions bundled with Chrome prior to 152.0.7977.82 KEV PoC ×5mass
Heap-Based Buffer Overflow in Windows ALPC Enables Local Privilege Escalation
CVE-2026-85880 is a heap-based buffer overflow in Windows Advanced Local Procedure Call (ALPC), the Windows mechanism for local inter-process communication. An authorized local attacker can trigger the overflow by submitting crafted input over ALPC, corrupting heap memory in the component that handles the request. Successful exploitation allows the attacker to execute code with elevated privileges, typically gaining SYSTEM-level control of the local host, which is especially valuable as a post-exploitation or sandbox-escape step. Affected products include Windows 10 (1607, 1809, 21H2, 22H2) and Windows Server 2012, 2016, 2019, and 2022, meaning most on-premises Windows estates are in scope. The flaw was fixed in Microsoft's record 974-CVE September 2026 Patch Tuesday and was added to CISA's KEV on 2026-09-08, confirming exploitation in the wild; press reports describe Windows zero-days being chained with a Chrome zero-day in 'BlueMoon' kit attacks, though the data does not explicitly confirm this CVE is the Windows flaw in that chain.
· Microsoft Windows 10 1607, 1809, 21H2, 22H2 · Microsoft Windows Server 2012, 2016, 2019, 2022 KEVmass
Actively Exploited Out-of-Bounds Write in Google Chrome V8
CVE-2026-87491 is an out-of-bounds write (CWE-787) in the V8 JavaScript engine in Google Chrome, fixed in Chrome 153.0.8010.36, which Google shipped alongside roughly 230 other security fixes. An attacker can trigger the flaw remotely by luring a user (user interaction required) into opening a crafted HTML page that corrupts memory in V8. Successful exploitation allows the attacker to execute arbitrary code inside the Chrome browser sandbox, which constrains but does not eliminate the impact. All Google Chrome users running versions prior to 153.0.8010.36 are affected; because the flaw resides in V8, CISA tracks it as 'Google Chromium V8', and other Chromium-based browsers may inherit the fix in their own updates. The flaw is being actively exploited in the wild — it is the seventh actively exploited Chrome zero-day of 2026 and was added to CISA's KEV catalog on 2026-09-09 — though no public proof-of-concept is known and ransomware use is unknown.
· Google Chrome (V8 JavaScript engine; tracked by CISA as 'Google Chromium V8') prior to 153.0.8010.36 KEVmass
Unauthenticated OGNL Injection RCE in Atlassian Confluence Server/Data Center
Atlassian Confluence Server and Data Center contain an unauthenticated remote code execution flaw caused by improper neutralization of expression-language (OGNL) input (CWE-917): an attacker with network access to the application can submit a crafted request that is evaluated as an expression and executed by the server. Successful exploitation lets a remote, unauthenticated attacker run arbitrary code with the privileges of the Confluence process, without any credentials. All organizations running self-managed Confluence Server or Data Center are affected, particularly instances exposed to the internet; Confluence Cloud is not listed among the affected products. Exploitation is confirmed in the wild: the flaw was added to CISA's KEV on 2022-06-02 with ransomware use marked as known, and EPSS assigns a 100% probability of exploitation within 30 days (100th percentile). CVSS has not yet been scored in this data, but the KEV listing and known ransomware use make unpatched, internet-facing instances a top-priority patching target.
· Atlassian Confluence Server · Atlassian Confluence Data Center KEV ransomware PoC ×2large
Permissive Cross-Domain Policy Privilege Elevation in Microsoft Azure Arc
Microsoft Azure Arc (CVE-2026-62895) contains a privilege elevation flaw caused by a permissive cross-domain policy that trusts untrusted domains, mapped by Microsoft to CWE-942 (permissive cross-domain policy with untrusted domains), CWE-1390 (weak authentication) and CWE-89 (SQL injection). An unauthenticated attacker can exploit it over a network, with CVSS scoring indicating some user interaction is required (AV:N/AC:L/PR:N/UI:R), by abusing the overly permissive cross-domain trust to elevate privileges, with high impact on confidentiality, integrity and availability (CVSS 3.1: 8.8 High). Any organization using Azure Arc to manage hybrid or multi-cloud resources is potentially affected. There is no evidence of exploitation in the wild, no known public proof-of-concept, the flaw is not in CISA's KEV catalog, and EPSS estimates only a 0.7% probability of exploitation in the next 30 days (52nd percentile). Microsoft addressed the flaw as part of its September 2026 Patch Tuesday release, which fixed 966 flaws including 2 zero-days.
Use-After-Free Remote Code Execution in Microsoft Active Directory Domain Services
CVE-2026-69524 is a use-after-free memory corruption flaw (CWE-416) in Microsoft's Active Directory Domain Services (AD DS), patched as part of Microsoft's September 2026 Patch Tuesday release. An unauthorized attacker with no privileges or user interaction can trigger the flaw remotely over the network, though the high attack-complexity rating suggests reliable exploitation may depend on favorable memory or timing conditions. A successful exploit yields remote code execution on the target, with high impact to confidentiality, integrity, and availability — typically a domain controller holding an organization's central authentication data. Any organization running Windows Server with the AD DS role enabled (i.e., operating domain controllers) is affected. As of this data there are no known in-the-wild exploits, no public proof of concept, and a modest 0.7% EPSS probability of exploitation within 30 days.
· Microsoft Windows Server with Active Directory Domain Services (AD DS) rolemass
Unauthenticated out-of-bounds read DoS in Microsoft Windows BranchCache
CVE-2026-69329 is an out-of-bounds read (CWE-125, arising from an integer-overflow condition, CWE-190) in the BranchCache component of Microsoft Windows. A remote, unauthenticated attacker can trigger the flaw over the network with no privileges or user interaction by sending malformed input to a system running BranchCache. Successful exploitation results only in denial of service of the BranchCache service — availability impact with no information disclosure or tampering (CVSS 3.1: 7.5, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Affected systems are Windows installations with the optional BranchCache feature enabled, such as branch-office caching deployments (Hosted Cache Servers or clients in distributed mode); the provided data does not specify affected version ranges. There is currently no known exploitation: the flaw was addressed in Microsoft's September 2026 Patch Tuesday (part of a 966-flaw release), has no public PoC, is not in CISA KEV, and carries an EPSS of 1.1% (62nd percentile).
· Microsoft Windows BranchCache (component of Windows client and Windows Server)large
OS Command Injection Privilege Elevation in Microsoft Azure HDInsights
CVE-2026-81349 is an operating-system command injection flaw (CWE-78) in Microsoft's Azure HDInsights managed big-data service. It is triggered when the service improperly neutralizes special elements passed into an OS command, and per the CVSS vector an attacker must already hold high-level authorized access, exploiting it over the network with no user interaction required. Successful exploitation allows the attacker to elevate privileges, with high impact on the confidentiality, integrity, and availability of the affected HDInsight environment. Only organizations running Azure HDInsight clusters are affected; the flaw was fixed as part of Microsoft's September 2026 Patch Tuesday, which addressed 966 flaws. No public proof-of-concept is known, it is not listed in CISA's KEV catalog, and EPSS estimates roughly a 0.7% chance of exploitation within 30 days.
Use-After-Free Local Privilege Escalation in Microsoft Windows AVCTP Component
CVE-2026-69401 is a use-after-free (CWE-416) in the Audio Video Control Transport Protocol (AVCTP) component of Microsoft Windows, the protocol layer used to control Bluetooth audio and video devices. A local, authorized (low-privileged) attacker can trigger the flaw by interacting with the vulnerable protocol handling such that memory is freed while still in use, though the high attack-complexity score indicates reliable triggering is non-trivial. Successful exploitation lets the attacker elevate privileges locally on the affected machine, with high impact to confidentiality, integrity, and availability once elevated. Any Windows system that includes the AVCTP/Bluetooth component is affected, meaning a very broad portion of the Windows installed base. Exploitation status is currently calm: there is no known public proof-of-concept, the flaw is not in CISA KEV, EPSS is low at 0.2%, and the fix shipped as part of Microsoft's September 2026 Patch Tuesday (966 flaws fixed, including 2 zero-days).
· Microsoft Windows (Audio Video Control Transport Protocol / Bluetooth AVCTP component)mass
Unauthenticated DoS in Microsoft Active Directory Federation Services (AD FS)
CVE-2026-72978 is an unauthenticated denial-of-service flaw in Microsoft Active Directory Federation Services (AD FS) caused by allocation of resources without limits or throttling (CWE-770). An attacker triggers it by sending network requests that cause the AD FS service to allocate resources without bound, exhausting capacity; the high attack-complexity score (AC:H) indicates the exhaustion condition is not reliably achieved on every attempt. A successful attack yields availability impact only (A:H) — the federation service can be knocked offline, interrupting sign-in/SSO for users who depend on it, with no confidentiality or integrity impact. Organizations running AD FS — typically enterprises using federated authentication with Microsoft 365/Entra ID on Windows Server — are affected. There is currently no evidence of exploitation (not in CISA KEV, no public PoC), EPSS puts the 30-day exploitation probability at 0.8%, and the fix shipped in Microsoft's September 2026 Patch Tuesday, which resolved 966 flaws including 2 zero-days.
· Microsoft Active Directory Federation Services (AD FS)large
Entities are extracted by the model from each article. Watching an entity keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.