Threat Intelligence Brief - Wednesday, September 23, 2026

Operational threat reporting for defenders who need signal, not noise.

By DevSecOpsDad
Posted on September 23, 2026

Threat Radar

  • PATCH NOW: F5 BIG-IP APM is under active exploitation via CVE-2026-94127, enabling unauthenticated remote code execution on systems configured as OAuth authorization servers — no credentials required.

  • PATCH NOW: Chinese state-linked actor UTA0565 is chaining Chrome and Windows zero-days (CVE-2026-85046) through fake websites to deliver CLEANGULP malware — drive-by compromise with no user interaction beyond visiting a page.

  • Chrome 154 closes 108 vulnerabilities including critical memory corruption flaws; given UTA0565’s active browser exploitation, this update is operationally urgent even without confirmed exploitation of the new CVEs.

  • Adobe patched nine critical flaws in Connect and AEM Forms enabling code execution and privilege escalation — no confirmed exploitation yet, but these are high-value enterprise targets.

  • Microsoft disrupted EvilTokens, an AI-powered phishing platform that automated target selection and social engineering message generation — a signal that AI is lowering the cost and raising the scale of credential theft campaigns.



Immediate Action Required

  • F5 BIG-IP APM — CVE-2026-94127 (Active Exploitation): Identify all BIG-IP APM instances configured as OAuth authorization servers. Apply F5’s patch immediately. If patching cannot be completed within hours, assess whether the OAuth server role can be temporarily disabled or access restricted at the network perimeter. Exploitation is confirmed and unauthenticated — the exposure window is open now.

  • Google Chrome / Microsoft Windows — CVE-2026-85046 (Active Exploitation by UTA0565): Validate that Chrome 154 is deployed across all managed endpoints. Confirm Windows patches covering the chained OS vulnerability are applied. Treat any unpatched Windows endpoint running Chrome as exposed to a state-actor drive-by chain. Prioritize internet-facing and executive workstations.



High-Impact Developments

F5 BIG-IP APM Zero-Day Actively Exploited — Unauthenticated RCE on OAuth Servers

  • What happened: F5 disclosed and patched CVE-2026-94127, a critical zero-day in BIG-IP Access Policy Manager. The flaw allows unauthenticated attackers to execute arbitrary code on any BIG-IP system where APM is functioning as an OAuth authorization server. Active exploitation is confirmed.

  • Why it matters: BIG-IP APM is widely deployed as a network access control and identity broker. Unauthenticated RCE on an OAuth authorization server means attackers can issue fraudulent tokens, pivot into downstream applications, or establish persistent access — all without valid credentials.

  • Who should care: Network security teams, infrastructure owners, and anyone responsible for identity federation or OAuth-based application access. Organizations using BIG-IP APM as an OAuth server are directly exposed.

  • Recommended action: Apply the F5 patch immediately. Audit BIG-IP APM configurations to confirm which systems are operating in OAuth server mode. Review access logs for anomalous activity predating the patch. If patching is delayed, restrict management interface access at the network level as a compensating control.

  • Confidence: High — exploitation confirmed by F5.

  • Search metadata: CVE-2026-94127, T1190, T1059, F5 BIG-IP APM, OAuth, remote code execution, authentication bypass

Intelligence Context



Chinese Actor UTA0565 Chains Chrome-Windows Zero-Days to Deploy CLEANGULP Malware

  • What happened: Chinese threat actor UTA0565 exploited a chained zero-day involving Chrome (CVE-2026-85046) and a Windows vulnerability, delivered via fake websites. Attacks were detected September 3–4, 2026. The payload, CLEANGULP malware, was deployed on compromised Windows endpoints. Patches are now available for both Chrome and Windows.

  • Why it matters: Chained browser-plus-OS exploits require only that a user visit a malicious site — no additional interaction. State-actor investment in this capability signals targeted, high-confidence campaigns. The named malware family CLEANGULP indicates a broader, structured operation rather than opportunistic activity.

  • Who should care: Endpoint security, browser management, and SOC teams. Any Windows endpoint running an unpatched Chrome version is in scope. Given the state-actor attribution, sectors commonly targeted by Chinese threat actors — defense, technology, critical infrastructure — should treat this as elevated risk.

  • Recommended action: Confirm Chrome 154 deployment across all managed endpoints immediately. Validate that Windows patches addressing the chained OS vulnerability are applied. Review proxy and DNS logs for connections to newly registered or suspicious domains consistent with fake-website lure infrastructure. Any gap in browser or OS patching is an open exposure to this chain.

  • Confidence: High — exploitation confirmed, actor attributed, malware identified.

  • Search metadata: CVE-2026-85046, T1190, T1566, UTA0565, CLEANGULP, Google Chrome, Microsoft Windows, malware deployment

Intelligence Context



Adobe Patches Nine Critical Flaws in Connect and AEM Forms

  • What happened: Adobe released patches for nine critical vulnerabilities across Adobe Connect and Adobe AEM Forms. The flaws enable arbitrary code execution and privilege escalation. No confirmed exploitation has been reported.

  • Why it matters: Adobe Connect is used for enterprise web conferencing; AEM Forms handles web-based form processing and data collection — both are common in regulated industries. Critical code execution and privilege escalation flaws in these products create meaningful lateral movement and data access risk if exploited post-initial access.

  • Who should care: IT operations, application owners, and security teams responsible for Adobe enterprise products. Organizations running internet-accessible Connect or AEM Forms instances should treat this as a priority patch cycle.

  • Recommended action: Apply Adobe patches within the week. Prioritize internet-exposed instances of Connect and AEM Forms. Verify patch deployment through vulnerability management tooling rather than assuming auto-update coverage.

  • Confidence: High — vendor-confirmed critical severity; exploitation status unknown.

  • Search metadata: T1190, T1548, Adobe Connect, Adobe AEM Forms, code execution, privilege escalation

Intelligence Context

  • Adobe Patches Critical Flaws in Connect, AEM Forms
    • Context: Adobe disclosed nine critical defects enabling arbitrary code execution and privilege escalation across Connect and AEM Forms, with patches released and no exploitation confirmed at time of reporting.



Monitor Only

  • Microsoft disrupted EvilTokens, an AI-powered phishing platform that used AI to generate social engineering messages and select targets — the disruption is welcome, but the tradecraft it represents (automated, AI-personalized phishing at scale) will persist and evolve in successor platforms. Phishing-resistant MFA is the most durable control against this class of threat. Source: AI-Powered Phishing Platform EvilTokens Disrupted by Microsoft — https://www.securityweek.com/ai-powered-phishing-platform-eviltokens-disrupted-by-microsoft/

  • Chrome 154 patches 108 vulnerabilities including critical memory safety and memory corruption flaws; no confirmed exploitation reported for this release, but given UTA0565’s active browser exploitation this week, accelerating Chrome updates across the enterprise is operationally justified. Source: Chrome 154 Patches 108 Vulnerabilities — https://www.securityweek.com/chrome-154-patches-108-vulnerabilities/



Analyst Observation

Today’s brief reflects a threat environment where the patch backlog is not a theoretical risk — it is an active attack surface. Two of the four stories involve confirmed, in-the-wild exploitation: a state actor chaining browser and OS zero-days for drive-by malware delivery, and an unauthenticated RCE on network infrastructure that handles identity tokens. Both have patches available. The operational question is not whether to patch but how fast your teams can execute. The EvilTokens disruption is worth noting not because the platform is gone — the capability will resurface — but because it confirms that AI-assisted phishing is now an operational reality. Organizations still relying on signature-based email filtering and periodic awareness training as their primary phishing defense should reassess that posture.





Generated by DevSecOpsDadAttack cyber threat intelligence.

Tags:  Cyber-Security-News  CVE-2026-94127  CVE-2026-85046  T1190  T1548  T1566  T1598  T1059  Microsoft  Google-Chrome  Google  Microsoft-Windows
DevSecOpsDadAttack!
Share: X (Twitter) LinkedIn