Critical Identity Flaws, Weaponized Print Servers, and AI-Powered Attacks on Water Infrastructure

Why it matters: Keycloak and Red Hat SSO are the backbone of federated authentication for many state government environments. CVE-2026-18963 is an authentication-bypass flaw in the reset-credentials flow (versions 26.0.0 through 26.7.1) that allows an unauthenticated attacker to skip email verification entirely and set a new password for any user whose username is known. The attacker then receives a valid OAuth authorization code — full account access, no alerts, no anomalous login from the system's perspective.

What makes this different: this is not a brute-force or credential-stuffing attack that existing controls would catch. The attacker uses the legitimate password-reset mechanism. The resulting session looks like an authorized user. MFA configured downstream of Keycloak may not trigger because the OAuth code is issued before MFA evaluation in many configurations.

Exploitation status: full proof-of-concept published September 2. Red Hat has issued patches (RHSA-2026:56519 through 56524). The exploit targets the /realms/{realm}/login-actions/reset-credentials endpoint.

Why it matters: PaperCut MF and NG manage print queues across state agencies — and those print queues process sensitive documents including legal filings, law enforcement records, health information, and financial data. CVE-2026-81578 (CVSS 9.8) is an improper access control flaw that allows an unauthenticated remote attacker to modify system configurations before access validation completes.

Exploitation status: confirmed active exploitation. CISA added this to the KEV catalog on August 31. A Metasploit module (PR #21842) has been merged into the metasploit-framework repository, meaning any attacker with basic Metasploit skills can exploit this vulnerability with a few commands.

The compounding risk: print management servers typically have network visibility across multiple VLANs and agency boundaries. A compromised PaperCut server provides lateral movement opportunities into sensitive document workflows and potentially into network segments that are otherwise segmented.

Why it matters: the barrier to attacking industrial control systems just dropped by an order of magnitude. Forescout's research demonstrated that an AI assistant could port a pre-authentication RCE exploit (CVE-2021-31886, CVSS 9.8) between WAGO PLC models — developing functional ARM shellcode and adapting the exploit chain — in a single 8.5-hour session. Previously, this work required deep embedded-systems expertise and weeks of manual effort.

The August 19 joint advisory from NSA, CISA, FBI, DOE, and EPA confirmed that threat actors are actively using AI-generated exploitation scripts against internet-exposed Siemens S7 PLCs. The FBI and EPA separately confirmed attacks on water utilities in at least seven states since July 27, where actors changed IP addresses and passwords on internet-facing Rockwell Automation MicroLogix controllers — attacks that required no sophisticated exploit at all, just access to an exposed management interface.

Affected systems: WAGO 750-series controllers (FW16 and earlier), Rockwell MicroLogix, Siemens S7 PLCs — found in water treatment, wastewater, and building automation across state government facilities. Building automation systems in state office buildings often use the same Rockwell ControlLogix and CompactLogix families cited in CISA's advisories, but are frequently managed by facilities teams outside IT governance.

Why it matters: Russia's APT28 (BlueDelta, Fancy Bear, Forest Blizzard — GRU Unit 26165) has deployed a new Windows backdoor called HOOKEDGE against government, diplomatic, and defense targets in Romania, Spain, and Turkey. The campaign ran from September 2025 through July 2026.

The evasion problem: HOOKEDGE uses Microsoft Edge in headless/hidden mode to communicate with webhook.site — a legitimate, widely-used developer service — for command and control. All malicious traffic appears as normal HTTPS browser activity to a legitimate domain. This defeats domain-reputation filtering, IP-reputation blocking, and standard proxy-category controls. Your web proxy will categorize webhook.site as "Technology/Developer Tools" and allow the traffic.

Current targeting is European — but the technique is infrastructure-agnostic. APT28 has a documented history of pivoting to U.S. government targets. The webhook.site C2 pattern can be retargeted with a single configuration change.

SafePay ransomware operators stood up fresh command-and-control infrastructure on August 31 with explicit government targeting tags. Deployment of ransomware operations against government targets is expected within one to three weeks. Meanwhile, Rhysida and Qilin (REVENANT SPIDER) remain active threats to state and local government, though no new incidents were observed this cycle — likely reflecting a Labor Day weekend operational lull rather than a strategic shift.

The XWorm RAT, observed in an active phishing campaign using WeTransfer-spoofed emails, includes ransomware capability among its modular features — adding another potential ransomware delivery vector.

Additional persistent threats: MuddyWater (Iran/MOIS) targeting government via supply chain compromise; IRGC maintaining persistent targeting of U.S. water/wastewater infrastructure; a China-nexus campaign tracked as TRACKSTOMP/EMPTYROAD actively targeting government entities; North Korean actors conducting supply chain attacks via malicious NPM packages; Volt Typhoon and Salt Typhoon produced zero detections this cycle — their absence is notable and may indicate an operational pause or infrastructure rotation rather than reduced intent.