7 minhigh
Cyber Centre Daily Advisory Digest — 2026-08-10 (7 advisories)
The Canadian Centre for Cyber Security published 7 security advisories on 2026-08-10 covering vulnerabilities in Dell, IBM, WebPros (Plesk), HashiCorp, WordPress, Roundcube, and Cisco products. The most critical item is CVE-2026-64638 affecting WordPress prior to 7.0.3, which is reportedly being exploited in the wild. Plesk Obsidian is affected by a blind SQL injection (CVE-2026-64636). The remaining advisories cover patch releases for Dell OpenManage, IBM product suite, HashiCorp Consul, Roundcube Webmail, and Cisco Secure Endpoint connectors.
Sens:■ ImmediateConf:high
IOCs2
2cve
Detection / Hunteropenrouter
What Happened
The Canadian government's cyber security agency published seven security warnings on August 10, 2026. The most urgent warning is about WordPress, a popular website-building tool, which has a security flaw that attackers are already using in the real world. Anyone running WordPress should update to version 7.0.3 or later right away. Another warning covers Plesk, a web hosting control panel, which has a flaw that could let attackers read sensitive database information. Warnings were also issued for Dell server management tools, IBM enterprise software, HashiCorp Consul, Roundcube email software, and Cisco security software. Organizations using any of these products should review the advisories and apply available updates as soon as possible.
Key Takeaways
- WordPress CVE-2026-64638 is actively exploited in the wild; versions prior to 7.0.3 are affected and should be patched immediately.
- Plesk Obsidian is affected by a blind SQL injection vulnerability (CVE-2026-64636) in versions prior to 18.0.80.1 and 18.0.79.5.
- Dell, IBM, HashiCorp, Roundcube, and Cisco each published security updates for multiple products on the same day.
- Cisco Secure Endpoint connectors across Linux, Mac, and Windows platforms are affected by ClamAV vulnerabilities prior to version 8.4.5.30483.
- HashiCorp Consul Community and Enterprise editions have multiple vulnerabilities requiring updates to versions 2.0.3, 1.22.11, or 1.21.17 depending on branch.
Affected Systems
- WordPress prior to 7.0.3
- Plesk Obsidian prior to 18.0.80.1 and 18.0.79.5
- Dell OpenManage Server Administrator Managed Node prior to 11.1.0.2 (Windows, RHEL 8.10, RHEL 9.4, SLES 15)
- Dell RVTools prior to 4.8.1
- Dell Virtual Storage Integrator for VMware vSphere Client prior to 10.11.1.0
- IBM WebSphere Application Server 8.5 and 9.0
- IBM QRadar prior to 7.5.0 UP 15 IF005 and 7.6.0.1
- IBM Cloud Pak for Business Automation 24.0.0 through 26.0.0
- HashiCorp Consul Community Edition prior to 2.0.3
- HashiCorp Consul Enterprise prior to 2.0.3, 1.22.11, or 1.21.17
- Roundcube Webmail prior to 1.6.18 and 1.7.3
- Cisco Secure Endpoint Connector for Linux, Mac, and Windows prior to 8.4.5.30483
Vulnerabilities (CVEs)
| CVE | Product | Severity | Description |
|---|---|---|---|
| CVE-2026-64638 | WordPress prior to 7.0.3 | Vulnerability in WordPress that is being actively exploited in the wild according to open-source reporting. | |
| CVE-2026-64636 | Plesk Obsidian prior to 18.0.80.1 and 18.0.79.5 | Blind SQL injection vulnerability in Plesk Obsidian allowing potential database extraction. |
Attack Chain
- Initial Access: Exploit CVE-2026-64638 against unpatched WordPress instances (prior to 7.0.3) — actively exploited in the wild
- Initial Access: Exploit CVE-2026-64636 blind SQL injection against unpatched Plesk Obsidian instances to extract database contents
- Persistence/Patch Window: Unpatched Dell, IBM, HashiCorp, Roundcube, and Cisco products remain exposed to documented vulnerabilities pending update deployment
Detection Availability
- YARA Rules: No
- Sigma Rules: No
- Snort/Suricata Rules: No
- KQL Queries: No
- Splunk SPL Queries: No
- EQL Queries: No
- Other Detection Logic: No
No detection rules are provided in this advisory digest. The article is a compilation of vendor security advisories with links to vendor-published patches and updates.
Detection Engineering Assessment
| Dimension | Rating | Rationale |
|---|---|---|
| EDR Visibility | Low | The advisories describe vulnerabilities in web applications and server infrastructure. EDR may detect post-exploitation activity but would not detect the initial exploitation of WordPress or Plesk SQL injection directly. |
| Network Visibility | Medium | Network monitoring could detect anomalous HTTP requests targeting WordPress or Plesk endpoints, but distinguishing exploit traffic from normal traffic requires knowledge of the specific exploit payloads which are not detailed in this digest. |
| Detection Difficulty | Hard | The advisory digest does not provide exploit details, payloads, or IOCs. Detecting exploitation of CVE-2026-64638 and CVE-2026-64636 requires vendor-specific threat intelligence or IDS signatures that are not included here. |
Required Log Sources
- Web server access logs (WordPress, Plesk)
- Database query logs (Plesk SQL injection detection)
- WAF logs and alerts
- Application server logs for IBM, Dell, Roundcube products
Hunting Hypotheses
| Hypothesis | Telemetry | ATT&CK Stage | FP Risk |
|---|---|---|---|
| Consider hunting for anomalous HTTP requests targeting WordPress installations that may indicate exploitation of CVE-2026-64638, particularly requests with unusual parameters or payloads directed at WordPress core endpoints. | Web server access logs, WAF logs, reverse proxy logs | Initial Access | Medium — WordPress plugins and themes generate diverse request patterns that may mimic exploit traffic. |
| Consider hunting for SQL injection patterns in HTTP requests directed at Plesk Obsidian instances, focusing on requests that attempt blind SQL injection techniques against versions prior to 18.0.80.1. | Web server access logs, WAF logs, database query logs | Initial Access | Low to Medium — blind SQL injection patterns are more distinctive than general web traffic. |
| If you have visibility into application logs for IBM WebSphere, QRadar, or Cloud Pak products, consider hunting for anomalous authentication attempts or unexpected API calls that may indicate exploitation of the vulnerabilities referenced in the IBM advisory. | Application server logs, authentication logs, API gateway logs | Initial Access / Privilege Escalation | Medium — enterprise application traffic is complex and may generate false positives. |
Control Gaps
- WAF rules may not yet cover CVE-2026-64638 or CVE-2026-64636 exploit payloads if vendor signatures are not yet deployed.
- Network IDS signatures for the specific vulnerabilities are not provided in this advisory digest.
- Endpoint detection will not catch exploitation of web application vulnerabilities like WordPress or Plesk SQL injection at the network edge.
Key Behavioral Indicators
- Unusual HTTP request patterns targeting WordPress core endpoints on instances running versions prior to 7.0.3
- SQL injection signatures in HTTP requests directed at Plesk Obsidian web interfaces
- Unexpected service restarts or crashes on Dell OpenManage, Cisco Secure Endpoint, or Roundcube systems post-update window
False Positive Assessment
Low — this is an advisory digest; no detection rules or IOCs are provided that could generate false positives. Detection of the underlying vulnerabilities would require vendor-specific threat intelligence.
Recommendations
Immediate Mitigation
defender takeaway
- Verify against your organization's incident response runbook and team escalation paths before acting. Prioritize patching WordPress installations to version 7.0.3 or later immediately due to active exploitation of CVE-2026-64638.
- Consider patching Plesk Obsidian to version 18.0.80.1 or 18.0.79.5 or later to remediate the blind SQL injection vulnerability CVE-2026-64636.
- If your organization runs Roundcube Webmail, consider updating to version 1.6.18 or 1.7.3 depending on your branch.
- Consider reviewing and applying Dell security updates for OpenManage Server Administrator (11.1.0.2), RVTools (4.8.1), and Virtual Storage Integrator (10.11.1.0).
Infrastructure Hardening
- Evaluate whether WAF rules can be updated to detect and block exploitation attempts targeting CVE-2026-64638 and CVE-2026-64636 while patches are being deployed.
- Consider deploying HashiCorp Consul updates to versions 2.0.3, 1.22.11, or 1.21.17 depending on the branch in use.
- If applicable, consider updating Cisco Secure Endpoint connectors to version 8.4.5.30483 or later across Linux, Mac, and Windows platforms.
- Evaluate whether IBM product patches for WebSphere, QRadar, Cloud Pak, and other affected products are available and schedule deployment.
User Protection
- Consider restricting external access to Plesk and WordPress admin interfaces where feasible until patches are confirmed deployed.
- If your organization uses Roundcube Webmail, consider evaluating whether webmail access should be restricted to VPN users until updates are applied.
Security Awareness
- Consider notifying web hosting and IT operations teams about the actively exploited WordPress vulnerability and the need for immediate patching.
- Consider reminding administrators that Plesk Obsidian blind SQL injection could expose hosting customer data if left unpatched.
MITRE ATT&CK Mapping
MITRE ATT&CK Mapping2 techniques
Tactic
Initial Access
Tactic
Execution
Showing defanged values
- cveCVE-2026-64636Blind SQL injection vulnerability in Plesk Obsidian allowing potential database extraction.
- cveCVE-2026-64638Vulnerability in WordPress that is being actively exploited in the wild according to open-source reporting.