The Q3 Vulnerability Pulse: Discovery ≠ Exploitation

What it is

A Talos Threat Source newsletter (Q3 2026). Beyond the CVE-vs-KEV argument in the catalog summary, it carries operational detail the summary leaves out: the UAT-6275 detection guidance, two actively exploited edge-device items in the headlines, and a tooling check on six-digit CVE IDs.

UAT-6275: what to hunt for

Talos and Recorded Future's Insikt Group observed four infection chains. They deliver custom reverse shells through macro-enabled documents, GitHub-hosted scripts, and a WinRAR vulnerability. Operational security lapses by the actor gave researchers direct visibility into its infrastructure and malware development.

Recovered tooling suggests the group is preparing to expand to Linux hosts and internet-facing appliances. Targets so far are CIS government and critical infrastructure.

Preconditions / Affected

• The UAT-6275 guidance applies mainly to defenders in CIS government and critical-infrastructure sectors.
• The Ivanti and SonicWall items below matter to anyone running those appliances.
• Any tooling that parses CVE IDs is affected by the six-digit change.

What to do

• UAT-6275 detections:
• Alert on unexpected PowerShell activity.
• Alert on payload downloads from public services such as GitHub.
• Watch for suspicious scheduled tasks.
• Watch for unauthorized changes to the Windows Startup folder, which the group uses for persistence.
• Make sure archive utilities are fully patched, to block exploit-assisted delivery via the WinRAR flaw. The newsletter does not name the CVE.
• ClamAV signatures and IOCs are in the full Talos post, not in this newsletter.
• KEV forensicTriage column: CISA added it to flag high-risk vulnerabilities that require mandatory forensic triage and incident response workflows (BOD 26-04 and its Implementation Guidance). If you ingest KEV, check that your parsers handle the new column and that it routes into IR.
• Six-digit CVE IDs: CVE numbering has organically reached six digits, so check that fields and regexes in your tooling accept them. The newsletter says this twice. It notes that pre-2014 IDs capped at 9999 and that 2014-2015 six- and seven-digit IDs were allocated artificially.
• Edge devices (headlines, from third-party reporting):
• Ivanti Connect Secure: SecurityWeek reports CVE-2026-104935, a zero-day chain giving unauthenticated RCE with elevated privileges, root on a fully patched VPN.
• SonicWall SMA: Dark Reading reports a maximum-severity (CVSS 10) SSRF, attributed to an "unintended alternate access path" in the vendor advisory, under active attack.
• Patch debt: the newsletter's practical point is to work down the backlog of older CVEs, because about a third of KEV entries are from 2025 or earlier.

Caveats

• The author calls the KEV math "not the whole ball of wax". The 29% same-day KEV additions for 2026 CVEs is only 2 points above 2025 as a whole.
• Networking-gear CVEs rose slightly to 27%. The page gives no breakdown by vendor.
• The Ivanti and SonicWall details are one-line headline blurbs. They give no affected versions, patch status, or mitigations, so read the linked articles and vendor advisories before acting.
• The Patch Tuesday entry (October 2026: 1,415 vulnerabilities, 85 rated critical) is a headline only, with no per-product detail.