Session CRT-20260826 — 26 August 2026 · Afternoon Edition

Halil, my order is 1) TeamCity, 2) Zimbra, 3) Metabase, 4) Oracle, 5) Gitea. TeamCity’s chain is clearest: an unauthenticated crafted HTTP(S) request reaches OS-command execution with TeamCity-server privileges, exposing build configurations, stored credentials and downstream CI/CD pipelines. That is not merely a broken application; it is a potential production-signing and deployment pivot. Active exploitation is reported for TeamCity, Zimbra, Metabase and Oracle; CISA’s KEV catalog covers Zimbra, Oracle and Gitea.

Zimbra comes next because reporting describes active RCE attacks and compromised servers. Metabase’s reported SQL injection leading to administrative takeover closes access to analytics and connected data, but OS-level execution is not established here. Oracle and Gitea remain urgent, but the available evidence does not establish their exploit primitive, gained privilege, secret access or public-PoC quality well enough to put them above the first three. Public PoC availability is unconfirmed for all five; active exploitation already proves somebody has working capability.

The 30-minute CISO decision: authorize immediate network isolation of exposed TeamCity, then Zimbra; preserve disks, logs and memory; disable build/deployment paths; rotate TeamCity service credentials, repository tokens, signing material and cloud/deployment secrets from clean systems. Queue Metabase, Oracle and Gitea for the same isolation-led investigation in that order. Patching is only replacing the lock after someone may have copied the keys—do not reconnect until persistence, token use, artifact integrity and downstream deployments have been checked.

I would change the ranking if Oracle or Gitea evidence shows unauthenticated code execution plus production credentials, or if deployment context shows Gitea holds signing/deployment keys. Conversely, authenticated-only or non-default preconditions would push an item down. Confirmed persistence or secret exfiltration moves any affected system straight to first place.

• Zimbra CVE-2026-73570 — high confidence active exploitation; moderate confidence in the exact scale. Shadowserver observed 274 IP instances with exploitation artifacts on 22 August. That is not 274 organizations, and it must not be conflated with estimates of merely exposed Zimbra servers; the available evidence does not validate that exposure denominator.
• TeamCity CVE-2026-63077 — high confidence. ASD observed exploitation in Australia, JetBrains received reports of successful and attempted exploitation, and CISA listed it in KEV.
• Metabase CVE-2026-72898 — high confidence that Metabase was attacked; moderate confidence on exact CVE linkage. Metabase confirms its cloud service was attacked through a zero-day, while CISA lists CVE-2026-72898 in KEV.
• Oracle and Gitea — unknown from the evidence available here. I cannot place their exploitation claims at the same confidence level without direct vendor, government, or incident evidence.

I found no infrastructure, payload, or victimology pivots linking these incidents to Medusa or Laundry Bear/Ulej; attribution confidence is low. The executive overstatement to stop is: “These actively exploited flaws and the 274 Zimbra detections represent one coordinated actor campaign.” The evidence supports separate T1190 exploitation events, not campaign continuity.

The reported Mirage2FA cookie theft means the attacker may retain an authenticated Microsoft 365 session after password reset or MFA re-enrollment. Unknown: available evidence does not establish every artifact stolen or whether TeamCity, Zimbra, or Gitea exposed additional secrets.

Tonight: preserve Entra sign-in/audit, device and authentication-method registration, OAuth consent, mailbox-rule, forwarding, and privilege-change logs. Then disable affected identities, revoke Entra sessions and refresh tokens, terminate sessions separately in Microsoft 365 applications, remove unfamiliar devices and authentication methods, revoke suspicious OAuth grants, and reverse malicious rules or role changes. Only then reset credentials and enroll phishing-resistant FIDO2/passkeys from clean devices. James Okafor agrees that application-issued sessions require application-side termination; an Entra revocation alone is incomplete.

If TeamCity, Zimbra, or Gitea may also be compromised, isolate them and freeze deployments tonight. Revoke exposed API, personal-access, deployment, runner/agent, webhook, and OAuth tokens at both issuer and relying service. Rotate service-account credentials from clean systems. For potentially stolen signing keys, identify exactly what they signed, publish replacement trust material, distrust the old key, invalidate outstanding artifacts, and quarantine builds or releases produced during the exposure window.

Tomorrow: reconstruct the trust chain—user → Entra token → application session → OAuth grant → CI/repository/mail service → deployment target. Review repositories, pipelines, integrations, mailbox permissions, app registrations, build provenance, and downstream cloud access. Reopen services only after issuing fresh least-privilege credentials, validating integrations and artifacts, and replacing static service secrets with short-lived workload identities where supported.

Halil, fact: CISA’s KEV remediation deadlines bind U.S. Federal Civilian Executive Branch agencies; the reported Zimbra order required remediation within three days, while the Metabase deadline was reported as 14 August 2026. They are urgent private-sector risk benchmarks—not, by themselves, private-sector notification duties. The reported 274 compromised Zimbra systems is an ecosystem count, not proof that any particular operator suffered a reportable incident.

Assessment: confirmed customer-data access through Metabase moves an affected organization from exposure triage into personal-data-breach and materiality review. For Zimbra, the trigger facts are organization-specific compromise artifacts, mailbox or credential access, exfiltration, and operational interruption—not merely running a vulnerable version. Medusa targeting alone triggers no notification; confirmed intrusion, encryption, exfiltration, patient-care disruption, safety effects, or material financial impact does. I could not verify the current GDPR, NIS2, DORA, or SEC provisions and reporting clocks from the available evidence, so counsel should not rely on unverified article numbers or deadlines.

Counsel’s first 30 minutes:

• 0–5: Record discovery time; identify affected legal entities, jurisdictions, regulated sectors, and public-company status.
• 5–15: Preserve Metabase access/query logs, Zimbra SMTP/SNMP/process/file evidence, EDR alerts, ransomware notes, and cloud/identity logs; impose legal hold.
• 15–25: Establish whether personal data, mailboxes, credentials, health data, or connected databases were accessed or exported; quantify people, systems, outage, patient/safety effects, loss, and recovery estimates.
• 25–30: Open jurisdiction-specific GDPR/NIS2/DORA/SEC and local-law decision records, assign notification owners, document materiality reasoning, and prepare provisional regulator/data-subject notices without waiting for patch completion.