Active Exploitation of MSP Tools, CCTV Systems and Windows VPNs

This episode examines three concurrent exploitation campaigns targeting UK small business infrastructure in August 2026. First, CVE-2026-18577 in N-able N-central RMM software, which grants unauthenticated administrative access to MSP management consoles and, by extension, every client system they control. Second, Operation CameraSwarm, a coordinated campaign that compromised over 14,530 Dahua CCTV devices using five-year-old unpatched vulnerabilities and default credentials. Third, CVE-2026-33824, a critical Windows IKE vulnerability patched in April 2026 but added to CISA’s Known Exploited Vulnerabilities catalogue in August following confirmed active exploitation. Corrine analyses the common thread: attackers are systematically targeting outsourced infrastructure that businesses stop monitoring after deployment. The episode provides specific remediation steps, including how to request patch compliance documentation from managed service providers, how to audit CCTV firmware versions, and how to verify Windows patch status against the CISA KEV catalogue. Practical guidance is given on converting threat intelligence into procurement advantages and compliance evidence for Cyber Essentials certified businesses.

Chapters

• Introduction Corrine introduces three active exploitation campaigns targeting outsourced and overlooked infrastructure in UK small businesses during August 2026.
• The Master Key Problem Analysis of CVE-2026-18577 in N-able N-central RMM software, which allows unauthenticated administrative access to MSP management consoles and every client system they control. Includes specific steps for requesting written patch confirmation from service providers.
• Call to Action Request for audience engagement through follows, ratings, reviews and sharing.
• 14,530 Cameras, None of Them Secure Breakdown of Operation CameraSwarm, which compromised over 14,530 Dahua CCTV devices between June and July 2026 using default credentials and five-year-old unpatched vulnerabilities CVE-2021-33044 and CVE-2021-33045. Practical guidance on firmware audits and credential management.
• A Patch From April That Nobody Applied Examination of CVE-2026-33824, a critical Windows IKE vulnerability patched in April 2026 but added to CISA’s Known Exploited Vulnerabilities catalogue in August following confirmed exploitation. Discussion of the four-month window between patch availability and active exploitation.
• Turning This Into an Advantage Strategic analysis of how proactive threat intelligence monitoring and documented security posture create procurement advantages and support Cyber Essentials compliance requirements.
• What to Do Before Friday Seven specific remediation actions: requesting written MSP patch confirmation, auditing Dahua firmware and credentials, verifying Windows patch compliance, extending scrutiny to all third-party access, and establishing weekly CISA KEV catalogue review.
• Closing Remarks Corrine summarises the common exploitation pattern across outsourced infrastructure and emphasises the importance of documentation over reassurance.

Links

• https://www.n-able.com/security-and-privacy/cve-2026-18577
• https://www.cyber.gov.au/about-us/advisories/n-able-n-central-critical-vulnerability
• https://hunt.io/blog/operation-cameraswarm-dahua-device-compromise
• https://www.cve.org/CVERecord?id=CVE-2021-33044
• https://www.cve.org/CVERecord?id=CVE-2021-33045
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33824
• https://www.dahuasecurity.com/support/firmware