CVE-2026-34908, CVE-2026-34909, CVE-2026-34910, CVE-2026-63030, CVE-2026-60137, CVE-2026-7273, CVE-2026-60004: Ubiquiti, WordPress, Zyxel — Global Data Exfiltration Campaign (June 2026)

CVE-2026-34908, CVE-2026-34909, CVE-2026-34910, CVE-2026-63030, CVE-2026-60137, CVE-2026-7273, CVE-2026-60004 — Ubiquiti, WordPress, Zyxel

A coordinated China-nexus threat actor is actively exploiting these critical CVEs in Ubiquiti, WordPress, and Zyxel products. The vulnerabilities allow remote code execution, privilege escalation, and security control bypass, resulting in confirmed mass data exfiltration. All CVEs are being exploited in the wild as of June 2026.

Attack Vector

Attackers leveraged these vulnerabilities to gain initial access to public-facing devices and web applications, then deployed custom tools—potentially developed with large language model assistance—to escalate privileges and evade detection. The campaign compromised nearly 1,000 Zyxel switches in 48 countries and exploited Ubiquiti and WordPress deployments to move laterally and exfiltrate sensitive documents. No user interaction was required; exploitation was achieved via network exposure and unpatched systems. MITRE tactics observed include initial access, defense evasion, and exfiltration.

Who Is at Risk

All organizations running affected versions of Ubiquiti network devices, WordPress installations, or Zyxel switches are at immediate risk. Confirmed victims include at least one Western government agency and 49 organizations across 29 countries, with a focus on government and small business sectors. Global exposure is confirmed, with nearly 1,000 Zyxel switches compromised.

Patch & Mitigate

• Patch: Apply vendor security updates for all listed CVEs immediately. Check Ubiquiti, WordPress, and Zyxel advisories for exact versions.
• Workaround: Isolate affected devices from the internet if patching is not immediately possible. Disable unused services and enforce strong access controls.
• Detect: Monitor for unusual authentication attempts, privilege escalation events, and large outbound data transfers. Review logs for unauthorized access to network devices and web applications.

MITRE ATT&CK

• TA0001 — Initial Access: Attackers exploited exposed services to gain entry.
• TA0005 — Defense Evasion: Custom tools bypassed security controls and logging.
• TA0010 — Exfiltration: Large volumes of sensitive documents were exfiltrated from compromised systems.

Source: https://www.cybersecuritydive.com/news/china-nexus-steals-thousands-documents-exploitation/830902/