The Sudden Reappearance of MS03-039
Summary: Cisco Talos reported two customer escalations involving alerts on Sourcefire SIDs 15512 and 3397 tied to MS03-039 and MS03-026, with packet payloads containing the strings "MEOW", "|CC CC CC CC|" and "|FF FF FF FF|". In both cases the source IP addresses were inside the customers' own corporate networks, and the second escalation involved "hundreds" of alerts.
Bottom line: The analyst initially judged active exploitation unlikely because the vulnerabilities date to 2003, yet both incidents were live attacks originating from inside the corporate network - a reminder that unpatched legacy hosts can still be the entry point.
Read the original at Cisco Talos ↗
- Topics
- Zero-Days & Exploits
- Related
- New Sign Drop Exploit Can Abuse Windows Defender to Bypass Security Protections Cyber Risks · Nov 13, 2026New Sign Drop Zero-Day Exploit Turns Windows CLFS Security Feature Into SYSTEM Access Cyber Risks · Nov 12, 2026November Patch Tuesday: An Overflowing Cornucopia of CVEs Cyber Risks · Nov 10, 2026