August 26 Security Briefing: Digdir DDoS, TranslatePress, and Arista OpenSSH Flaws

Today's security picture

Availability of shared public services and trust boundaries inside web and network products defined this reporting window. Norway's Digitalisation Agency, Digdir, said a large distributed denial-of-service attack affected shared services including ID-porten, MinID and Altinn. Many functions remained available, but login delays and intermittent disruption continued while mitigation work was active.

Two newly published product advisories require configuration-aware triage. TranslatePress could expose an administrator password-reset link when a secondary-language translation path stored it in a dictionary reachable through public AJAX. Arista mapped four OpenSSH vulnerabilities across EOS, CloudVision, NDR and other product families. In both cases, the product name alone is not enough: administrator locale, translation settings, inbound SSH exposure and device-initiated outbound connections determine practical exposure.

Issues at a glance

• Digdir DDoS: a disruption at shared identity infrastructure propagated across multiple public services, making end-to-end login and signing checks more useful than application-server health alone.
• TranslatePress CVE-2026-19632: an unauthenticated attacker could retrieve a password-reset link stored in a secondary-language dictionary and take over an administrator account under specific configuration conditions.
• Four Arista OpenSSH flaws: one server-side authentication-delay weakness and three client-side issues have different product and connection prerequisites.

Major incident

DDoS disruption of Digdir shared services

Digdir said the attack began at 03:38 local time on August 24. The affected environment supported ID-porten, MinID, Maskinporten, the Contact and Reservation Register, eFormidling, ELMA, eInnsyn, the employee portal and self-service functions. Altinn, electronic signing and digital post were also affected. This was therefore not an outage of one website but an availability event that propagated through shared identity and integration dependencies.

In its August 25 update, Digdir said the services had largely stabilized, although some disruption remained and mitigation continued. The agency characterized the objective as reducing availability and said it had no indication of a security breach or personal-data exposure. That distinction does not make the event operationally minor: an application can be running while users still cannot authenticate, receive tokens, sign documents or complete transactions.

Organizations using centralized identity, signing or API gateways should map the full user journey rather than monitor only their own application tier. Synthetic checks should cover login initiation, token issuance, signing and transaction completion from multiple networks. Recovery validation should also account for queued work, expired sessions and repeated requests created during instability.

1. Map business services to shared identity, signing, DNS, messaging and supplier control planes.
2. Test end-to-end login and token issuance separately from basic server availability.
3. Define which workflows can queue, degrade or switch to read-only operation and which must fail closed.
4. After mitigation, reconcile failed transactions, duplicate requests and delayed processing.

New priority CVEs

TranslatePress CVE-2026-19632

Wordfence disclosed CVE-2026-19632 on August 25. TranslatePress versions through 3.3.1 are affected, and version 3.3.2 contains the fix. Exploitation depends on automatic string saving being enabled and the targeted administrator's profile locale being set to a published secondary language. A password-reset email can then pass through the translation pipeline and leave its reset URL and key in the secondary-language dictionary table.

A public AJAX action returns requested dictionary rows. An unauthenticated attacker can initiate an administrator password reset, enumerate the relevant dictionary and retrieve the stored reset link. The attacker can then set a new password and gain administrator access. Administrators whose profile language remains the site's default language do not send the reset message through this secondary-language path.

Inventory should combine plugin version with automatic string-saving status, published secondary languages and administrator profile locales. After upgrading to 3.3.2 or later, review password-reset events, active sessions, unexpected administrators and plugin or theme changes across the pre-patch period. Multi-factor authentication can block a login after a password change, but it is a compensating control rather than a substitute for the fixed release.

1. Upgrade TranslatePress installations running 3.3.1 or earlier to 3.3.2 or later.
2. Record administrator locale, published secondary languages and automatic string-saving settings together.
3. Review password-reset, login, administrator-creation and plugin-change activity across the exposure window.
4. Refresh administrator sessions and recovery links, then enforce multi-factor authentication.

Four OpenSSH vulnerabilities across Arista products

Arista Security Advisory 0147 maps four OpenSSH vulnerabilities to EOS, CloudVision Portal and Appliance, DANZ Monitoring Fabric, Multi Cloud Director, Converged Cloud Fabric, NDR and certain Wi-Fi products. Applicability differs by product and embedded OpenSSH role. Arista said it was not aware of malicious exploitation in customer networks and directed operators to compare installed releases with the advisory's affected-software table.

CVE-2026-60001 weakens the minimum authentication delay in the SSH server, which can accelerate password guessing and username enumeration when an attacker can reach the management service. It does not itself grant authentication. CVE-2026-60002 is a use-after-free in the SSH client when a server changes its host key during rekeying. It requires a device operator or service to initiate an outbound connection to a malicious or compromised SSH server and may crash the client or potentially permit code execution.

CVE-2026-59995 lets a malicious SFTP server place a downloaded file outside its intended local directory. CVE-2026-59996 can place a file in the parent directory during an SCP copy between two remote endpoints. Both client-side file-transfer issues require an operator to initiate a connection involving a malicious or compromised server, so they should not be triaged like an unauthenticated internet scan against the device.

• CVE-2026-59995: an SFTP download may escape the intended destination path.
• CVE-2026-59996: a remote-to-remote SCP copy may write into a parent directory.
• CVE-2026-60001: a reachable SSH management service may lose part of its authentication-delay protection.
• CVE-2026-60002: an outbound SSH client connection may trigger a memory fault when the server changes its host key during rekeying.

Permanent remediation is an upgrade to a fixed release listed for the specific Arista product. Until then, restrict SSH management access to trusted source addresses, prefer key-based authentication and limit device-initiated SSH, SFTP and SCP connections to approved systems. Strict host-key checking is particularly relevant to CVE-2026-60002. Post-change validation should cover management ACLs, SSH daemon state, outbound destinations, file placement and unexpected SSH client termination.

Operational notes

These issues show why an asset inventory needs dependencies and traffic direction, not only product and version. Digdir's event propagated through shared identity and signing services. TranslatePress exposure depended on language behavior. The Arista advisory separates inbound server exposure from outbound client actions. Recording those relationships turns a long vulnerability list into a smaller set of testable conditions.

Patch completion should lead to evidence checks rather than a closed ticket. Validate the real login path after an availability event, inspect administrator and session changes after an account-takeover flaw, and review file placement and SSH client crashes after a network-product update. A patch can close the vulnerable behavior, but it does not reverse a change made before deployment.

• Link shared identity, signing and API relay services to the business workflows that depend on them.
• Track TranslatePress version together with administrator locale and secondary-language settings.
• Manage inbound SSH services and device-initiated SSH, SFTP and SCP as separate exposure records.
• Validate login flow, administrators, file destinations and client termination records after changes.
• Watch Digdir recovery updates and subsequent Wordfence and Arista advisory revisions.

Verification basis: official material newly published or materially changed between August 25, 2026 09:00 and August 26, 2026 07:59 KST. Later statements from the organizations and vendors may change the affected scope or recommended actions.