Rackspace Breach Linked to Zero-Day Vulnerability in ScienceLogic SL1’s Third-Party Utility

On 2024-09-24 Rackspace reported that an attacker exploited an undocumented zero-day RCE in a third-party utility bundled with ScienceLogic SL1, used for Rackspace Monitoring. The breach was described as limited to low-sensitivity performance monitoring data (account names/numbers, usernames, internal device IDs/names, device IPs, and AES256-encrypted internal device agent credentials). Rackspace notified affected customers, collaborated with ScienceLogic to produce a patch which has been distributed, and Arctic Wolf continues to monitor for additional affected vendors or products.