.@PaloAltoNtwks' PAN-OS GlobalProtect auth bypass flaw is under active exploitation. CISA added CVE-2026-0257 to its KEV list as security teams race to patch and hunt for compromise. #cybersecurity #CISO #infosec https://t.co/Gf6UB7tQoa

This week’s list is a little Windows-heavy thanks to June Patch Tuesday. Four of the five are already on CISA’s KEV list, the DHCP flaw can be triggered from the local network, and Oracle had to release an out-of-band fix for a PeopleSoft zero-day that was already being used in attacks.

**1.** [**CVE-2026-44815: Windows DHCP Client**](https://nvd.nist.gov/vuln/detail/CVE-2026-44815)

A malicious DHCP server on the same network can send a crafted response and get code execution on Windows clients. That makes this more important than a normal workstation patch, especially on guest Wi-Fi, branch networks, or anywhere you don’t fully trust the local segment.

* **Scope:** Windows systems using DHCP
* **Why now:** Critical, KEV-listed, CISA deadline June 23
* **Next step:** Deploy the June 2026 Windows updates

**2.** [**CVE-2026-35273: Oracle PeopleSoft PeopleTools**](https://nvd.nist.gov/vuln/detail/CVE-2026-35273)

Unauthenticated RCE that attackers were already using for data theft before Oracle released the fix. Any exposed or affected PeopleSoft server deserves both a patch and a closer look at what happened before it was patched.

* **Scope:** PeopleTools 8.61 and 8.62
* **Why now:** CVSS 9.8, KEV-listed, CISA deadline July 3
* **Next step:** Apply Oracle’s out-of-band update and check for signs of post-exploitation activity

**3.** [**CVE-2026-0257: Palo Alto PAN-OS GlobalProtect**](https://unit42.paloaltonetworks.com/active-exploitation-of-pan-os-cve-2026-0257/)

An authentication bypass that allows attackers to establish GlobalProtect VPN sessions without valid credentials. Since this sits at the front door of the networks running a Palo fw, log review matters almost as much as installing the fix.

* **Scope:** Exposed GlobalProtect portals and gateways
* **Why now:** Active exploitation confirmed by Unit 42 on June 9
* **Next step:** Apply the appropriate PAN-OS hotfix and investigate any VPN sessions you can’t explain

**4.** [**CVE-2026-10520**](https://nvd.nist.gov/vuln/detail/CVE-2026-10520) **/** [**CVE-2026-10523**](https://nvd.nist.gov/vuln/detail/CVE-2026-10523)**: Ivanti Sentry**

This is a rough pair: one flaw allows unauthenticated root RCE, while the other can be used to create a rogue administrator account. Either one would justify urgent work on its own.

* **Scope:** Ivanti Sentry gateway deployments
* **Why now:** CVSS 10.0 and 9.9; both KEV-listed
* **Next step:** Upgrade to the fixed release in Ivanti’s advisory

**5.** [**CVE-2026-47288: Windows Kerberos KDC**](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-47288)

Critical RCE in the Windows Kerberos Key Distribution Center, putting domain controllers in the blast radius. There is no confirmed exploitation listed here yet, but the affected role makes delaying it a hard sell.

* **Scope:** Windows Server domain controllers
* **Why now:** Critical, released with June 2026 Patch Tuesday
* **Next step:** Roll out the June updates, with domain controllers handled early

I try to limit these posts to 5 CVE's so it doesn't get too long, but feel free to discuss anything that missed the cut down in the comments!

The vulnerability in question is CVE-2026-0257 (CVSS score: 7.8), an authentication bypass flaw affecting the portal and gateway components of PAN-OS software that could be exploited by bad actors to set up VPN connections. https://t.co/vDU0sfVFPL

RAUDONA — aktyviai išnaudojama, šiuo metu vykstančios atakos

Cisco SD-WAN vManage (CVE-2026-20262): zero-day, išnaudojama eskaluoti teises iki root; pataisymai išleisti — atnaujinti nedelsiant.

Palo Alto PAN-OS GlobalProtect (CVE-2026-0257): patvirtintas aktyvus autentifikacijos apėjimo išnaudojimas.

Splunk Enterprise (CVE-2026-20253, CVSS 9.8): kritinė pre-auth RCE grandinė; atnaujinti iki 10.2.4 / 10.0.7.

WordPress tiekimo grandinė: OptinMonster, TrustPulse, PushEngage CDN scenarijai užkrėsti slaptais admin backdoorais.

UNC6508 (Kinijos šnipinėjimas): >1 m. aktyvi kampanija prieš medicinos, karinius ir DI tyrimų tinklus (REDCap, Google Workspace taisyklės).

ShinyHunters prievartavimas: Europos Taryba ir Infinite Campus (137 tūkst.) — toliau aktyvu.

The Gentlemen ransomware: sustabdytas Australijos „Mackay Sugar" gamyklų darbas.

GELTONA — užfiksuota / paskelbta šią savaitę

Microsoft 365 Copilot „SearchLeak": 1 paspaudimo duomenų vagystė (paštas, OneDrive, SharePoint).

LiteLLM DI gateway: 3 pažeidžiamumų grandinė leidžia perimti serverį iš žemų teisių paskyros.

Šiaurės Korėja (Contagious Interview): kūrėjų įrankiai ir „code review" kaip kenkėjiško kodo kanalas.

152 Chrome „wallpaper" plėtiniai (105 tūkst. įdiegimų): adware ir suklastotas paieškos srautas.

Prancūzijos pažeidimai: „Tchap" (73 tūkst. paskyrų), Superimmo (146 tūkst.), Local'Emploi (27 tūkst.).

Novo Nordisk (Danija): pažeistos IT sistemos, pavogti asmens duomenys.

„Agentjacking": DI kodavimo agentų (Claude Code, Cursor) užgrobimas per įterptą Sentry klaidą.

FBI įspėjimas: kurjeriai renka grynuosius iš kriptovaliutų sukčiavimų aukų.

ŽALIA — reguliavimo / teisiniai pokyčiai

DOJ: pirmasis domenų areštas pagal „TAKE IT DOWN" įstatymą (CFAKE \[.\] com, SOCFAKE \[.\] com).

NPM 12: pagal nutylėjimą nebevykdys priklausomybių scenarijų — apsauga nuo tiekimo grandinės atakų.

FBI ir Google sunaikino „Outsider Enterprise" phishing-as-a-service (>9 000 svetainių, \~1,9 mlrd. USD žalos).

Conti: ukrainietis pripažino kaltę JAV dėl loaderio kūrimo.

Buvęs mokyklos IT darbuotojas (JAV) nuteistas 21 mėn. už ataką prieš darbdavį.

Maine (JAV) laikinai išjungė pažeidimų pranešimų portalą dėl suklastotų pranešimų.

Anthropic užblokavo Fable 5 / Mythos 5 po JAV eksporto kontrolės nurodymo (šaltinis: Cyber Security News — nepatikrinta).

CVE-2026-0257's GlobalProtect authentication bypass went from advisory to active exploitation in four days. The recurring pattern of perimeter device failures demands more than a patch cycle.
Palo Alto’s GlobalProte...  https://t.co/09jcVcnfyx

Palo Alto Networks warns of attacks using PAN-OS VPN bypass flaw CVE-2026-0257 https://t.co/pnBqxTjdXk

🔐 Palo Alto's GlobalProtect VPN has an actively exploited authentication bypass flaw — CVE-2026-0257.

How it works: attacker grabs your public cert from HTTPS, forges a cookie for the local admin account, gets VPN access. No credentials needed. 

Rapid7 confirmed exploitation across multiple enterprise customers since May 17. 

CISA added it to KEV. Patch or disable auth override cookies now.

🛡️ Active exploitation of a critical Palo Alto GlobalProtect flaw (CVE-2026-0257) lets attackers bypass authentication and forge VPN access without valid credentials. If authentication override is enabled, patch immediately.

#CyberSecurity #PaloAlto

 https://t.co/QYA6xVKCa3

Attackers are exploiting CVE-2026-0257 to forge session cookies and establish unauthorized VPN connections through Palo Alto GlobalProtect portals. Once inside the perimeter, lateral movement becomes trivial without runtime segmentation to contain breach chains. #ZeroTrust

🔗 Full TRC analysis: https://t.co/72xFKjfTvV

Palo Alto Networks предупреждает своих клиентов об активной эксплуатации недавно обнаруженной уязвимости в PAN-OS неизвестным злоумышленником с целью получения несанкционированного доступа к порталам GlobalProtect.

Речь идёт о CVE-2026-0257 (CVSS: 7,8), представляющей собой ошибку обхода аутентификации, затрагивающую компоненты портала и шлюза программного обеспечения PAN-OS, которая может быть использована злоумышленниками для установления VPN-соединений.

По данным компании, этот недостаток безопасности может быть использован злоумышленником для обхода средств контроля безопасности и установления VPN-соединений.

Уязвимость была использована в реальных условиях в ходе ограниченных атак, при этом первоначальная активность была зафиксирована 17 мая 2026 года. В настоящее время неизвестно, кто стоит за этими попытками эксплуатации.

Как заявили в Palo Alto Networks, на данный момент не выявлено никаких изменений в поведении после доступа или перемещения по сети. Лишь небольшая часть проверенных устройств фактически установила VPN-сессии, что привело к событиям, связанным с подключением к шлюзу.

Компания представила замеченные IOCs, связанные с этой активностью: 

- IP-адреса: 23.128.228[.]6, 104.207.144[.]154, 146.19.216[.]119, 146.19.216[.]120, 146.19.216[.]125, 179.43.172[.]213, 185.195.232[.]139, 198.12.106[.]60 и 202.144.192[.]47;
- Имена хостов и MAC-адреса: aa:bb:cc:dd:ee:ff, 00:11:22:33:44:55, WINDOWS-LAPTOP-001, DESKTOP-GP01 и GP-CLIENT.

Palo Alto Networks также настоятельно рекомендует клиентам искать в журналах GlobalProtect события успешного подключения к шлюзу, соответствующие следующим жестко закодированным значениям конфигурации клиента из эксплойта, демонстрирующего работоспособность системы: 
- endpoint_os_version: Microsoft Windows 10 Pro 64-bit;
- source_user_info.domain : empty.

Помимо клиентов Palo Alto с PAN-OS’ом, с проблемами также столкнулись и пользователи Splunk Enterprise, связанными с критической CVE-2026-20253 (имеет рейтинг 9,8).

Ошибка может быть использована для проведения неаутентифицированных операций с файлами и даже удаленного выполнения кода. 

В версиях Splunk Enterprise ниже 10.2.4 и 10.0.7 неавторизованный пользователь мог создавать или усекать произвольные файлы через конечную точку службы-посредника PostgreSQL. 

Уязвимость обусловлена отсутствием средств аутентификации в конечной точке службы-контейнера PostgreSQL, что позволяет любому пользователю, доступному по сети, выполнять файловые операции без учетных данных.

Проблема была решена в следующих версиях: 10.0.0-10.0.6 (исправлено в версии 10.0.7), 10.2.0-10.2.3 (исправлено в версии 10.2.4), 10.4 (не затронуто).

Splunk, входящая в состав Cisco, заявляет, что уязвимость не затрагивает Splunk Cloud, поскольку в этом продукте не используются sidecar-контейнеры Postgres.

В пятницу watchTowr Labs также опубликовала дополнительные технические подробности об уязвимости CVE-2026-20253. Несмотря на то, что пока нет доказательств того, что эта уязвимость используется в реальных условиях, доступность подробностей об эксплойте может все изменить.

CVE-2026-42824 (critical) in Microsoft 365 Copilot Enterprise chained Parameter-to-Prompt Injection, an HTML rendering race condition, and a Bing SSRF to silently exfiltrate emails, OTP codes, SharePoint files, and salary data via a single…

#DFIR_Radar https://t.co/baH2WOTkVn

TRC analysis shows attackers exploited Microsoft 365 Copilot via crafted links, using parameter-to-prompt injection to exfiltrate emails and documents. The 'SearchLeak' vulnerability (CVE-2026-42824) demonstrates how AI systems can become conduits for data theft. #ZeroTrust #ThreatIntel

🔗 Full TRC analysis: https://t.co/nYECCVYuve

🧠 Microsoft has patched CVE-2026-42824, a critical Microsoft 365 Copilot flaw that could leak emails, files, calendar data, and even MFA codes with just one click on a legitimate Microsoft link. No user interaction beyond the click was needed.

#CyberSecurity #AI

Read more: https://t.co/5OXRvPfTaa

Microsoft 365 Copilot 'SearchLeak' Flaw (CVE-2026-42824) — One-Click Enterprise Data Theft via AI #cybersecurity #AIsecurity #Microsoft365 #Copilot #CISO #AI #vulnerability https://t.co/I4UzzlNxLB

🚨 #Microsoft 365 #Copilot SearchLeak (#CVE-2026-42824): The One-Click #AI Data Exfiltration Flaw That Exposes the Hidden Dangers of Over-Permissioned Data + Video

https://t.co/ePNEHxtAyO
Educational Purposes!

CVE-2026-42824 (CVSS 6.5) in Microsoft 365 #Copilot enables single-click exfiltration of emails, MFA codes, meeting notes, and SharePoint/OneDrive files via a trusted microsoft.com-associated link. No additional permissions or victim interaction required. https://t.co/mpYPz14SOn

CISO Daily Briefing: LiteLLM CVE-2026-47101 (CVSS 9.9) three-CVE chain: low-priv to RCE, 100+ AI provider keys exposed — patch to v1.83.14; M365 Copilot CVE-2026-42824 exfiltrates email, OneDrive, and MFA codes from a single legitimate Microsoft click, server-side mitigated; OMB M-26-14 mandates continuous AI monitoring, ending point-in-time audits; U.S. suspended Anthropic Fable 5/Mythos 5 for foreign nationals — AI BCP gaps are now operational risk.
https://t.co/keQSHq4XvT

CVE-2026-42824 uncovered SearchLeak  a critical vulnerability chain in Microsoft 365 Copilot Enterprise that could turn a single click into full data exfiltration.

Using parameter-to-prompt injection & browser rendering tricks & Bing as a relay, attackers could pull sensitive M365 data the victim already had access to.

emails, MFA codes, meeting notes, and SharePoint OneDrive files all silently exfiltrated.

Microsoft patched it quickly,

Important lesson as AI adoption grows: classic web issues & powerful AI assistants new attack surfaces. https://t.co/PtWH7LLgjs

🚨High - M365 Copilot Command Injection (CVE-2026-42824)

Improper neutralization of special elements used in a command ('command injection') in Microsoft 365 Copilot allows an unauthorized attacker to disclose information over a network.

👉Affected: M365 Copilot (affected versions prior to the latest security update) | Upgrade to April 28, 2026 versions

Copilot SearchLeak: One-Click Attack Exfiltrated Corporate Data via Legitimate Microsoft Links

A critical vulnerability chain in Microsoft 365 Copilot Enterprise allowed attackers to steal sensitive corporate data, MFA codes, email contents, calendar details, and confidential files with a single click on a link pointing to a legitimate Microsoft domain. Named SearchLeak and tracked as CVE-2026-42824, the flaw earned Microsoft's maximum severity rating before being patched. The attack combines three distinct weaknesses into a chain that weaponizes Copilot Enterprise Search as a silent data exfiltration engine.

Stage 1: Parameter-to-Prompt (P2P) Injection
→ Microsoft 365 Copilot Search accepts a q URL parameter intended for natural language search queries.
→ Any value placed in the q parameter is interpreted by Copilot's AI engine as executable instructions, not just a search string.
→ Attacker crafts a malicious URL pointing to a trusted microsoft[.]com domain.
→ URL commands Copilot to search the victim's mailbox and embed extracted data in an image URL.
→ Because the link resolves to a legitimate Microsoft domain, traditional anti-phishing and URL protection tools do not flag it.

Stage 2: HTML Rendering Race Condition
→ Microsoft's mitigation for dangerous AI-generated HTML is to wrap Copilot output in <code> blocks, preventing browser rendering as markup.
→ Wrapping only occurs after Copilot finishes its generation phase.
→ During streaming phase, raw HTML including attacker-injected <img> tags is temporarily rendered live in the DOM.
→ Browser fires off HTTP request before sanitizer activates.
→ Textbook race condition bypass.

Stage 3: Server-Side Request Forgery (SSRF) via Bing
→ Victim's browser cannot directly contact attacker-controlled server due to Content Security Policy (CSP) on m365[.]cloud[.]microsoft.
→ *.bing.com is CSP-allowlisted.
→ Bing's "Search by Image" feature accepts an imgurl parameter and performs server-side fetch of the provided URL.
→ Attacker embeds stolen data directly in the path of the Bing image-search URL.
→ Bing's backend unwittingly relays stolen data to the attacker's server, bypassing CSP entirely.

Attack Requirements
→ Crafted link sent via email, Teams, Slack, or any messaging channel.
→ One click required.
→ No special privileges, plugins, or secondary interactions needed.

What Gets Exfiltrated
→ Email contents, Calendar details, MFA codes, Confidential files.
→ Virtually any data the victim can access within their Microsoft 365 tenant.

🛡️ Defense Recommendations
→ Monitor Copilot Search URLs for encoded payloads in the q parameter containing HTML or image-embedding instructions.
→ Audit CSP allowlists for any domain that performs server-side fetches on user-supplied URLs.
→ Treat AI streaming output as untrusted; sanitization must occur at render time, not as a post-processing step.
→ Alert users to inspect Microsoft 365 links with long, encoded query strings before clicking.

SearchLeak follows Varonis' earlier discovery of Reprompt, a similar one-click data exfiltration chain affecting Copilot Personal. AI assistants are reactivating previously unexploitable classic vulnerabilities in new contexts, creating new attack surfaces that are hard to detect with traditional defenses.

Dolev Taler

CVE-2026-31431 (Copy Fail) detection toolkit — auditd, eBPF, Sigma, YARA https://t.co/eu5X5JlkJ1 #cyber #threathunting #infosec

Container escapes are no longer just about simple misconfigurations. Modern attacks may rely on kernel-level flaws, exposed Docker sockets, privileged containers, or multiple weaknesses chained together.

This technical breakdown covers:

* How CVE-2026-31431, also known as Copy-Fail, enables container escape
* The relationship between the container, shared kernel, and runc
* A practical exploitation flow from low-privilege access to host command execution
* Key mitigation steps for defenders

Read the full walkthrough:  
[https://www.redfoxsec.com/blog/escaping-docker-container-in-2026](https://www.redfoxsec.com/blog/escaping-docker-container-in-2026)

For authorized security research and educational purposes only.

CVE-2026-31431: Linux Kernel Local Privilege Escalation ("Copy Fail")

Status: QUEUED FOR https://t.co/CfXzKLwl6E 
Priority: HIGH 
Date Published: May 1, 2026 CISA Added to KEV: May 1, 2026 
CVE ID: CVE-2026-31431

Status: QUEUED FOR https://t.co/CfXzKLwl6E 
Priority: HIGH 
Date Published: May 1, 2026 (CISA Added to KEV: May 1, 2026) 
CVE ID: CVE-2026-31431

CVE-2026-31431: Linux Kernel Local Privilege Escalation ("Copy Fail")

Unpopular opinion:

The cybersecurity industry is selling you dashboards.

A deterministic Linux kernel local privilege escalation vulnerability — CVE-2026-31431, nicknamed "Copy Fail" — gives any unprivileged local user a root shell on virtually every major Linux…

Unpopular opinion:

The cybersecurity industry is selling you dashboards.

CVE-2026-31431, branded "Copy Fail" by its discoverers at Theori, is a high-severity (CVSS 7.8) local privilege escalation (LPE) flaw baked into the Linux kernel's cryptographic subsystem since 2017.

Copy Fail: The Complete Defender's Playbook for CVE-2026-31431 — The Nine-Year Linux LPE Hiding in Your Cloud.

CVE-2026-31431, publicly nicknamed Copy Fail, is a local privilege escalation LPE vulnerability in the Linux kernel's algifaead module.

Copy Fail: The 732-Byte Root Exploit Hiding in Your Page Cache — Defender Playbook for CVE-2026-31431

---

CVE-2026-31431 ("Copy Fail") is a deterministic local privilege escalation (LPE) vulnerability in the Linux kernel that has been sitting in production kernels since 2017. Publicly disclosed on April 29, 2026 by Theori/Xint researchers, and added to CISA's Known Exploited…

Jan Schaumann

#ParsedReport #CompletenessMedium
15-06-2026

Dark Web Profile: Fox Kitten

https://socradar.io/blog/dark-web-profile-fox-kitten/

Report completeness: Medium

Actors/Campaigns:
Fox_kitten (motivation: cyber_espionage)
Irgc

Threats:
Chinachopper
Chunkytuna
Hanifnet
Hxlibrary
Neoexpressrat
Shadow_copies_delete_technique
Credential_harvesting_technique
Procdump_tool
Angry_ip_scanner_tool
Putty_tool
Plink_tool
Tightvnc_tool
Frpc_tool
Ngrok_tool
Reversesocks5_tool
Sshminion_tool
Timestomp_technique
Chisel_tool
Meshcentral_tool
Noescape
Ransomhouse
Blackcat
Pay2key
Psexec_tool
Credential_dumping_technique

Victims:
Oil and gas, Technology, Government, Defense, Healthcare, Manufacturing, Engineering, Finance, Education, Telecommunications, have more...

Industry:
Government, Critical_infrastructure, Telco, Petroleum, Education, Healthcare, Financial

Geo:
America, Israeli, Middle east, China, Africa, Australia, Iranian, Israel, United states, Azerbaijan, Arab emirates, United arab emirates

CVEs:
CVE-2024-24919  [Vulners]
    CVSS V3.1: 8.6, 
    Vulners: Exploitation: True
    X-Force: Risk: Unknown
    X-Force: Patch: Unknown
    Soft:
    - checkpoint quantum_spark_firmware (r80.40)

CVE-2019-11510  [Vulners]
    CVSS V3.1: 9.9, 
    Vulners: Exploitation: True
    X-Force: Risk: Unknown
    X-Force: Patch: Unknown
    Soft:
    - ivanti connect_secure (8.2, 8.3, 9.0)

CVE-2023-3519  [Vulners]
    CVSS V3.1: 9.8, 
    Vulners: Exploitation: True
    X-Force: Risk: Unknown
    X-Force: Patch: Unknown
    Soft:
    - citrix netscaler_application_delivery_controller (<12.1-55.297, <13.0-91.13, <13.1-37.159, <13.1-49.13)
    - citrix netscaler_gateway (<13.0-91.13, <13.1-49.13)

CVE-2019-19781  [Vulners]
    CVSS V3.1: 9.8, 
    Vulners: Exploitation: True
    X-Force: Risk: Unknown
    X-Force: Patch: Unknown
    Soft:
    - citrix application_delivery_controller_firmware (10.5, 11.1, 12.0, 12.1, 13.0)

CVE-2024-3400  [Vulners]
    CVSS V3.1: 10.0, 
    Vulners: Exploitation: True
    X-Force: Risk: Unknown
    X-Force: Patch: Unknown
    Soft:
    - paloaltonetworks pan-os (10.2.0, 10.2.1, 10.2.2, 10.2.3, 10.2.4)

CVE-2022-1388  [Vulners]
    CVSS V3.1: 9.8, 
    Vulners: Exploitation: True
    X-Force: Risk: Unknown
    X-Force: Patch: Unknown
    Soft:
    - f5 big-ip_access_policy_manager (le11.6.5, le12.1.6, <13.1.5, <14.1.4.6, <15.1.5.1)
    - f5 big-ip_advanced_firewall_manager (le11.6.5, le12.1.6, <13.1.5, <14.1.4.6, <15.1.5.1)
    - f5 big-ip_analytics (le11.6.5, le12.1.6, <13.1.5, <14.1.4.6, <15.1.5.1)
    - f5 big-ip_application_acceleration_manager (le11.6.5, le12.1.6, <13.1.5, <14.1.4.6, <15.1.5.1)
    - f5 big-ip_application_security_manager (le11.6.5, le12.1.6, <13.1.5, <14.1.4.6, <15.1.5.1)
    have more...
CVE-2020-5902  [Vulners]
    CVSS V3.1: 9.8, 
    Vulners: Exploitation: True
    X-Force: Risk: Unknown
    X-Force: Patch: Unknown
    Soft:
    - f5 big-ip_access_policy_manager (<11.6.5.2, <12.1.5.2, <13.1.3.4, <14.1.2.6, le15.0.1.4)
    - f5 big-ip_advanced_firewall_manager (<11.6.5.2, <12.1.5.2, <13.1.3.4, <14.1.2.6, <15.0.1.4)
    - f5 big-ip_advanced_web_application_firewall (<11.6.5.2, <12.1.5.2, <13.1.3.4, <14.1.2.6, <15.0.1.4)
    - f5 big-ip_analytics (<11.6.5.2, <12.1.5.2, <13.1.3.4, <14.1.2.6, <15.0.1.4)
    - f5 big-ip_application_acceleration_manager (<11.6.5.2, <12.1.5.2, <13.1.3.4, <14.1.2.6, <15.0.1.4)
    have more...

TTPs:
Tactics: 10
Technics: 47

IOCs:
File: 6

Soft:
BIG-IP, PAN-OS, PsExec, prodump, Active Directory, KeePass, WizTree, Chrome, TightVNC, Twitter, have more...

Algorithms:
base64

Languages:
perl, powershell, php

Iran 🇮🇷 state-sponsored Fox Kitten APT operates dual mission: intelligence collection for IRGC while brokering network access to ransomware affiliates for profit. Group rapidly weaponizes VPN/firewall CVEs and maintains extended access through tunneling infrastructure.

Key technical details:
• Primary entry via internet-facing appliances: CVE-2024-3400 (Palo Alto), CVE-2023-3519 (Citrix), CVE-2024-24919 (Check Point)
• Persistence: HanifNet/.NET backdoor, HXLibrary/IIS module, China Chopper webshells, sticky keys abuse (T1546.008)
• C2 infrastructure: FRPC, ngrok, Chisel reverse proxies routing through AWS; SSHMinion custom tunneling tool
• Credential theft: prodump (ProcDump variant) for LSASS dumping, Volume Shadow Copy for NTDS.dit extraction
• Confirmed partnerships with NoEscape, Ransomhouse, ALPHV affiliates since 2024

Hunt for ngrok/FRPC execution, LSASS access attempts, and TightVNC installations. Prioritize patching internet-facing VPN/firewall devices - Fox Kitten weaponizes new CVEs within days of disclosure.

#DFIR_Radar

Everyone is building AI agents.

Very few are giving them real security intelligence.

That's the gap.

CVE MCP Server gives Claude access to 27 security tools across 21 APIs for vulnerability analysis, threat intelligence, EPSS scoring, CISA KEV lookups, MITRE ATT&CK mapping, Shodan, VirusTotal, and more—all through natural language.

Think about what this means.

Instead of spending hours jumping between:

• NVD databases
• CVE feeds
• EPSS scores
• Shodan searches
• Threat intelligence platforms
• MITRE ATT&CK references

You can simply ask:

"Should we patch CVE-2024-3400?"

And get a risk-based answer backed by multiple intelligence sources.

The interesting part?

This isn't another security dashboard.

It's a security analyst API for AI agents.

We're entering a world where:

AI can write code.

AI can deploy code.

AI can monitor systems.

The missing piece is helping AI understand risk.

Because every AI-powered company is becoming a software company.

And every software company eventually becomes a security company.

The biggest opportunity in AI security isn't building smarter firewalls.

It's giving AI access to better intelligence.

Models create answers.

Intelligence creates decisions.

And in cybersecurity, decisions are everything.

Palo Alto Networks firewalls (CVE-2024-3400) had a critical zero-day exploited in the wild before a patch was available. Even security appliances have critical vulnerabilities. Defence-in-depth means no single device is the last line. #PaloAlto #CVE20243400

#threatreport #MediumCompleteness
From Conti to The Gentlemen: tooling evolved, gaps didn't. | 03-06-2026
Source: https://t.co/5HfSyUx5DS
Key details below ↓

🧑‍💻Actors/Campaigns:
Gentlemen_ransomware (🧠motivation: financially_motivated, cyber_criminal)
Contileaks
Zeta88
Protagor
0ktapus
Volt_typhoon

💀Threats:
Conti, Blackbasta, Lockbit, Qilin_ransomware, Pikabot, Ryuk, Cobalt_strike_tool, G-bot, Phemedrone, Dumpbrowsersecrets_tool, Lumma_stealer, Anydesk_tool, Rclone_tool, Megacmd_tool, Icedid, Devman, Darkside, 
🎯Victims: Banking, Health care, Energy, Businesses, Individuals, Cloud environments, Germany, Ireland, Russian federation

🏭Industry: Financial, Government, Healthcare

🌐Geo: Ireland, French, Moscow, Russian, Ukrainian, Germany, Ukraine

🔓CVEs: CVE-2025-32433  \[[Vulners](https://t.co/CCYFnis5BB)]
 - CVSS V3.1: *10.0*, 
 - Vulners: Exploitation: True
    Soft:
 - erlang erlang\/otp (<25.3.2.20, <26.2.5.11, <27.3.3)

CVE-2025-33073  \[[Vulners](https://t.co/hoReITJskV)]
 - CVSS V3.1: *8.8*, 
 - Vulners: Exploitation: True
    Soft:
 - microsoft windows_10_1507 (<10.0.10240.21034)
 - microsoft windows_10_1607 (<10.0.14393.8148)
 - microsoft windows_10_1809 (<10.0.17763.7434)
 - microsoft windows_10_21h2 (<10.0.19044.5965)
 ...
CVE-2024-55591  \[[Vulners](https://t.co/oy3q2NTvpy)]
 - CVSS V3.1: *9.8*, 
 - Vulners: Exploitation: True
    Soft:
 - fortinet fortiproxy (<7.0.20, <7.2.13)
 - fortinet fortios (<7.0.17)

CVE-2024-3400  \[[Vulners](https://t.co/Mb1vAGibLu)]
 - CVSS V3.1: *10.0*, 
 - Vulners: Exploitation: True
    Soft:
 - paloaltonetworks pan-os (10.2.0, 10.2.1, 10.2.2, 10.2.3, 10.2.4)

CVE-2020-5135  \[[Vulners](https://t.co/E9CMkTnHBh)]
 - CVSS V3.1: *9.8*, 
 - Vulners: Exploitation: True
    Soft:
 - sonicwall sonicos (le6.0.5.3, le6.5.1.11, le6.5.4.7, 7.0.0.0)
 - sonicwall sonicosv (le6.5.4.4)

🤖LLM extracted TTPs:`
T1003.003, T1071.004, T1078, T1090, T1095, T1105, T1106, T1110.001, T1190, T1219, ...

🧨IOCs:
 - File: 4
 - IP: 1

💽Software: Jabber, Twitter, Telegram, ChatGPT, , Hugging Face, ESXi, Hyper-V, PAN-OS, Confluence, ...

🪙Crypto: bitcoin

🔢Algorithms: rc4

📜Programming Languages: rust, python

💻Platforms: arm, intel

#threatreport:
Recent leaks from various ransomware groups over the past four years have illustrated their evolving operational structures and tactics, particularly highlighting a lack of innovation in their entry and movement strategies. In analyzing leaked communications from groups like Conti, Black Basta, LockBit, and The Gentlemen, it's evident that while the technique and tooling have advanced, foundational gaps in cybersecurity remain unaddressed.

The operators of The Gentlemen, identified in a leak from May 2026, exhibited a decentralized structure with no formal payroll system, unlike Conti, which functioned with a larger, corporate-like framework. This shift signifies a move towards smaller, more agile units that operate across various time zones, relying on platforms like https://t.co/7gL4zMUo1A for coordination. The role continuity among operators, particularly Tinker, showcases an ongoing reliance on established personnel across these groups, despite rebranding and operational changes.

The leaks revealed a notable evolution in the use of artificial intelligence (AI) in ransomware operations. Initial discussions in the 2022 Conti chats reflected a human-driven approach, but by 2025, AI tools like ChatGPT were being employed for tasks ranging from creating deceptive messages to automating negotiations and debugging code. Despite this integration, the leaks did not indicate the development of AI-generated malware, suggesting that while AI tools are enhancing operational efficiency, they are not yet at the forefront of malware innovation.

A significant advancement in attack techniques is the effective exploitation of endpoint detection and response (EDR) systems. The Gentlemen group demonstrated the ability to operate their malware without detection by employing methods like hardware breakpoint removal and syscall unhooking. Moreover, their approach included attacking hypervisor-level systems, thereby circumventing guest-level defenses that typical endpoint detection strategies may offer insufficient visibility into, marking a crucial vulnerability for organizations.

Conversely, the intelligence gathered from these leaks pointed to a persistent reliance on known vulnerabilities. Operators continually discussed targeting specific CVEs, including those for prominent enterprise systems. For instance, the primary access tactics of The Gentlemen heavily referenced a CVE-2024-55591 exploit concerning Fortinet appliances, demonstrating a tendency to exploit well-documented weaknesses in enterprise security.

Additionally, common tools used for credential theft and lateral movement were identified, including Phemedrone and various credential dumping and decryption tools. This underlines a continued focus on leveraging browser-stored credentials as a significant attack vector. Importantly, file exfiltration methods remained rudimentary yet effective, emphasizing the use of legitimate tools like rclone for data transfer to external locations.

In summary, while ransomware groups are adapting their organizational structures and incorporating new tools into their operation, the exploitation of existing vulnerabilities and the overarching gaps in detection and response mechanisms remain significant challenges. Addressing these recurring issues should focus on rigorous auditing of edge appliances, improving visibility into hypervisor-level activities, and enhancing detection capabilities for post-authentication behaviors to counteract the prevalent threats posed by such sophisticated ransomware actors.

[Main Interface](https://preview.redd.it/hfcqy8ifh41h1.png?width=1852&format=png&auto=webp&s=ac41531763c48e7268e67bab342b838e38bfbfe3)



Been building this for a while and wanted to share what it does and how the pipeline works.

**X3r0Hunter** is a terminal-based platform that wires together multiple techniques from discovery, nuclei scanning, and exploit execution into a single workflow. You pick a CVE, discover targets, scan them, and launch exploits - all from one TUI.

**The pipeline**:

1. **Profile system** \- each CVE has a config entry which helps me get the targets and, a nuclei template path, and a hit-matcher function that parses nuclei output
2. **Discovery** \- spins up Docker containers with X3r0IPRotator to rotate IPs while scanning for targets. Saves them to a target list. Finds 10k ip under 10 seconds lol.
3. **Scanning** \- feeds targets into nuclei with the CVE's template. Tracks scanned vs pending vs vulnerable. Handles checkpointing, resume, IP rotation
4. **Exploitation** \- Python exploits for each CVE (RCE shells, interactive mode, etc.), launchable from a menu

**Currently supports \~15 CVEs including:**

\- **CVE-2025-55182** (React2Shell)

\- **CVE-2022-26134** (Confluence OGNL injection)

\- **CVE-2024-2719**8 (TeamCity auth bypass)

\- **CVE-2024-3400** (PAN-OS GlobalProtect)

\- **CVE-2026-42945** (NGINX Rift (Most recent one) )

\- **Various others** (Tomcat, ActiveMQ, FortiOS, Ivanti, etc.)

the niche is automated scan-to-exploit without context switching between tools.

really had fun building this beast!

CVE-2024-3400 (GlobalProtect) last year was the same shape — unauth RCE root, exploited weeks before patch. PAN-OS management-plane features keep being the soft spot. If the User-ID Captive Portal is internet-reachable, assume it's a target, not just a webpage.

🔒 #CyberSecurity

CVE-2024-3400: Palo Alto Networks PAN-OS Zero-Day Exploitation — Detection & Mi…

"Critical PAN-OS vulnerability (CVE-2024-3400) is under active attack. Immediate mitigation…"

🔗 https://t.co/cHjhCLVlkM

#CyberSecurity #ThreatIntel #cve #zeroday #patchtuesday

Steven Adair

On April 28, 2026, cPanel released an emergency patch for CVE-2026-41940—an unauthenticated remote authentication bypass that allowed attackers to gain administrative access to cPanel and Web Host Manager (WHM) with no credentials.

The cPanel Cascade: How 44,000 Servers Fell to One Flaw, and Why Three More Just Appeared.

A critical authentication bypass in cPanel CVE-2026-41940, CVSS 9.8 has already compromised 44,000 servers worldwide with active "Sorry" ransomware deployments.

A critical authentication bypass in cPanel (CVE-2026-41940, CVSS 9.8) has already compromised 44,000 servers worldwide with active "Sorry" ransomware deployments. Within ten days of the initial patch, cPanel disclosed three additional HIGH-severity vulnerabilities…

🚨 cPanelSniper — CVE-2026-41940

CRITICAL auth bypass in cPanel & WHM (CVSS 10.0)

Zero credentials → Full root WHM access via CRLF injection + session file poisoning.

~70 million domains affected.

### Exploit Chain (4 stages):
1. Pre-auth session minting  
2. CRLF injection via Authorization header  
3. do_token_denied gadget (raw → cache flush)  
4. /json-api/version → PWNED

What you get:
- ✅ Interactive WHM root shell  
- ✅ Account enumeration  
- ✅ Command execution  
- ✅ Backdoor admin creation  
- ✅ Ready for bulk scanning (stdlib only, no extra deps)

https://github.com/ynsmroztas/cPanelSniper

| Date | Event |
|------|-------|
| Feb 23, 2026 | Earliest confirmed in-the-wild exploitation (Bitsight telemetry) |
| Apr 28, 2026 | cPanel issues sparse advisory; patches released across all supported tracks |
| Apr 29, 2026 | CVE-2026-41940 assigned (CVSS 9.8);…

Event vs competitors:
Feb 23, 2026: Earliest confirmed in-the-wild exploitation (Bitsight telemetry)
Apr 28, 2026: cPanel issues sparse advisory; patches released across all supported tracks
Apr 29, 2026: CVE-2026-41940 assigned (CVSS 9.8); watchTowr publishes PoC +…

The Key to 70 Million Kingdoms: CVE-2026-41940 — cPanel/WHM CRLF Auth Bypass Exploited as Zero-Day.

A CVSS 9.8 authentication bypass in cPanel &amp; WHM — the control panel software managing 70 million-plus domains across 94% of shared hosting infrastructure — has been…

CVE-2026-41940 is a pre-authentication CRLF injection bug in cPanel &amp; WHM's session daemon (cpsrvd) with a CVSS of 9.8 (Critical). An unauthenticated remote attacker injects fabricated session attributes — including user=root and tfaverified=1 — into a server-side session…

What this means for your agents and systems:
CVE-2026-41940 is a pre-authentication CRLF injection bug in cPanel &amp; WHM's session daemon (cpsrvd) with a CVSS of 9.8 (Critical). An unauthenticated remote attacker injects fabricated session attributes — including user=root…

1.5 Million · CVE-2026-41940 · 1.5 → 9.8

CVE-2026-41940: The cPanel Zero-Day That Owned 1.5 Million Servers Before the Patch Existed

Watchtowr

CVE-2025-8088 — Russia-Linked APTs Are Still Pwning Unpatched WinRAR Installs in Ukraine

Original text: “Russian APTs Still Exploiting Patched WinRAR Flaw CVE-2025-8088” — Pierluigi Paganini, Security Affairs (June 10, 2026). Trend Micro’s reporting and the two illustrations below are reproduced with attribution; prose is original analysis.

Executive Summary

Pierluigi Paganini’s Security Affairs writeup — built on a June 2026 Trend Micro report — documents that CVE-2025-8088, the…

https://core-jmp.org/2026/06/cve-2025-8088-russian-apts-winrar-ukraine-patch-gap/

WinRAR is used daily across Ukraine, but CVE-2025-8088, a WinRAR flaw patched in July 2025, is still being exploited. TrendAI™ Research tracked two Russia-aligned groups producing new exploit samples for this flaw through April 2026. Read more: https://t.co/E7nF71bTLW https://t.co/FKe4Izmxdw

Here’s a quick breakdown of the 10 most interesting vulnerabilities trending today:

**1. [CVE-2025-8088](https://nvd.nist.gov/vuln/detail/CVE-2025-8088)**

- 📝 A path traversal vulnerability affecting the Windows version of WinRAR allows the attackers to execute arbitrary code by crafting malicious archive files. This vulnerability was exploited in the wild and was discovered byAnton Cherepanov, Peter Koinr, and Peter Strek      from ESET.

- 📅 **Published:** 08/08/2025
- 📈 **CVSS:** 8.4
- 🛡️ **CISA KEV:** True
- 🧭 **Vector:** CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
- 📣 **Mentions:** 23
- ⚠️ **Priority:** 1+
- 📝 **Analysis:** A path traversal vulnerability in Windows WinRAR allows attackers to execute arbitrary code via malicious archive files. This vulnerability has been exploited in the wild and was discovered by ESET researchers. Given its high CVSS score and prior activity, it is a priority 2 issue.


---

**2. [CVE-2026-27509](https://nvd.nist.gov/vuln/detail/CVE-2026-27509)**

- 📝 Unitree Go2 firmware versions V1.1.7 through V1.1.9 and V1.1.11 (EDU) do not implement DDS authentication or authorization for the Eclipse CycloneDDS topic rt/api/programming_actuator/request handled by actuator_manager.py. A network-adjacent, unauthenticated attacker can join DDS domain 0 and publish a crafted message (api_id=1002) containing arbitrary Python, which the robot writes to disk under /unitree/etc/programming/ and binds to a physical controller keybinding. When the keybinding is pressed, the code executes as root and the binding persists across reboots.

- 📅 **Published:** 26/02/2026
- 📈 **CVSS:** 8.5
- 🧭 **Vector:** CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
- 📣 **Mentions:** 8
- ⚠️ **Priority:** 2
- 📝 **Analysis:** Unauthenticated network-adjacent attackers can write arbitrary Python code onto a robot's file system and bind it to physical controller keybindings via DDS domain 0 in Unitree Go2 firmware versions V1.1.7 through V1.1.9 and V1.1.11 (EDU). No known exploits detected, this is a priority 2 vulnerability given high CVSS but low Exploit Prediction Scoring System (EPSS) score.


---

**3. [CVE-2026-27510](https://nvd.nist.gov/vuln/detail/CVE-2026-27510)**

- 📝 Unitree Go2 firmware versions 1.1.7 through 1.1.11, when used with the Unitree Go2 Android application (com.unitree.doggo2), are vulnerable to remote code execution due to missing integrity protection and validation of user-created programmes. The Android application stores programs in a local SQLite database (unitree_go2.db, table dog_programme) and transmits the programme_text content, including the pyCode field, to the robot. The robots actuator_manager.py executes the supplied Python as root without integrity verification or content validation. An attacker with local access to the Android device can tamper with the stored programme record to inject arbitrary Python that executes when the user triggers the program via a controller keybinding, and the malicious binding persists across reboots. Additionally, a malicious program shared through the applications community marketplace can result in arbitrary code execution on any robot that imports and runs it.

- 📅 **Published:** 26/02/2026
- 📈 **CVSS:** 6.4
- 🧭 **Vector:** CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H
- 📣 **Mentions:** 7
- ⚠️ **Priority:** 2
- 📝 **Analysis:** A remote code execution vulnerability exists in Unitree Go2 firmware versions 1.1.7 through 1.1.11 when used with the com.unitree.doggo2 Android app. An attacker can tamper with stored programs, leading to arbitrary Python execution on the robot. This vulnerability has a CVSS score of 6.4 and is considered a priority 2 issue due to high CVSS but low exploit potential. Confirmed exploits in the wild have not been detected.


---

**4. [CVE-2026-46529](https://nvd.nist.gov/vuln/detail/CVE-2026-46529)**

- 📝 n/a

- 📈 **CVSS:** 0
- 🧭 **Vector:** n/a
- ⚠️ **Priority:** 2
- 📝 **Analysis:** A critical command execution vulnerability exists in a web application's admin panel (API module). Remote attackers can exploit this due to improper input validation. While there's no confirmed in-the-wild activity (CISA KEV), the high CVSS score indicates significant impact and easy exploitability, making it a priority 1 vulnerability. The versions affected are those explicitly mentioned in the description.


---

**5. [CVE-2026-25089](https://nvd.nist.gov/vuln/detail/CVE-2026-25089)**

- 📝 A improper neutralization of special elements used in an os command (os command injection) vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.5, FortiSandbox 4.4.0 through 4.4.8, FortiSandbox 4.2 all versions, FortiSandbox Cloud 5.0.4 through 5.0.5, FortiSandbox PaaS 5.0.4 through 5.0.5 may allow an unauthenticated attacker to execute unauthorized commands via specifically crafted HTTP requests

- 📅 **Published:** 09/06/2026
- 📈 **CVSS:** 9.1
- 🧭 **Vector:** CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C
- 📣 **Mentions:** 6
- ⚠️ **Priority:** 2
- 📝 **Analysis:** Unauthenticated attacker can execute unauthorized OS commands via HTTP requests on various Fortinet FortiSandbox versions due to an os command injection vulnerability. No known exploits have been detected but given high CVSS score, this is a priority 2 vulnerability with low Exploit Prediction Scoring System (EPSS) score.


---

**6. [CVE-2026-39813](https://nvd.nist.gov/vuln/detail/CVE-2026-39813)**

- 📝 A path traversal: ../filedir vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.5, FortiSandbox 4.4.0 through 4.4.8 may allow attacker to escalation of privilege via <insert attack vector here>

- 📅 **Published:** 14/04/2026
- 📈 **CVSS:** 9.1
- 🧭 **Vector:** CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C
- 📣 **Mentions:** 21
- ⚠️ **Priority:** 2
- 📝 **Analysis:** A path traversal vulnerability found in Fortinet FortiSandbox versions 5.0.0-5.0.5 and 4.4.0-4.4.8 enables privilege escalation. Despite no known exploits, the high CVSS score indicates a priority 2 situation due to low exploitability.


---

**7. [CVE-2026-39808](https://nvd.nist.gov/vuln/detail/CVE-2026-39808)**

- 📝 A improper neutralization of special elements used in an os command (os command injection) vulnerability in Fortinet FortiSandbox 4.4.0 through 4.4.8 may allow attacker to execute unauthorized code or commands via <insert attack vector here>

- 📅 **Published:** 14/04/2026
- 📈 **CVSS:** 9.1
- 🧭 **Vector:** CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C
- 📣 **Mentions:** 35
- ⚠️ **Priority:** 2
- 📝 **Analysis:** A 'os command injection' vulnerability in Fortinet FortiSandbox 4.4.0 through 4.4.8 allows unauthorized code execution via <insert attack vector here>. No known exploits detected in the wild, but the high CVSS score and potential impact warrant a priority 2 response.


---

**8. [CVE-2026-54420](https://nvd.nist.gov/vuln/detail/CVE-2026-54420)**

- 📝 LiteSpeed cPanel plugin before 2.4.8 (as distributed in LiteSpeed WHM PlugIn before 5.3.2.0) mishandles symlinks provided by a user with FTP or web shell access on a shared hosting server running CloudLinux/CageFS, as exploited in the wild in May 2026.

- 📅 **Published:** 14/06/2026
- 📈 **CVSS:** 8.5
- 🛡️ **CISA KEV:** True
- 🧭 **Vector:** CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
- 📣 **Mentions:** 15
- ⚠️ **Priority:** 1+
- 📝 **Analysis:** An unhandled symlink issue in the LiteSpeed cPanel plugin before version 2.4.8, as found in LiteSpeed WHM PlugIn before 5.3.2.0 on CloudLinux/CageFS servers, has been exploited in the wild since May 2026. This vulnerability poses a high impact due to its ability to compromise command execution and confidential data, making it a priority 1+ concern for prompt patching.


---

**9. [CVE-2026-20262](https://nvd.nist.gov/vuln/detail/CVE-2026-20262)**

- 📝 A vulnerability in the web UI of Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, could allow an authenticated, remote attacker to create a file or overwrite any file on the filesystem of an affected system. This vulnerability exists because the affected software does not properly validate user-supplied input during a file upload process. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected API endpoint of the affected system. A successful exploit could allow the attacker to create or overwrite any file on the underlying operating system. This file could later be used to elevate to root. To exploit this vulnerability, the attacker must have valid credentials with at least a lower-privileged, single-task user account.

- 📅 **Published:** 15/06/2026
- 📈 **CVSS:** 6.5
- 🛡️ **CISA KEV:** True
- 🧭 **Vector:** CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
- 📣 **Mentions:** 21
- ⚠️ **Priority:** 1+
- 📝 **Analysis:** A file-upload vulnerability exists in the web UI of Cisco Catalyst SD-WAN Manager, allowing authenticated attackers to create or overwrite files on affected systems via a crafted HTTP request. Successful exploitation could lead to elevation to root. This vulnerability requires valid credentials with at least a lower-privileged account. Confirmed exploited in the wild, prioritize remediation.


---

**10. [CVE-2026-54157](https://nvd.nist.gov/vuln/detail/CVE-2026-54157)**

- 📝 n/a

- 📈 **CVSS:** 0
- 🧭 **Vector:** n/a
- ⚠️ **Priority:** n/a
- 📝 **Analysis:** No Information available for this CVE at the moment


---

Let us know if you're tracking any of these or if you find any issues with the provided details.

Russia-aligned groups have long targeted Ukrainian government and military networks. At least five have now exploited CVE-2025-8088, a WinRAR flaw. Credentials stolen from those targets carry downstream risk for allied nations and partners. Read more: https://t.co/E7nF71bTLW https://t.co/p2R2Piyix4

Russian campaigns exploit patched WinRAR flaw (CVE-2025-8088) for data theft against Ukrainian orgs. The lesson: attackers don't need zero-days. They need unpatched systems. Your patch cadence is your defense.

#DataStrategy #CyberSecurityIntel #DataLeadership #InfoSec

Russian hackers are exploiting the WinRAR vulnerability CVE-2025-8088 to deploy the GIFTEDCROOK stealer, targeting Ukrainian organizations. This flaw, patched in July 2025, allows attackers to infiltrate systems via malicious RAR archives. Despite the availability of a fix, the continued exploitation highlights the critical need for timely software updates. Organizations must prioritize patch management to mitigate such risks.

#CyberSecurity #WinRAR #GIFTEDCROOK #CVE20258088 #RussianHackers #PatchManagement

https://t.co/GRJgjg56KL

Trend Micro reports CVE-2025-8088, a patched WinRAR flaw, is still being exploited by Russia-aligned groups to deliver GIFTEDCROOK and espionage tools against Ukraine.

#WinRAR #CVE20258088 #Ukraine #CyberEspionage 
https://t.co/WRKL9pps9l https://t.co/lV5akIxmt7

Most enterprise software is managed by system administrators, but WinRAR isn't. With no auto-update and no Group Policy support, CVE-2025-8088 is still fueling attacks on Ukraine nearly a year after patch. Here's what you need to know: https://t.co/E7nF71bTLW https://t.co/HJLVZ8AVDx

'Trading.rar' CVE-2025-8088, seen from Ethiopia @abuse_ch 
https://t.co/luETIHUbUR https://t.co/7XC9WnCW21

Peter Strýček

Peter Košinár

Anton Cherepanov

CVE-2026-53435 (CVSS 8.8) in #Jenkins actively exploited via config.xml deserialization for remote code execution. Exploitation observed against honeypots since early today. Jenkins environments expose CI/CD credentials, pipeline configs, tokens, and application secrets. https://t.co/1sRe56WPXG

🚨 CVE-2026-53435, a high severity (CVSS 8.8) deserialization vulnerability in Jenkins is now seeing active exploitation as per @DefusedCyber.

Scan your infrastructure: https://t.co/Bow5Vo1QGD

Patches are available per the vendor advisory: https://t.co/JgVytDoXfJ https://t.co/VodN95SUob

🚨 Attackers are actively exploiting critical Jenkins flaw CVE-2026-53435 (CVSS 9.0). The bug can lead to full RCE on vulnerable controllers, and real-world attack attempts are already being detected. If you run Jenkins, patch immediately.

#Jenkins 

https://t.co/rnH2MLSigB

Jenkins RCE Vulnerability CVE-2026-53435 Now Exploited - https://t.co/gDA7LFrR0z

‼️ #Jenkins: rilevato sfruttamento attivo in rete della CVE-2026-53435

Rischio: 🔴

⚠️ Ove non provveduto, si raccomanda l’aggiornamento tempestivo del software interessato

👉 link al post principale: https://t.me/CSIRT_italia/3631

🚨 High - Arbitrary Type Deserialization Vulnerability Patched in Jenkins

A severe deserialization vulnerability (CVE-2026-53435) has been identified in Jenkins versions 2.567 and earlier (LTS 2.555.2 and earlier). Attackers can force Jenkins to deserialize arbitrary types from a manipulated config.xml submission, allowing them to intercept and handle subsequent HTTP requests.

👉 Impact: Enables full user impersonation, arbitrary file reads from the controller, and unauthorized execution of arbitrary code via the Jenkins Script Console | Upgrade to Jenkins 2.568 or LTS 2.555.3 or later immediately to eliminate this risk

🚨 Jenkins Under Siege: Critical #CVE-2026-53435 Actively Exploited in Real-Time Attacks as Global Infrastructure Faces Silent Takeover Attempts + Video

-Fact Checker: ✅: 2 ❌: 3 || 2/5 → Score: 40% 🤏🏻
-Prediction: 📈 2 Positive | 📉 1 Negative

https://t.co/Z8ORSQbBEw

🚨 Jenkins CVE-2026-53435 CVSS 8.8 HIGH

Deserialization flaw lets low-privileged attackers abuse config.xml to impersonate users, hit Script Console RCE, or read controller files.

Patch: 2.568 / LTS 2.555.3

https://t.co/Z43qYRdP46

#Jenkins

A Jenkins RCE vulnerability (CVE-2026-53435) is under active exploitation. Honeypots are seeing attacks now, so patch your Jenkins controller fast.

#Jenkins #CVE202653435 #RCE #ActiveExploitation #InfoSec
https://t.co/ZWwyYi3X4n https://t.co/cVLWpeIeJS

🚨 CVE-2026-53435 (Jenkins config.xml deserialization / potential RCE) is now under active exploitation

We're seeing in-the-wild attempts hitting our decoys since early this morning

Track Jenkins exploitation live 👉https://t.co/GXFaqggV8a https://t.co/BPwVGlTupi

Группа ShinyHunters атаковала более 100 организаций с помощью уязвимости Oracle PeopleSoft

Группа ShinyHunters взломала более 100 организаций, используя уязвимость нулевого дня в Oracle PeopleSoft. Они похитили 40 ГБ личных данных и записей оплаты, принадлежащих сотням тысяч студентов Университета Ноттингема. Группа опубликовала украденные данные на своем сайте утечек. Уязвимость CVE-2026-35273 имеет рейтинг 9,8 по шкале CVSS и позволяет удаленным, неавторизованным атакам компрометировать PeopleSoft Enterprise PeopleTools. Oracle выпустила предупреждение о безопасности, но пока неясно, выпустила ли она патч для исправления уязвимости.

#security #vulns #foss #linux

OpenNews

Interesting situation unfolding in the cybercrime space.

ShinyHunters is claiming responsibility for a breach of the Council of Europe, alleging that it exfiltrated more than 297 GB of data spread across roughly 429,000 files.

According to the threat actor, the dataset includes HR and payroll records, personnel files, CVs, and over 409,000 payslips tied to more than 10,000 employees. The group also claims the data contains highly sensitive information such as banking records, tax records, salary information, and medical records.

One technical detail that stood out is the alleged attack vector. A spokesperson for ShinyHunters reportedly told The Register that the intrusion involved exploitation of CVE-2026-35273, an Oracle PeopleSoft vulnerability that can allow remote code execution without authentication.

The important caveat: none of these claims have been independently verified so far.

That puts defenders in an interesting position. On one hand, ShinyHunters has a track record of high-profile extortion and data leak operations. On the other, security professionals know that threat actor claims aren't always accurate and should be treated carefully until evidence emerges.

Either way, the story raises broader questions about enterprise HR systems, patch management, and how organizations should respond when a threat actor publicly claims a major breach before official confirmation is available.

Full breakdown:  
[https://www.technadu.com/shinyhunters-claims-297-gb-council-of-europe-data-breach/629382/](https://www.technadu.com/shinyhunters-claims-297-gb-council-of-europe-data-breach/629382/)

When groups like ShinyHunters make large breach claims before verification, do you assume credibility based on past activity, or wait for independent confirmation before treating it as a serious incident?



#ShinyHunters Exploits #Oracle #PeopleSoft #ZeroDay (CVE-2026-35273) to Breach #Universities https://t.co/JiPo7cNdwp

A crew broke into PeopleSoft with a 9.8 bug and stole data with no ransomware at all. ShinyHunters don't need to encrypt you. They steal and extort. Your backups won't save you from a leak. Access control and detection will. CVE-2026-35273. Patch it.

Oracle PeopleSoft CVE-2026-35273 was exploited as a zero-day in data-theft activity. Restrict management endpoints and inspect PSEMHUB access. https://t.co/q3gqaajPe0

If you're hunting ShinyHunters post-exploitation (CVE-2026-35273), look for PSEMHUB auth bypass followed by MeshCentral staging and internal recon targeting psappsrv.cfg.

cc @vxunderground https://t.co/KHOQ284ny3

ShinyHunters posted the Council of Europe to their Tor leak site Sunday. 297 GB. 429,000 files. 15 years of payslips for 10,000+ staff, 14,000 CVs, medical records, bank account data, tax info, all pulled out of the CoE’s HR and payroll systems.

The entry point: CVE-2026-35273, a CVSS 9.8 zero-day in Oracle PeopleSoft’s Environment Management component. Google and Mandiant tracked the exploitation from May 27 through June 9. Oracle’s advisory didn’t land until June 10, meaning ShinyHunters had roughly 2 weeks of clean access before Oracle said anything publicly.

100+ organizations hit across this campaign. University of Nottingham went first. 68% of the vulnerable endpoints Google flagged were in higher education. (If your org runs PeopleSoft and this is the first you’re hearing about CVE-2026-35273: go patch before finishing this email.)

The ransom deadline is today, June 16. The CoE issued the standard “we’re currently investigating” non-statement. Oracle still hasn’t confirmed the patch is live.

ShinyHunters has been running hot. March 2026: claimed the European Commission, 350 GB. May 2026: Canvas/Instructure “reached an agreement” (translation: paid). Ralph Lauren, Madison Square Garden Sports, JCPenney, dozens of Snowflake customers. Their playbook: find a flaw, write a fanout script, work through every connected host they can reach.

One zero-day, 100+ victims, 2 weeks of undetected exploitation. Oracle’s advisory came 2 weeks late. Audit your detection coverage on Oracle products, and don’t wait for the bulletin.

1/4 CISA just pushed CVE-2026-35273 (Oracle PeopleSoft Enterprise PeopleTools) into the KEV. While the timeline is fixated on edge VPN bugs, ShinyHunters has been quietly weaponizing this missing authentication flaw to rip through ERP databases.

Detection Signature:
PAN-OS Threat ID 510019 — detects CVE-2026-0300 exploitation attempts
Note: Requires PAN-OS 11.1 or later. Organizations running 10.2 branches have no native detection signature and must rely entirely on network-level access controls.

Sources
Palo Alto Networks Security Advisory: CVE-2026-0300
Unit 42 Threat Brief: Exploitation of PAN-OS Captive Portal Zero-Day
Wiz Blog: Critical Buffer Overflow Vulnerability in PAN-OS Exploited in-the-Wild
The Hacker News: Palo Alto PAN-OS Flaw Under Active…

The Firewall That Opened the Door: CVE-2026-0300 PAN-OS Captive Portal Zero-Day Under Active State-Sponsored Exploitation.

CVE-2026-0300 is an unauthenticated remote code execution (RCE) zero-day in Palo Alto Networks PAN-OS, scoring CVSS 9.3, rooted in a buffer overflow…

Unpopular opinion:

The cybersecurity industry is selling you dashboards.

A critical unauthenticated remote code execution zero-day in Palo Alto Networks PAN-OS — CVE-2026-0300, CVSS 9.3 — is being actively exploited in the wild by a cluster of likely state-sponsored…

CVE-2026-0300 is a classic out-of-bounds write (buffer overflow) in the Captive Portal service. By sending a specially crafted packet sequence, an unauthenticated attacker can corrupt heap or stack memory adjacent to the target buffer. The vulnerability is…

CVE-2026-0300: The PAN-OS Captive Portal Zero-Day That Handed State Actors the Keys to the Kingdom

A critical, unpatched buffer overflow in the Palo Alto Networks PAN-OS User-ID Authentication Portal Captive Portal allows an unauthenticated attacker to execute arbitrary…

0300 CVSS — CVE-2026-0300: The PAN-OS Captive Portal Zero-Day That Handed State Actors the Keys to the Kingdom.

A critical, unpatched buffer overflow in the Palo Alto Networks PAN-OS User-ID Authentication Portal Captive Portal allows an unauthenticated attacker to…

Unpopular opinion:

The cybersecurity industry is selling you dashboards.

Palo Alto Networks has confirmed active exploitation of CVE-2026-0300, a CVSS 9.3 Critical buffer overflow in the User-ID™ Authentication Portal (Captive Portal) component of PAN-OS.

Unpopular opinion:

The cybersecurity industry is selling you dashboards.

Root on the Perimeter: CVE-2026-0300 — The PAN-OS Captive Portal Zero-Day Being Exploited by State Actors Right Now

CISA's new CI Fortify initiative and recent state-actor campaigns (Palo Alto CVE-2026-0300, MuddyWater APT masquerades, UAT-8302) signal a seismic shift in federal doctrine: prevention-first defense is dead. Nation-state actors are already inside critical infrastructure,…

RAUDONA — stipriai suaktyvėjo, atakos vyksta dabar

* **Fortinet FortiSandbox**: trys CVE aktyviai išnaudojamos per pastarąsias 24 val. (CVE-2026-39813, CVSS 9.1, be ankstesnės išnaudojimo istorijos; CVE-2026-39808; CVE-2026-25089). Veiksmas: skubus pataisymas arba izoliavimas.
* **CISA**: aktyviai išnaudojama LiteSpeed cPanel papildinio spraga (CVE-2026-54420); JAV federalinėms agentūroms — 3 dienos.
* **Ghostwriter** phishing banga prieš Gmail (valstybės remiama; renka prisijungimus ir 2FA kodus).
* **ClickFix** krautuvų protrūkis (GULoader per EtherHiding; BabaDeda, Lorem Ipsum, Potemkin).
* **SprySOCKS** (su Kinija siejamas) backdoor išplito į Windows, atakuoja vyriausybines organizacijas (≥4 šalys).
* **Atomic** tiekimo grandinės ataka prieš Arch Linux AUR (1 500 kenkėjiškų paketų; registracijos sustabdytos).

GELTONA — įvyko šią savaitę

* Duomenų nutekėjimai/vagystės: Novo Nordisk (tariama 1,3 TB), iRhythm (patvirtinta), Inter Mutuelles Habitat (105 000+, FR), Autosur (63 000+, FR), Cal Water (tiriama).
* M365 Device Code phishing; GhostTree (Defender apėjimas); 15 kenkėjiškų JetBrains papildinių; Steam Workshop kenkėjas; Rokarolla Android trojanas; OnionDrop/LegionLoader; UNC3753 prieš advokatų kontoras; Google Vertex AI SDK spraga (in-the-wild nepastebėta).

ŽALIA — reguliavimo ir įstatymų pasikeitimai

* JAV: NSPM-12 memorandumas dėl nacionalinių saugumo sistemų (NSS) kibernetinio saugumo valdymo; atkuriama CNSS.
* JK: privalomas amžiaus/ID arba veido tikrinimas registruojant socialinių tinklų paskyras (draudimas <16 m., nuo 2027 pavasario).
* Indija: laikinas Telegram draudimas iki 2026-06-22.
* JAV politika: raginimai sušvelninti Anthropic AI modelių naudojimo apribojimus užsieniečiams.

CISA KEV: CVE-2026-54420 (CVSS 8.5) in LiteSpeed cPanel plugin allows unauthenticated root escalation on shared hosts — all co-tenant data at risk. Federal deadline: June 18. https://t.co/6oCqcgttCx #CyberSecurity #VulnerabilityManagement https://t.co/wMJYCJxah5

CISA Orders Agencies to Patch CVE-2026-54420 in LiteSpeed #cve202654420 #litespeedcpanelplugin #cisakev https://t.co/TRQfikgDfD

Attackers exploited CVE-2026-54420 to escalate from FTP access to root privileges on shared hosting servers. TRC analysis shows symlink mishandling in LiteSpeed cPanel plugin enabled lateral movement across tenant boundaries. Runtime segmentation helps contain such privilege escalation chains. #ZeroDay #CloudSecurity

🔗 Full breakdown: https://t.co/QKNouyhKW4

TRC analysis shows attackers exploiting CVE-2026-54420 in LiteSpeed cPanel to escalate privileges from web shell access to root on shared hosting servers. The symlink mishandling vulnerability enables lateral movement across user accounts within the hosting environment. Runtime segmentation helps contain such post-compromise pivoting activities. #CloudSecurity

:link: Full breakdown: https://t.co/A1rBFA5kOO

🔐 KEV alert: CISA added CVE-2026-54420 in LiteSpeed cPanel Plugin to KEV. LiteSpeed says versions before cPanel plugin 2.4.8 are actively exploited and can allow privilege escalation to root on CloudLinux/CageFS shared hosting. #KEV https://t.co/kfGRXkgrfg

CVE-2026-54420 LiteSpeed cPanel Plugin Symlink Privilege Escalation POC -- https://t.co/1LSradSp0N

CVE-2026-54420 (CVSS 8.5) in #LiteSpeed cPanel Plugin added to CISA KEV. Flaw in shared hosting allows FTP or web shell access to escalate to root on CloudLinux/CageFS servers. Federal remediation deadline: June 18, 2026. https://t.co/xuRaSflAh9

🔐 Cybersecurity Threat Briefing | June 16, 2026

The threat landscape is heating up this week. Here is what you need to know:

🔴 Microsoft Patch Tuesday — A record 200+ vulnerabilities patched, including 3 zero-days. The "HTTP/2 Bomb" and a BitLocker bypass are among the critical fixes. If you haven't deployed updates yet, stop what you're doing.

🔴 Splunk Enterprise RCE (CVE-2026-20253, CVSS 9.8) — Unauthenticated remote code execution is now possible on unpatched systems. Exploit details are already public.

🔴 CISA KEV Update — Two new actively exploited vulnerabilities added: Cisco SD-WAN (CVE-2026-20262) and LiteSpeed cPanel (CVE-2026-54420). Prioritize remediation now.

Awareness is your first line of defense. At CoreRecon, we keep you one step ahead.

👉 Are your systems patched?

#CoreRecon #CyberSecurity #InfoSec #PatchTuesday #ThreatIntelligence #ZeroDay #Texas #compliance

#LiteSpeed: rilevato sfruttamento attivo in rete della CVE-2026-54420

Rischio: 🔴

Tipologia:
🔸 Privilege Escalation


🔗https://www.acn.gov.it/portale/w/rilevato-sfruttamento-di-vulnerabilita-in-prodotto-litespeed-cpanel-plugin

🔄Aggiornamenti disponibili🔄

Hackers are already using it.

CVE-2026-20262 hits Cisco SD-WAN Manager, a zero day:

- Root privilege escalation, no user action needed
- Active exploitation in the wild
- Patch is out, update vManage this week

https://t.co/YPKc7n2LjS

Cisco Catalyst SD-WAN Manager Vulnerability (CVE-2026-20262): Attackers Could Gain Root Access Through File Write Flaw https://t.co/g6CadzXEuo

Critical arbitrary file write vuln (CVE-2026-20262) in Cisco Catalyst SD-WAN Manager allows root access &amp; is actively exploited. Update now!
#cisco #sdwan #vulnerability #zeroday

Some increased actor activities are shown targeting Cisco Catalyst SD-WAN Manager (CVE-2026-20262) https://t.co/VwZd4kMoZw

🚨 CVE-2026-20262: Cisco SD-WAN Manager flaw allows web shell uploads, leading to orchestrator RCE and complete network fabric compromise.

https://t.co/zSNtyQKFDl

#CVE202620262 #Cisco #SDWAN #RCE #Cybersecurity https://t.co/4NHAiHjPQX

CISA adds CVE-2026-20262 to KEV — unauthenticated SSRF in Cisco SD-WAN Manager, 8th exploited SD-WAN flaw of 2026. Federal patch deadline: June 29. Fix: 20.12.4 / 21.1.1. https://t.co/J8iXixvK4U #CyberSecurity #Cisco https://t.co/SCIhmE3Low

Sources:

SpaceX acquires Cursor maker Anysphere for $60B
https://t.co/MgQeWwswgF
India temporarily blocks Telegram nationwide
https://t.co/8jRjLBnuWI

Databricks acquires Panther Labs
https://t.co/hN6dMjGyIp
SoftBank launches OpenAI-powered cybersecurity service
https://t.co/NzFLDgHU6Q

Cisco SD-WAN vulnerability under active exploitation (CVE-2026-20262)
https://t.co/Dng9UmYS2i
https://t.co/pY6clCR5Rk
Palo Alto Unit 42 discloses Vertex AI attack path research
https://t.co/IhhSkHOdTR

Snap launches new Specs AR glasses
https://t.co/dnkUdnI8Dw
EssilorLuxottica and Applied Materials partner on smart glasses and AR technology
https://t.co/2wqRMqPAhe

Regulatory scrutiny dropped for Tata-operated Apple supplier facility in India
https://t.co/2wqRMqPAhe
Sarvam AI funding and unicorn milestone
https://t.co/npWdl3EPKT
https://t.co/B6u3aDiA8P
Oracle expands AI platform model support
https://t.co/VivXGIRePQ

Microsoft Work IQ APIs become generally available
https://t.co/Qp5MnFODQV
One warning: several of these links (especially #7–#12) are company homepages, blog hubs, or section pages rather than specific article URLs. For a publication-quality roundup, I'd re-run a fresh search and collect the exact announcement URLs, company blog posts, X posts, GitHub releases, and Reuters articles for each story before publishing.

TRC analysis shows attackers exploiting CVE-2026-20262 in Cisco SD-WAN Manager to achieve arbitrary file write, then escalating to root access for lateral movement across networks. Runtime segmentation helps contain post-compromise activity when management infrastructure is breached. #ZeroTrust

🔗 Full breakdown: https://t.co/3BH67wNxJ6

Active exploitation of SD-WAN infrastructure should be treated as an urgent network security event. CVE-2026-20262 in Cisco Catalyst SD-WAN Manager, allowing arbitrary file writes, highlights how attackers can target centralized network management systems to gain persistence, alter configurations, or pivot deeper into connected environments.

What organizations should prioritize now:

- Identify all Cisco Catalyst SD-WAN Manager instances and confirm affected versions
- Apply Cisco patches or mitigations immediately and verify successful deployment
- Restrict management access with VPN/Zero Trust, IP allowlisting, and MFA where supported
- Review logs for suspicious file writes, unexpected configuration changes, new accounts, and unusual admin activity
- Rotate credentials, API keys, and automation tokens if compromise is suspected
- Monitor for lateral movement, abnormal traffic patterns, and unauthorized access across connected sites

𝗩𝗶𝘀𝘁𝗲𝗺 𝗘𝗹𝗲𝘃𝗮𝘁𝗲 𝗽𝗼𝘄𝗲𝗿𝗲𝗱 𝗯𝘆 𝗩𝗶𝘀𝘁𝗲𝗺𝗦𝗲𝗰𝘂𝗿𝗲𝗣𝗿𝗼 helps organizations validate exposure, prioritize remediation, and strengthen network security with vCISO-led strategy, continuous monitoring, and measurable risk reduction.

Contact: sales@vistem.com | https://t.co/lWgYuLfQq5  

#Cybersecurity #Cisco #SDWAN #CatalystSDWAN #CVE #VulnerabilityManagement #NetworkSecurity #ThreatIntel #IncidentResponse #ZeroTrust #CyberResilience #VistemElevate #VistemSecurePro #VistemSolutions #SecurityCompliance
https://t.co/0pIl5QaPfF

CVE-2026-20262 is a vulnerability in the UI of Cisco Catalyst SD-WAN Manager that can potentially allow an authenticated attacker to create or overwrite any file on the filesystem of a victim. This can then lead to the attacker being able to elevate themselves to root, provided the attacker already has credentials with write access.

This is the 8th flaw found in the Cisco SD-WAN this year alone, with some of these flaws being attributed to APT actor 'UAT-8616'. UAT-8616 has been active since 2023 and has been known to target Critical Infrastructure sectors.

#cybersecurity #UAT8616 #Cisco #CVE 

https://t.co/yMD33NFGfK

What to patch first, tied to this week's active groups:
Fortinet CVE-2024-21762, CVE-2024-55591 (Qilin) SimpleHelp CVE-2024-57727 (DragonForce) VMware ESXi CVE-2024-37085 (Akira) Citrix CVE-2023-3519 (INC Ransom)
Full report: https://t.co/DpsbHsXabc
#ransomware #threatintel #CTEM

The Gentlemen ransomware hit 483 victims across 66 countries in under a year using infostealer credentials, AI tools, and a 90% affiliate cut. Internal chat leaks reveal their complete playbook.

Key findings:
• Initial access via FortiOS CVE-2024-55591, ZeroLogon, PetitPotam, and stolen OWA credentials from infostealer logs
• 90% affiliate revenue split (vs typical 70-80%) targeting Tier 1-3 countries and Latin America over US 🇺🇸 targets
• AI-assisted operations using "abliterated" Qwen models for coding and analyzing stolen data
• Cross-referenced victims had live corporate logins in https://t.co/cW5tArZhrz stealer index before appearing on leak sites
• Copied Black Basta's leaked playbook as training manual rather than developing original TTPs

Immediate actions: Treat infostealer infections as breaches requiring session revocation. Deploy hardware-backed auth to prevent cookie replay attacks that bypass MFA.

#DFIR_Radar

The Gentlemen ransomware group is brute forcing ~1,000 Fortinet VPNs and exploiting CVE-2024-55591 authentication bypass, using custom G-BOT C2; tighten VPN credentials, patch CVE-2024-55591, hunt for related outbound C2 traffic.
https://t.co/jmw7FohUaa

#ParsedReport #CompletenessMedium
03-06-2026

From Conti to The Gentlemen: tooling evolved, gaps didn't.

https://www.vectra.ai/blog/from-conti-to-the-gentlemen-tooling-evolved-gaps-didnt

Report completeness: Medium

Actors/Campaigns:
Gentlemen_ransomware (motivation: cyber_criminal, financially_motivated)
Contileaks
Zeta88
Protagor
0ktapus
Volt_typhoon

Threats:
Conti
Blackbasta
Lockbit
Qilin_ransomware
Pikabot
Ryuk
Cobalt_strike_tool
G-bot
Phemedrone
Dumpbrowsersecrets_tool
Lumma_stealer
Anydesk_tool
Rclone_tool
Megacmd_tool
Icedid
Devman
Darkside

Victims:
Banking, Health care, Energy, Businesses, Individuals, Cloud environments, Germany, Ireland, Russian federation

Industry:
Financial, Government, Healthcare

Geo:
Ukraine, Russian, Ireland, Germany, Moscow, Ukrainian, French

CVEs:
CVE-2025-33073  [Vulners]
    CVSS V3.1: 8.8, 
    Vulners: Exploitation: True
    X-Force: Risk: Unknown
    X-Force: Patch: Unknown
    Soft:
    - microsoft windows_10_1507 (<10.0.10240.21034)
    - microsoft windows_10_1607 (<10.0.14393.8148)
    - microsoft windows_10_1809 (<10.0.17763.7434)
    - microsoft windows_10_21h2 (<10.0.19044.5965)
    - microsoft windows_10_22h2 (<10.0.19045.5965)
    have more...
CVE-2024-3400  [Vulners]
    CVSS V3.1: 10.0, 
    Vulners: Exploitation: True
    X-Force: Risk: Unknown
    X-Force: Patch: Unknown
    Soft:
    - paloaltonetworks pan-os (10.2.0, 10.2.1, 10.2.2, 10.2.3, 10.2.4)

CVE-2025-32433  [Vulners]
    CVSS V3.1: 10.0, 
    Vulners: Exploitation: True
    X-Force: Risk: Unknown
    X-Force: Patch: Unknown
    Soft:
    - erlang erlang\/otp (<25.3.2.20, <26.2.5.11, <27.3.3)

CVE-2020-5135  [Vulners]
    CVSS V3.1: 9.8, 
    Vulners: Exploitation: True
    X-Force: Risk: Unknown
    X-Force: Patch: Unknown
    Soft:
    - sonicwall sonicos (le6.0.5.3, le6.5.1.11, le6.5.4.7, 7.0.0.0)
    - sonicwall sonicosv (le6.5.4.4)

CVE-2024-55591  [Vulners]
    CVSS V3.1: 9.8, 
    Vulners: Exploitation: True
    X-Force: Risk: Unknown
    X-Force: Patch: Unknown
    Soft:
    - fortinet fortiproxy (<7.0.20, <7.2.13)
    - fortinet fortios (<7.0.17)


ChatGPT TTPs:
do not use without manual check
T1003.003, T1071.004, T1078, T1090, T1095, T1105, T1106, T1110.001, T1190, T1219, have more...

IOCs:
File: 4
IP: 1

Soft:
Jabber, Twitter, Telegram, ChatGPT, , Hugging Face, ESXi, Hyper-V, PAN-OS, Confluence, have more...

Crypto:
bitcoin

Algorithms:
rc4

Languages:
rust, python

Platforms:
arm, intel

Here’s a quick breakdown of the 10 most interesting vulnerabilities trending today:

**1. [CVE-2025-49113](https://nvd.nist.gov/vuln/detail/CVE-2025-49113)**

- 📝 Roundcube Webmail before 1.5.10 and 1.6.x before 1.6.11 allows remote code execution by authenticated users because the _from parameter in a URL is not validated in program/actions/settings/upload.php, leading to PHP Object Deserialization.

- 📅 **Published:** 02/06/2025
- 📈 **CVSS:** 9.9
- 🛡️ **CISA KEV:** True
- 🧭 **Vector:** CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
- 📣 **Mentions:** 108
- ⚠️ **Priority:** 1+
- 📝 **Analysis:** Authenticated users can perform remote code execution due to improper validation in program/actions/settings/upload.php of Roundcube Webmail versions below 1.5.11 and 1.6.11. This vulnerability, while high in CVSS, has shown low exploit activity in the wild, resulting in a priority 2 status.


---

**2. [CVE-2024-30088](https://nvd.nist.gov/vuln/detail/CVE-2024-30088)**

- 📝 Windows Kernel Elevation of Privilege Vulnerability

- 📅 **Published:** 11/06/2024
- 📈 **CVSS:** 7
- 🛡️ **CISA KEV:** True
- 🧭 **Vector:** CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
- 📣 **Mentions:** 7
- ⚠️ **Priority:** 1+
- 📝 **Analysis:** A Windows Kernel Elevation of Privilege Vulnerability has been identified, confirmed as exploited in the wild due to a CISA KEV notice. This vulnerability allows for remote code execution with a CVSS score of 7, making it a priority 1+ issue requiring immediate attention and remediation.


---

**3. [CVE-2025-8088](https://nvd.nist.gov/vuln/detail/CVE-2025-8088)**

- 📝 A path traversal vulnerability affecting the Windows version of WinRAR allows the attackers to execute arbitrary code by crafting malicious archive files. This vulnerability was exploited in the wild and was discovered byAnton Cherepanov, Peter Koinr, and Peter Strek      from ESET.

- 📅 **Published:** 08/08/2025
- 📈 **CVSS:** 8.4
- 🛡️ **CISA KEV:** True
- 🧭 **Vector:** CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
- 📣 **Mentions:** 23
- ⚠️ **Priority:** 1+
- 📝 **Analysis:** A path traversal vulnerability in Windows WinRAR allows attackers to execute arbitrary code via malicious archive files. This vulnerability has been exploited in the wild and was discovered by ESET researchers. Given its high CVSS score and prior activity, it is a priority 2 issue.


---

**4. [CVE-2026-46529](https://nvd.nist.gov/vuln/detail/CVE-2026-46529)**

- 📝 n/a

- 📈 **CVSS:** 0
- 🧭 **Vector:** n/a
- ⚠️ **Priority:** 2
- 📝 **Analysis:** A critical command execution vulnerability exists in a web application's admin panel (API module). Remote attackers can exploit this due to improper input validation. While there's no confirmed in-the-wild activity (CISA KEV), the high CVSS score indicates significant impact and easy exploitability, making it a priority 1 vulnerability. The versions affected are those explicitly mentioned in the description.


---

**5. [CVE-2025-46308](https://nvd.nist.gov/vuln/detail/CVE-2025-46308)**

- 📝 An authorization issue was addressed with improved state management. This issue is fixed in iOS 18.4 and iPadOS 18.4, macOS Sequoia 15.4. An app may be able to leak sensitive user information.

- 📅 **Published:** 11/06/2026
- 📈 **CVSS:** 5.3
- 🧭 **Vector:** CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- ⚠️ **Priority:** 4
- 📝 **Analysis:** App may leak sensitive user information due to an authorization issue in iOS 18.4 and iPadOS 18.4, macOS Sequoia 15.4. While there's no known exploit activity, the low CVSS score and current priority rating of 4 indicate a low risk at this time.


---

**6. [CVE-2025-3000](https://nvd.nist.gov/vuln/detail/CVE-2025-3000)**

- 📝 A vulnerability classified as critical has been found in PyTorch 2.6.0. This affects the function torch.jit.script. The manipulation leads to memory corruption. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used.

- 📅 **Published:** 31/03/2025
- 📈 **CVSS:** 4.8
- 🧭 **Vector:** CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
- 📣 **Mentions:** 2
- ⚠️ **Priority:** 4
- 📝 **Analysis:** Critical memory corruption vulnerability found in PyTorch 2.6.0 (torch.jit.script). Exploitable locally, publicly disclosed exploit, priority level 4 (low CVSS & low EPSS).


---

**7. [CVE-2026-45447](https://nvd.nist.gov/vuln/detail/CVE-2026-45447)**

- 📝 Issue summary: A specially crafted PKCS#7 or S/MIME signed message could trigger a use-after-free during PKCS#7 signature verification. Impact summary: A use-after-free may result in process crashes, heap corruption, or potentially remote code execution. When processing a PKCS#7 or S/MIME signed message, if the SignedData digestAlgorithms field is present as an empty ASN.1 SET, OpenSSL may incorrectly free a caller-owned BIO during PKCS7_verify(). A subsequent use of the BIO by the calling application results in a use-after-free condition. In the common case this occurs when the application later calls BIO_free() on the BIO originally passed to PKCS7_verify(). Depending on allocator behavior and application-specific BIO usage patterns, this may result in a crash or other memory corruption. In some application contexts this may potentially be exploitable for remote code execution. Applications that process PKCS#7 or S/MIME signed messages using OpenSSL PKCS#7 APIs may be affected. Applications using the CMS APIs for this processing are not affected. The FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this issue, as the affected code is outside the OpenSSL FIPS module boundary.

- 📅 **Published:** 09/06/2026
- 📈 **CVSS:** 8.8
- 🧭 **Vector:** CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- 📣 **Mentions:** 22
- ⚠️ **Priority:** 4
- 📝 **Analysis:** A use-after-free vulnerability in OpenSSL PKCS#7 and S/MIME signature verification allows for potential remote code execution when processing an empty ASN.1 SET in the SignedData digestAlgorithms field. Affected are applications using the PKCS#7 APIs, while those using CMS APIs are not impacted. The FIPS modules in versions 4.0, 3.6, 3.5, 3.4, and 3.0 are unaffected. This is a priority 4 vulnerability due to low exploitation potential so far.


---

**8. [CVE-2026-11557](https://nvd.nist.gov/vuln/detail/CVE-2026-11557)**

- 📝 A weakness has been identified in Tenda F451 1.0.0.7/1.0.0.9. The affected element is the function fromNatlimit of the file /goform/Natlimit of the component Web Management Interface. Executing a manipulation of the argument page can lead to stack-based buffer overflow. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks.

- 📅 **Published:** 08/06/2026
- 📈 **CVSS:** 8.7
- 🧭 **Vector:** CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
- 📣 **Mentions:** 1
- ⚠️ **Priority:** 2
- 📝 **Analysis:** A stack-based buffer overflow vulnerability in Tenda F451 1.0.0.7/1.0.0.9 (Web Management Interface /goform/Natlimit) enables remote attacks, exploit code is publicly available, and in-the-wild activity has been observed. This warrants a priority 2 response due to high CVSS but low Exploitability Scoring System (EPSS) score.


---

**9. [CVE-2026-11556](https://nvd.nist.gov/vuln/detail/CVE-2026-11556)**

- 📝 A security flaw has been discovered in Tenda F451 1.0.0.7/1.0.0.9. Impacted is the function formWriteFacMac of the file /goform/WriteFacMac of the component Web Management Interface. Performing a manipulation of the argument mac results in os command injection. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks.

- 📅 **Published:** 08/06/2026
- 📈 **CVSS:** 8.7
- 🧭 **Vector:** CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
- 📣 **Mentions:** 1
- ⚠️ **Priority:** 2
- 📝 **Analysis:** A remote code injection vulnerability exists in the Tenda F451 1.0.0.7/1.0.0.9 Web Management Interface due to os command injection in formWriteFacMac. The exploit is public, and it's been observed in-the-wild. Given the high CVSS score and known exploitation, this is a priority 2 vulnerability.


---

**10. [CVE-2026-35273](https://nvd.nist.gov/vuln/detail/CVE-2026-35273)**

- 📝 Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Updates Environment Management). Supported versions that are affected are 8.61 and 8.62. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks of this vulnerability can result in takeover of PeopleSoft Enterprise PeopleTools. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

- 📅 **Published:** 11/06/2026
- 📈 **CVSS:** 9.8
- 🛡️ **CISA KEV:** True
- 🧭 **Vector:** CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- 📣 **Mentions:** 111
- ⚠️ **Priority:** 1+
- 📝 **Analysis:** Unauthenticated network attacker can compromise PeopleSoft Enterprise PeopleTools via HTTP in versions 8.61 and 8.62, resulting in complete takeover. This vulnerability has a high impact on confidentiality, integrity, and availability, with a CVSS 3.1 Base Score of 9.8. Confirmed exploited, this is a priority 1+ issue.


---

Let us know if you're tracking any of these or if you find any issues with the provided details.

@luckyhacker43 🛡️ Dragon-Lady/Linux-supply-chain-guard updated with the CVE-2025-49113 and checks for 

-vulnerable installed versions below 1.5.10 or 1.6.11
-local PoC/exploit-runner artifacts referencing CVE-2025-49113
-Roundcube upload/session code-path review terms

https://t.co/7LnSNPjfAF

Critical RCE in Roundcube 🤯🔥

Your inbox could be the attack vector.

CVE-2025-49113 allows Remote Code Execution on vulnerable Roundcube instances, putting countless email servers at risk. 🚨

👨‍💻 AirCorridor / Hackers-Arise
🔗 https://t.co/R8St5Ly3ml

#CyberSecurity #RCE https://t.co/pebfwoV57K

Roundcube CVE-2025-49113: Authenticated PHP Object Deserialization to RCE in Open-Source Webmail

Attribution. This is an original English rewrite based on the article “Critical Remote Code Execution (RCE) in Roundcube, CVE-2025-49113: Your Email is Not Safe!” by AirCorridor on Hackers Arise (published 25 July 2025). The technical analysis, walkthrough and screenshots are the original author’s work; this page paraphrases the prose in our own words, preserves every…

https://core-jmp.org/2026/05/roundcube-cve-2025-49113-authenticated-rce-php-deserialization/

Your email server might be vulnerable! CVE-2025-49113 allows attackers to compromise servers without authentication.

https://t.co/t6mRtvwXrh
@three_cube @DI0256 @IamSmouk @co11ateral https://t.co/a9gyDen9o4

I just completed Roundcube: CVE-2025-49113 room on TryHackMe! Exploit CVE-2025-49113 in a lab environment. https://t.co/hEntzj5esa #tryhackme via @tryhackme 
#tryhackme #learning #consistency

#ParsedReport #CompletenessHigh
09-04-2026

The alarm clock that won't go off: How CapFix is attacking Russian organizations

https://ptsecurity.com/research/pt-esc-threat-intelligence/an-alarm-you-can-t-ignore-how-capfix-attacks-russian-organizations/

Report completeness: High

Actors/Campaigns:
Capfix (motivation: financially_motivated)

Threats:
Capdoor
Sectop_rat
Clickfix_technique
Dll_sideloading_technique
Supply_chain_technique
Ghostpulse
Hijackloader
Process_hollowing_technique
Spear-phishing_technique
Junk_code_technique
Process_injection_technique
Asyncrat
Trojan.win32.generic.a
Trojan.win32.inject.a
Dropper.win32.generic.i

Victims:
Russian organizations, Industrial sector, Aircraft industry, Education sector

Industry:
Government

Geo:
France, Usa, Russian federation, Russian, Mexico, Holland

CVEs:
CVE-2025-4911  [Vulners]
    CVSS V3.1: 7.3, 
    Vulners: Exploitation: Unknown
    X-Force: Risk: Unknown
    X-Force: Patch: Unknown
    Soft:
    - phpgurukul zoo_management_system (2.1)

CVE-2025-49113  [Vulners]
    CVSS V3.1: 9.9, 
    Vulners: Exploitation: True
    X-Force: Risk: Unknown
    X-Force: Patch: Unknown
    Soft:
    - roundcube webmail (<1.5.10, <1.6.11)


TTPs:
Tactics: 9
Technics: 36

IOCs:
File: 19
Hash: 67
IP: 2
Command: 1
Path: 3
Registry: 1

Soft:
Roundcube, QILING, Windows Installer

Crypto:
bitcoin

Algorithms:
fowlernollv, sha1, md5, sha256, chacha20, murmur3

Functions:
MurmurHash3

Win API:
MsiInstallProductW, ShellExecuteW, VirtualAlloc, BCryptGenRandom, VirtualProtect, EnumSystemCodePagesW, CreateToolhelp32Snapshot, Process32FirstW, Process32NextW, GetCurrentProcessId, have more...

Languages:
powershell

@the_real_egg_f @ProtonMail I'm confused? A webmail client is better than the actual email service it self?! 

CVE-2025-68461
CVE-2025-49113
CVE-2025-68460
CVE-2024-42009
CVE-2024-37385
CVE-2023-5631
CVE-2021-44026
CVE-2020-12641
CVE-2017-16651

Firs0V

How CVE-2026-20253 Turns Splunk’s PostgreSQL Sidecar Into an Open Door
https://latesthackingnews.com/2026/06/17/splunk-cve-2026-20253-postgresql-sidecar-rce/
Nmap for Beginners: Understanding Scans Before You Run Them
https://latesthackingnews.com/2026/06/17/nmap-for-beginners-understanding-scans/

#CVE-2026-20253 Splunk Enterprise Unauthenticated Arbitrary File Operations / RCE. This vulnerability allows any network-reachable attacker to create or overwrite files on the server without credentials. 🎇

TRC analysis shows attackers can exploit CVE-2026-20253 to achieve unauthenticated RCE in Splunk Enterprise through PostgreSQL sidecar manipulation. The vulnerability enables lateral movement across monitored systems. Runtime segmentation can help limit blast radius when central monitoring infrastructure is compromised. #ZeroTrust #ThreatIntel

🔗 Full TRC analysis: https://t.co/gSvemxaKhY

The vulnerability, tracked as CVE-2026-20253, is rated 9.8 on the CVSS scoring system. https://t.co/0avUMyvNkC

Full KEVIntel telemetry and timeline for CVE-2026-20253:

https://t.co/9JNpYovN1t

🚨 CVE-2026-20253 is not yet in CISA KEV.

But KEVIntel honeypots are already seeing sustained attacker activity targeting Splunk Enterprise.

- 80 exploitation attempts
- 17 attacker IPs
- 8 countries

If Splunk is exposed in your environment, this should be on the radar.

Full telemetry in the comment reply.

A critical **unauthenticated Remote Code Execution (RCE)** vulnerability, **CVE-2026-20253** (CVSS 9.8), has been disclosed in **Splunk Enterprise**. This flaw poses a severe risk as it allows attackers to compromise the very platform many SOCs rely on for detection, potentially providing a critical foothold into an organization's infrastructure.

### Technical Breakdown
*   **Vulnerability Type:** Unauthenticated Remote Code Execution (RCE)
*   **CVE ID:** CVE-2026-20253
*   **CVSS Score:** 9.8 (Critical)
*   **Affected Product:** Splunk Enterprise
*   **Impact:** An attacker can execute arbitrary code on the Splunk Enterprise instance without requiring any authentication.

### Defense
Organizations should prioritize applying patches as soon as they are available from Splunk to mitigate this critical risk. Monitoring Splunk logs for unusual activity or unauthorized access attempts is also crucial.

**Source:** https://www.picussecurity.com/resource/blog/splunk-cve-2026-20253-unauthenticated-remote-code-execution-vulnerability-explained

14 new OPEN, 19 new PRO (14 + 5)

Splunk Enterprise PostgreSQL Sidecar Service (CVE-2026-20253), TA569, ZPHP, Landupdate808, Lumma Stealer, tdsshop, UNK_SmokeScreen

https://t.co/YYPsRt2lTr https://t.co/573IAJZGPa

Alex Hordijk

@briancheong Absolutely, Brian. With CVE-2023-3519 exposing vulnerabilities in misconfigured MCPs, adopting strict allowlists and sandboxes isn’t just a strategy; it's a survival imperative in tightening security paradigms. Every tool input could ind...

🔒 #CyberSecurity

CVE-2023-3519 &amp; CVE-2023-4966: Critical Citrix NetScaler Exploitation — Detecti…

"Defenders are currently facing a critical window of exposure. Recent intelligence from…"

🔗 https://t.co/BpxuJHswFI

#CyberSecurity #ThreatIntel #vulnerability #cve #patch

TRC analysis shows INC ransomware group exploited CVE-2023-3519 and spear-phishing to breach healthcare networks across Oceania. Attackers used credential dumping and NETSCAN.EXE for lateral movement before data exfiltration. Runtime segmentation could help contain such post-compromise pivoting. #Ransomware #HealthcareSecurity

🔗 Full TRC analysis: https://t.co/IBPsUbZfEY

Early 2026 reports show rising cloud compromises via misconfigured services and CVE-2023-3519, CVE-2023-2868, CVE-2021-43798 exploitation, expanding victim impact across sectors. #CloudSecurity
https://t.co/JtGxVn3keB

INC ransomware targets Windows, Linux, and ESXi. It exploits Citrix CVE-2023-3519 and Fortinet CVE-2023-48788 to get in. Full attack lifecycle and IOCs → https://t.co/YXZtbziokL 

#Ransomware #CyberSecurity #IncidentResponse #ThreatIntel #InfoSec #DFIR #RansomwareAttack https://t.co/2Ur8piJCz3

Microsoft публикува спешни актуализации за сигурност, с които отстранява активно експлоатирана уязвимост в **Exchange Server**, позволяваща извършване на **cross-site scripting (XSS)** атаки срещу потребители на **Outlook Web Access (OWA)**.

Уязвимостта, проследявана като **CVE-2026-42897**, е с висока степен на критичност и засяга:

* Exchange Server 2016;
* Exchange Server 2019;
* Exchange Server Subscription Edition (SE).

Според Microsoft, тя може да бъде експлоатирана дистанционно от атакуващи без необходимост от предварителна автентикация.

# Как работи атаката

Уязвимостта се задейства чрез изпращане на специално създаден имейл.

Ако потребителят отвори съобщението в **Outlook Web Access** и са изпълнени определени условия на взаимодействие, атакуващият може да постигне:

* изпълнение на произволен JavaScript код;
* манипулация на сесията на потребителя;
* кражба на идентификационни данни;
* фишинг атаки в рамките на легитимния интерфейс;
* потенциално поемане на контрол върху акаунта.

**Това превръща уязвимостта в типичен пример за атака чрез доверен интерфейс, при която потребителят остава в легитимна среда, но изпълнява злонамерен код без да го осъзнава.**

# Активна експлоатация преди публикуването на пача

Microsoft потвърди, че уязвимостта вече е била експлоатирана в реални атаки преди публикуването на финалната корекция.

Още през май компанията е въвела временни защитни мерки чрез **Exchange Emergency Mitigation Service (EEMS)**, които автоматично ограничават част от рисковите сценарии.

Въпреки това, окончателното решение идва едва с юнските актуализации за 2026 г.

# Препоръки на Microsoft към администраторите

След публикуването на корекциите, Microsoft призова организациите незабавно да:

* инсталират юнските Exchange Server актуализации;
* запазят временните митигейшъни активни;
* следят за подозрителна активност в OWA среда;
* ограничат достъпа до уеб интерфейса, когато е възможно.

Компанията подчертава, че комбинирането на пач и временни защити предоставя най-високо ниво на сигурност срещу текущите атаки.

# Реакция от CISA и риск за публични организации

Американската **Агенция за киберсигурност и сигурност на инфраструктурата (CISA)** добави CVE-2026-42897 към списъка с активно експлоатирани уязвимости още на 15 май и задължи федералните агенции да приложат корекциите в рамките на две седмици.

Исторически данни показват, че Exchange Server е една от най-често атакуваните корпоративни платформи:

* над 20 включени уязвимости в KEV каталога на CISA;
* 14 от тях са използвани от рансъмуер групи;
* множество глобални кампании за кражба на имейл данни през последните години.

# Защо Exchange остава основна цел

Exchange Server и Outlook Web Access продължават да бъдат сред най-ценните цели за атакуващите, тъй като предоставят директен достъп до:

* корпоративни комуникации;
* идентификационни данни;
* вътрешни бизнес процеси;
* стратегическа информация.

**Комбинацията от уеб интерфейс, имейл съдържание и сложни клиентски скриптове създава идеална среда за XSS атаки, особено когато се експлоатират доверени домейни.**

CVE-2026-42897 е поредното доказателство, че дори добре защитени корпоративни системи като Exchange Server остават уязвими към атаки, които използват най-слабата връзка – потребителя и уеб интерфейса.

**Навременното прилагане на актуализации, съчетано с постоянен мониторинг на уеб базирани услуги, остава критичен елемент в защитата срещу модерните XSS и фишинг кампании.**

[e-security.bg](http://e-security.bg)

4.🧵 Other high-risk surfaces in this update:

🖥️ Remote Desktop Client — 11 CVEs, including critical RCE
🔷 Hyper-V — critical RCE with VM guest escape to host
📧 Exchange Server — CVE-2026-42897 XSS in OWA (CVSS 8.1, exploited)

.@Microsoft has released its June 2026 Exchange Server security updates, including fixes for CVE-2026-42897 and other vulnerabilities affecting supported on-premises deployments.

See what Exchange administrators need to know 👇

#Microsoft #Cybersecurity
https://t.co/i9m6kPi9Td

Exchange CVE-2026-42897 patches land after acti… is the kind of management-plane bug defenders should move on fast. It combines active exploitation with security exposure and auth bypass risk in FortiClient EMS. When endpoint management infrastructure is exposed, the b…

Legacy exposure keeps paying off for attackers. Exchange CVE-2026-42897 patches land after active OWA exp…

Microsoft released June 2026 Exchange updates for CVE-2026-42897 after active exploitation…

🔗 Read → https://t.co/MObLsTWXxZ

Most people will see the headline. The real signal is what Exchange CVE-2026-42897 patches…

Microsoft released June 2026 Exchange updates for CVE-2026-42897 after active exploitation.

🔗 Details → https://t.co/Z1lX9pdoP9

Exchange CVE-2026-42897 patches land after acti… is already being exploited, and Fortinet says the FortiClient EMS flaw carries security exposure and auth bypass risk.

If you run 7.4.5 or 7.4.6, treat it as exposed management-plane risk and hotfix now.

🛑 Exchange CVE-2026-42897 patches land after active OWA exploitation

Microsoft released June 2026 Exchange updates for CVE-2026-42897 after active exploitation…

🔗 Details → https://t.co/Z1lX9pdoP9

Microsoft’s latest Patch Tuesday updates resolve an actively exploited Exchange Server vulnerability tracked as CVE-2026-42897. https://t.co/n0MxtEsRUm

🔴 THREAT RESEARCH

Open the email. The attacker is now you.
Jun 13, 2026 · 6 min read
────────────────────────────────────────

An employee opens an email in Outlook Web Access. They don't click a link. They don't open an attachment. They read it — that's the whole attack.

By the time they reach the signature, JavaScript embedded in the message is already running inside their authenticated session: reading their mailbox, lifting their credentials, sending messages as them. There is no malware on the endpoint. There is no exploit chain to a domain controller. There is only the user's own session, doing things the user never did. And in every log you have, the user did all of it.

## The flaw: a weaponized email

On June 9, 2026, Microsoft shipped an emergency fix for CVE-2026-42897, a zero-day in on-premises Exchange Server already under active exploitation. Technically it's a spoofing flaw — improper neutralization of input during web-page generation, which is the formal way of saying cross-site scripting in Outlook Web Access. Rated critical at CVSS 8.1.

The mechanics are brutally simple. An attacker sends a crafted email. The victim opens it in OWA. Arbitrary JavaScript executes in their browser session, and from there the attacker can spoof email, steal credentials, hijack the session, and perform actions on behalf of the compromised user. It affects every update level of Exchange Server 2016, 2019, and Subscription Edition. No privileged access required on the attacker's side, and the only "user interaction" needed is the one thing email is designed to make people do: open the message.

The crown jewel of most enterprises isn't a database. It's the mail server — because it's where identity, communication, and trust all converge. Compromise it and you don't break in. You become the company's voice.

## Why the mail server is the worst place for this

Exchange isn't just where email lives. It's an identity system. It holds the conversations attackers use to pivot, the password-reset flows they hijack, the org chart they impersonate. An attack that runs inside a trusted OWA session inherits all of that — and wears the user's identity while it does.

That's what makes CVE-2026-42897 nastier than its modest score suggests. There's no second-stage payload to flag, no anomalous process tree, no beacon to a command server. The malicious actions are HTTP requests issued by a legitimate, authenticated browser session — indistinguishable, on their face, from the user simply working in their inbox. The attacker isn't hiding from your detection. They're wearing your user as a disguise.

## What the SOC actually sees

Pulled apart into individual events, the attack is invisible. "User opened an email" — happens ten thousand times a day. "User accessed mailbox items" — that's the job. "User sent messages" — normal. "Credential used from the session" — the session is authenticated, so of course it is. Not one of those lines, on its own, is worth chasing.

The breach exists only in the contradictions between them: script execution inside OWA, followed within seconds by a burst of mailbox actions and a credential touch that don't match how this human actually works. Each signal is benign alone. Correlated, in order, they are a session being driven by someone who isn't the user. The tell was always there — it just required holding every event at once and asking a question most stacks never ask: is this really them?

## How n0limit catches the session that isn't the user

n0limit treats every action inside a session as something to investigate, not something to wave through because the session authenticated. When script executes in an OWA context and is followed by mailbox and credential activity that contradicts the user's established pattern, those events aren't filed se...

────────────────────────────────────────

📰 Full analysis on The Signal:
https://t.co/wobtfO07Qo

#cybersecurity #threatintel #infosec

#threatreport #LowCompleteness
How to defend ARM64 cloud infrastructure from ITScape | 11-06-2026
Source: https://t.co/6P3BRHEHO5
Key details below ↓

💀Threats:
Itscape_vuln, 
🎯Victims: Cloud infrastructure, Multi tenant cloud environments

🔓CVEs: CVE-2026-46316  \[[Vulners](https://t.co/gAPOO0byVT)]
 - CVSS V3.1: *9.3*, 
 - Vulners: Exploitation: Unknown

🤖LLM extracted TTPs:`
T1068, T1611

🧨IOCs:
 - Hash: 1

💽Software: QEMU

🔢Algorithms: sha256

🔠Functions: vgic_its_invalidate_cache

⚙️Win Services: bits

💻Platforms: arm

YARA: Found

#threatreport:
CVE-2026-46316, also known as ITScape, is a critical guest-to-host escape vulnerability in the vGIC-ITS (Interrupt Translation Service) emulation component of KVM/arm64, disclosed by researcher Hyunwoo Kim. The vulnerability stems from a race condition in the `vgic_its_invalidate_cache()` function, leading to a double-use-after-free scenario that allows execution of host kernel code. This vulnerability directly threatens multi-tenant ARM64 cloud environments, where untrusted guest operating systems are common. Notably, if an attacker does not possess root access on the guest system, they can potentially exploit this vulnerability together with other local privilege escalation methods. The affected kernel versions stretch from commit 8201d1028caa (April 25, 2024) to commit 13031fb6b835 (June 5, 2026), when the necessary patch was integrated into the mainline kernel.

To address and monitor potential exploitation of this vulnerability, two specific YARA rules have been created. The first, named ITScape_ExploitConstants_1, aims to identify nine hardcoded 64-bit constants that are contained in the proof-of-concept (PoC) source code. These constants include kernel symbol addresses and a sentinel used for anti-leak measures, all encoded in little-endian format typical for compiled ARM64 ELF binaries. Testing against a known PoC binary has shown that seven out of nine constants can be matched, despite some discrepancies due to compiler variations. The rule retains potentially variable constants defensively to account for different build scenarios in future variants of the exploit.

The second rule, ITScape_KVM_PrivDrop_1, focuses on a unique, semantically significant instruction sequence within the compiled binary. This includes a permission check on `/dev/kvm`, followed by a sequence of privilege-dropping system calls—specifically `setgroups(0, NULL)`, `setgid(1000)`, and `setuid(1000)`. The specific byte patterns are allowed to vary to create a robust signature against different compilation methods, ensuring that meaningful instruction sequences remain reliable indicators of exploitation attempts.

These YARA rules serve as both detection and discovery mechanisms for organizations operating on ARM64 cloud infrastructures, helping them identify and mitigate risks associated with the ITScape vulnerability effectively.

CVE-2026-46316 is a critical Linux KVM arm64 flaw scoring 9.3 that lets a guest VM escape to the host kernel via a vGIC-ITS race condition.

#CVE202646316 #KVMEscape #LinuxKernel #arm64 #CloudSecurity
https://t.co/RJ5u8x9vmK https://t.co/rjE4Xnl2N0

Ошибка в ядре Linux позволила гостевой машине вмешаться в работу хоста на arm64

Исследователь Хёнву Ким обнаружил уязвимость CVE-2026-46316 (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H — 9.3 Critical) в реализации KVM для arm64 в ядре Linux. Из-за состояния гонки в эмуляции vGIC-ITS гостевая система могла вмешиваться в то, как хост обрабатывает прерывания, и добиться выполнения своих команд.

При успешной атаке код исполняется не с правами процесса виртуализации, а с привилегиями ядра хоста. В демонстрации это выразилось наглядно: после выхода из гостевой системы уязвимость создавала файл /ITScape на хосте от имени пользователя с uid 0.

Уязвимость затрагивает ядра Linux начиная с апреля 2024 года и исправлена коммитом от 5 июня 2026 года. Проблема касается только KVM на arm64 и не затрагивает x86 — администраторам таких хостов нужно проверить наличие патча, а пользователям arm64-облаков уточнить статус обновления у своего провайдера.

#kvm #linux #виртуализация #arm64 

@ZerodayAlert

#ParsedReport #CompletenessLow
11-06-2026

How to defend ARM64 cloud infrastructure from ITScape

https://www.reversinglabs.com/blog/defend-cloud-infrastructure-itscape

Report completeness: Low

Threats:
Itscape_vuln

Victims:
Cloud infrastructure, Multi tenant cloud environments

CVEs:
CVE-2026-46316  [Vulners]
    CVSS V3.1: 9.3, 
    Vulners: Exploitation: Unknown
    X-Force: Risk: Unknown
    X-Force: Patch: Unknown


ChatGPT TTPs:
do not use without manual check
T1068, T1611

IOCs:
Hash: 1

Soft:
QEMU

Algorithms:
sha256

Functions:
vgic_its_invalidate_cache

Win Services:
bits

Platforms:
arm

YARA: Found

Weekly threat recap: supply-chain intrusions, Microsoft token phishing, cloud and identity abuse, plus ransomware and extortion cases. Also covered defenses tied to CVE-2026-46316. #ShaiHulud #EntraID #Ransomware
https://t.co/rgF25XhBco

⚠️  PoC Exploit Released for Guest-to-Host Escape Linux Kernel Vulnerability 

Source: https://t.co/0YG7N6J8Q7

A proof-of-concept (PoC) exploit has been released for a critical Linux kernel vulnerability, CVE-2026-46316, that enables a guest-to-host escape in KVM environments on arm64 systems.

The vulnerability was discovered by security researcher Hyunwoo Kim (V4bel) and affects the in-kernel KVM implementation rather than user-space components like QEMU.

This makes the issue particularly severe, as exploitation results in a direct compromise of the host kernel rather than a confined user-space process. ITScape is caused by a race condition in the vGIC-ITS (Interrupt Translation Service) emulation within KVM on arm64.

#cybersecuritynews

Here’s a quick breakdown of the 10 most interesting vulnerabilities trending today:

**1. [CVE-2024-30088](https://nvd.nist.gov/vuln/detail/CVE-2024-30088)**

- 📝 Windows Kernel Elevation of Privilege Vulnerability

- 📅 **Published:** 11/06/2024
- 📈 **CVSS:** 7
- 🛡️ **CISA KEV:** True
- 🧭 **Vector:** CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
- 📣 **Mentions:** 7
- ⚠️ **Priority:** 1+
- 📝 **Analysis:** A Windows Kernel Elevation of Privilege Vulnerability has been identified, confirmed as exploited in the wild due to a CISA KEV notice. This vulnerability allows for remote code execution with a CVSS score of 7, making it a priority 1+ issue requiring immediate attention and remediation.


---

**2. [CVE-2025-8088](https://nvd.nist.gov/vuln/detail/CVE-2025-8088)**

- 📝 A path traversal vulnerability affecting the Windows version of WinRAR allows the attackers to execute arbitrary code by crafting malicious archive files. This vulnerability was exploited in the wild and was discovered byAnton Cherepanov, Peter Koinr, and Peter Strek      from ESET.

- 📅 **Published:** 08/08/2025
- 📈 **CVSS:** 8.4
- 🛡️ **CISA KEV:** True
- 🧭 **Vector:** CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
- 📣 **Mentions:** 23
- ⚠️ **Priority:** 1+
- 📝 **Analysis:** A path traversal vulnerability in Windows WinRAR allows attackers to execute arbitrary code via malicious archive files. This vulnerability has been exploited in the wild and was discovered by ESET researchers. Given its high CVSS score and prior activity, it is a priority 2 issue.


---

**3. [CVE-2026-42908](https://nvd.nist.gov/vuln/detail/CVE-2026-42908)**

- 📝 Windows Remote Desktop Protocol (RDP) Information Disclosure Vulnerability

- 📅 **Published:** 09/06/2026
- 📈 **CVSS:** 7.5
- 🧭 **Vector:** CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C
- 📣 **Mentions:** 2
- ⚠️ **Priority:** 2
- 📝 **Analysis:** A Windows RDP Information Disclosure Vulnerability has been identified with a high CVSS score (7.5). The vector indicates network-based low authentication and unauthorized access potential. No known in-the-wild activity has been reported yet (CISA KEV not specified), but the priority is 2 due to the high CVSS score and currently lower exploitability potential.


---

**4. [CVE-2026-45639](https://nvd.nist.gov/vuln/detail/CVE-2026-45639)**

- 📝 Windows Remote Desktop Protocol (RDP) Information Disclosure Vulnerability

- 📅 **Published:** 09/06/2026
- 📈 **CVSS:** 7.5
- 🧭 **Vector:** CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C
- 📣 **Mentions:** 2
- ⚠️ **Priority:** 2
- 📝 **Analysis:** A Windows RDP Information Disclosure Vulnerability has been identified (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C). Known in-the-wild activity is minimal, making it a priority 2 vulnerability with high CVSS. Attackers may gain sensitive information, but no confirmed exploits are known at this time.


---

**5. [CVE-2025-46308](https://nvd.nist.gov/vuln/detail/CVE-2025-46308)**

- 📝 An authorization issue was addressed with improved state management. This issue is fixed in iOS 18.4 and iPadOS 18.4, macOS Sequoia 15.4. An app may be able to leak sensitive user information.

- 📅 **Published:** 11/06/2026
- 📈 **CVSS:** 5.3
- 🧭 **Vector:** CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- ⚠️ **Priority:** 4
- 📝 **Analysis:** App may leak sensitive user information due to an authorization issue in iOS 18.4 and iPadOS 18.4, macOS Sequoia 15.4. While there's no known exploit activity, the low CVSS score and current priority rating of 4 indicate a low risk at this time.


---

**6. [CVE-2026-0273](https://nvd.nist.gov/vuln/detail/CVE-2026-0273)**

- 📝 A command injection vulnerability in Palo Alto Networks PAN-OS software enables an authenticated administrator to bypass system restrictions and run arbitrary commands as a root user. To be able to exploit this issue, the user must have access to the PAN-OS CLI or Web UI. The security risk posed by this issue is significantly minimized when CLI access is restricted to a limited group of administrators and by restricting access to the management web interface to only trusted internal IP addresses according to our recommended  best practice deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 . This issue is applicable to PAN-OS software on PA-Series and VM-Series firewalls and on Panorama (virtual and M-Series). Cloud NGFW and Prisma Access are not affected by this vulnerability.

- 📅 **Published:** 10/06/2026
- 📈 **CVSS:** 6.1
- 🧭 **Vector:** CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/AU:N/R:U/V:D/RE:M/U:Amber
- 📣 **Mentions:** 5
- ⚠️ **Priority:** 2
- 📝 **Analysis:** Command injection vulnerability found in Palo Alto Networks PAN-OS software allows authenticated administrators to bypass system restrictions and run arbitrary commands as root user via CLI or Web UI access. The risk is minimized with restricted admin groups and trusted IP access. Applies to PA-, VM- Series firewalls, Panorama (virtual & M-Series), not affecting Cloud NGFW or Prisma Access. Prioritization score: 2 (low EPSS but high CVSS).


---

**7. [CVE-2026-54073](https://nvd.nist.gov/vuln/detail/CVE-2026-54073)**

- 📝 n/a

- 📈 **CVSS:** 0
- 🧭 **Vector:** n/a
- ⚠️ **Priority:** n/a
- 📝 **Analysis:** No Information available for this CVE at the moment


---

**8. [CVE-2026-53762](https://nvd.nist.gov/vuln/detail/CVE-2026-53762)**

- 📝 n/a

- 📈 **CVSS:** 0
- 🧭 **Vector:** n/a
- ⚠️ **Priority:** n/a
- 📝 **Analysis:** No Information available for this CVE at the moment


---

**9. [CVE-2024-1065](https://nvd.nist.gov/vuln/detail/CVE-2024-1065)**

- 📝 Use After Free vulnerability in Arm Ltd Bifrost GPU Kernel Driver, Arm Ltd Valhall GPU Kernel Driver, Arm Ltd Arm 5th Gen GPU Architecture Kernel Driver allows a local non-privileged user to make improper GPU memory processing operations to gain access to already freed memory.This issue affects Bifrost GPU Kernel Driver: from r45p0 through r48p0; Valhall GPU Kernel Driver: from r45p0 through r48p0; Arm 5th Gen GPU Architecture Kernel Driver: from r45p0 through r48p0.

- 📅 **Published:** 19/04/2024
- 📈 **CVSS:** 5.9
- 🧭 **Vector:** CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
- ⚠️ **Priority:** 4
- 📝 **Analysis:** A local non-privileged user can perform improper GPU memory processing operations due to a Use After Free vulnerability in Bifrost GPU Kernel Driver (r45p0 through r48p0), Valhall GPU Kernel Driver (r45p0 through r48p0), and Arm 5th Gen GPU Architecture Kernel Driver (r45p0 through r48p0). Confirmed exploit activity is low (CISA KEV, score 4).


---

**10. [CVE-2026-46316](https://nvd.nist.gov/vuln/detail/CVE-2026-46316)**

- 📝 In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry vgic_its_invalidate_cache() walks the per-ITS translation cache with xa_for_each() and drops the caches reference on each entry with vgic_put_irq(). It puts the iterated pointer, though, rather than the value returned by xa_erase(). The function is called from contexts that do not exclude one another: the ITS command handlers hold its_lock, the GITS_CTLR write path holds cmd_lock, and the path that clears EnableLPIs in a redistributors GICR_CTLR holds neither. Two or more of them can drain the same cache concurrently, and if each one observes the same entry, erases it and then puts it, the single reference the cache holds on that entry is dropped more than once. The entry can then be freed while an ITE still maps it. xa_erase() is atomic and returns the previous entry, so put only the entry that this context actually removed. The cache reference is then dropped exactly once per entry even when the invalidations run concurrently, and the behavior is unchanged when only one context runs.

- 📅 **Published:** 09/06/2026
- 📈 **CVSS:** 0
- 🧭 **Vector:** n/a
- 📣 **Mentions:** 9
- ⚠️ **Priority:** 4
- 📝 **Analysis:** A concurrency issue has been resolved in the Linux kernel's KVM (arm64): vgic-its translation cache reference drops can occur more than once for the same entry if multiple contexts access it simultaneously. This issue, while low priority (score 4), is due to its low exploitability and no known in-the-wild activity. Ensure systems using these versions are updated as precautionary measure.


---

Let us know if you're tracking any of these or if you find any issues with the provided details.

CVE-2026-46316 (ITScape) is a guest-to-host escape in KVM/arm64 yielding host root, discovered by researcher Hyunwoo Kim (V4bel). Organizations operating multi-tenant cloud infrastructure should closely evaluate this issue. RL has provided two YARA rules for detection. https://t.co/oFImZnRCJR

🚨 ITScape #CVE-2026-46316 Guest-to-Host Breakout Threat and RoguePlanet #Windows SYSTEM Escalation Chain Reshape Cloud and Endpoint Security Landscape + Video

-Fact Checker: ✅: 1 ❌: 2 || 1/3 → Score: 33% 🤏🏻
-Prediction: 📈 2 Positive | 📉 1 Negative

https://t.co/dhkMAylXEL

🚨  Critical Fortinet FortiSandbox Vulnerabilities Actively Exploited in Attacks 

Source: https://t.co/7eCFLiLLrc

Threat actors are actively exploiting multiple critical vulnerabilities in Fortinet's FortiSandbox platform, with live attack telemetry confirming exploitation attempts over the past 24 hours.

Security researchers have flagged three CVEs under active targeting, including one, CVE-2026-39813, with no previously recorded exploitation history. A compromised FortiSandbox can be weaponized to approve malicious files as clean to dependent Fortinet products or serve as a lateral movement pivot within enterprise networks.

#cybersecuritynews

Three FortiSandbox CVEs (CVE-2026-39813, -39808, -25089 CVSS 9.8) chained for unauthenticated root RCE — 7 financial/critical-infra deployments confirmed compromised. Patch to 5.4.3. https://t.co/Pn802W3q7f #CyberSecurity #Fortinet https://t.co/diAjMjFgd3

Fortinet's FortiSandbox is under active attack, with critical vulnerabilities like CVE-2026-39813 being exploited. Unauthenticated attackers can execute commands and access sensitive data. Immediate patching is essential to secure systems.

#Fortinet #FortiSandbox #CyberSecurity #Vulnerabilities #PatchNow #InfoSec

https://t.co/SSGDsUBv2Y

Attackers chained CVE-2026-39813 and CVE-2026-39808 to compromise FortiSandbox systems, using path traversal for authentication bypass then command injection for privilege escalation. Lateral movement followed, highlighting how security appliance compromise can expose entire network segments. #ZeroTrust

🔗 Full TRC analysis: https://t.co/fxdFdlCYvb

Two stories worth your attention today. One is a critical infrastructure threat moving toward active exploitation. The other is a governance story out of India that reads like a minor platform-policy item until you notice what it's part of.

FortiSandbox is not a typical perimeter product. It's the decision engine — the threat-verdict brain that FortiGate, FortiMail, FortiWeb, and the rest of the Fortinet stack poll to decide what to block. Compromise it, and you don't just own the sandbox. You own the enforcement layer. Malware gets clean verdicts. Blocking decisions go quiet. The lateral movement window opens without an alarm.

Three vulnerabilities. Two of them CVSS 9.8, unauthenticated, remote. All three confirmed exploitable.

CVE-2026-39813 is a path traversal and auth bypass through the JRPC API — CWE-24, CVSS 9.8 (AV:N/AC:L/PR:N/UI:N), affecting FortiSandbox 5.0.0 through 5.0.5 and 4.4.0 through 4.4.8. CVE-2026-39808 is OS command injection at the same severity, same affected range. Both were patched in April. Defused is now tracking active exploitation of both. The window has been open for two months. That's a Tuesday in 2026.

CVE-2026-25089 is the most recent — OS command injection against the web UI, disclosed June 9, discovered internally by Fortinet's own product security team. That's the marginally better scenario: vendor-found before external researchers. "Marginally" is doing a lot of work here, because the other two are already under active attack, and a vibecoded exploit for CVE-2026-25089 is already circulating. Help Net Security flags it as "likely faulty." Cold comfort. A broken exploit for an unauthenticated command injection chain still generates scan noise and tells you that commodity actors are attempting to retool. A corrected version is a matter of days, not weeks.

The MITRE picture is clean and damaging: T1190 (Exploit Public-Facing Application) is the initial access vector across all three CVEs. T1059 covers the command injection execution paths in CVE-2026-39808 and CVE-2026-25089. The architectural risk lives in T1553 (Subvert Trust Controls) and T1562 (Impair Defenses) — because a compromised FortiSandbox doesn't announce itself. It just starts returning wrong answers to the products that trust it.

If you're running FortiSandbox on 4.4.x or 5.0.x, patch all three now — fixes exist for all of them. If patching in the next 24 hours isn't feasible, restrict JRPC API and web UI access to management VLANs as a compensating control and watch for unusual verdict patterns in your downstream enforcement logs. That's the canary.

The India-Telegram story is quieter but worth a read.

India's National Testing Agency ordered a temporary block on Telegram through June 22, ahead of the NEET-UG medical exam rerun. The stated rationale: fraud rings selling fake "leaked" exam questions to 2 million candidates. The mechanism those rings use is clever — post fabricated questions before the exam, then edit the messages after results drop to make them look like genuine leaks. Monetizing student anxiety at up to several thousand dollars per family. Indian police arrested one ring in Ahmedabad that moved ₹15 million (~$159K) in a single month contacting roughly 1,000 numbers.

No paper actually leaked. The NTA said so explicitly. Which means the government blocked a platform used by 2 million exam candidates — losing access to legitimate study resources — to suppress rumor. The Internet Freedom Foundation's critique is precise: targeted channel takedowns and criminal prosecution, tools already deployed, address the actual fraud ring. A platform-wide block is a different instrument with different collateral damage.

The technically sharper intervention was already available: Telegram disabled its message-editing feature through June 30, removing the mechanism that made the fraud scheme work. That's the tool that addresses the vector. The NTA should have led with that.

The broader pattern is what makes this worth watching. India's regulatory posture on platform liability has been hardening steadily — IT Rules 2021, the 2023 amendments, ongoing legal exposure for Telegram's leadership in Europe. This block fits a pattern of reaching for the off-switch first and calibrating later. Less surprising than it should be.

Sources for both stories:

FortiSandbox CVE-2026-39813 (CVSS 9.8, path traversal / JRPC auth bypass) and CVE-2026-39808 (CVSS 9.8, OS command injection) — active exploitation confirmed by Defused. CVE-2026-25089 (OS command injection, web UI) — disclosed June 9, vibecoded exploit circulating. Full technical detail and patch guidance via Help Net Security (June 16, 2026): https://t.co/B9MsciNsaf

NVD entry for CVE-2026-39813: https://t.co/eXKyBajPpw

India / Telegram block — NTA order through June 22, Telegram message-editing disabled through June 30, Ahmedabad fraud ring arrest confirmed. Full reporting via The Record: https://t.co/11XyX52YlG

@TheHackersNews Defender note: treat FortiSandbox as internet-edge management risk until proven otherwise. Prioritize exposed WEB UI/API, confirm fixes for CVE-2026-39813/39808/25089, and review admin/auth logs for anomalous HTTP/API activity. Avoid public PoC testing on production. https://t.co/YzLnOKV8w7

Attackers are exploiting FortiSandbox vulnerabilities: Attackers have been spotted exploiting three vulnerabilities (CVE-2026-39813, CVE-2026-39808, CVE-2026-25089) in FortiSandbox, a platform that other Fortinet security products depend on for threat… https://t.co/55j3T5laWe https://t.co/dtpEhksjSk

🔐 Exploit watch: The Hacker News reports active exploitation of Fortinet FortiSandbox flaws CVE-2026-39813, CVE-2026-39808 and CVE-2026-25089 over the past 24 hours, citing Defused Cyber. #Fortinet #Cybersecurity https://t.co/fiN9z90ZOl

Exploitation attempts detected against Fortinet #FortiSandbox targeting CVE-2026-39813, CVE-2026-39808, and CVE-2026-25089 (all CVSS 9.1). CVE-2026-39813 shows no prior #exploitation evidence, suggesting recent availability of working exploits. https://t.co/ZOvLG4wBNH

**Fortinet FortiSandbox is facing exploitation of three critical security vulnerabilities, heightening concerns for users and cybersecurity professionals.**

**Key Points:**

- Attackers are exploiting CVE-2026-39813 and CVE-2026-39808, both patched in April 2026.
- CVE-2026-25089, fixed last week, is also under active exploitation despite being recently patched.
- All three vulnerabilities have a CVSS score of 9.1, indicating critical risk.
- Fortinet appliances have been frequent targets for security breaches in recent years.

Threat intelligence firm Defused Cyber has reported that malicious actors are actively exploiting multiple vulnerabilities in the Fortinet FortiSandbox. The identified vulnerabilities include CVE-2026-39813 and CVE-2026-39808, which were patched in April 2026, indicating a significant risk for users who may not have adhered to the latest updates. Both have a CVSS score of 9.1, emphasizing their criticality and the threat they pose to anyone utilizing FortiSandbox technology.

Additionally, CVE-2026-25089, a flaw recently patched, also exhibits signs of ongoing exploitation. This particular vulnerability has been observed to allow unauthenticated attackers to execute unauthorized commands through crafted HTTP requests. Despite it being addressed, its exploit reportedly shows signs of being developed using artificial intelligence, yet remains faulty. The rapid exploitations not only underline the vulnerabilities present in Fortinet products but also reflect a growing trend of attackers targeting their devices—evidently, Fortinet appliances have become a preferred target among cybercriminals.

What measures can organizations take to protect themselves from vulnerabilities like those found in Fortinet FortiSandbox?

**Learn More:** [The Hacker News](https://thehackernews.com/2026/06/attackers-exploit-three-fortinet.html)

**Want to stay updated on the latest cyber threats?** 

 👉 **[Subscribe to /r/PwnHub](https://www.reddit.com/r/pwnhub)**

Исследователи Defused сообщают об эксплуатации ряда критических уязвимостей в платформе обнаружения киберугроз FortiSandbox от Fortinet.

14 апреля Fortinet выпустила обновления для трех критически важных уязвимостей: CVE-2026-39813, CVE-2026-39808 и CVE-2026-25089.

Они позволяют неавторизованным злоумышленникам повышать привилегии и удаленно выполнять несанкционированный код посредством простых атак с внедрением команд, не требующих взаимодействия с пользователем.

Для решения этих проблем и блокировки входящих атак администраторам необходимо обновить затронутые развертывания до последних выпущенных версий.

Как предупреждают в Defused, за последние 24 часа наблюдается эксплуатация множества уязвимостей Fortinet FortiSandbox, включая: CVE-2026-39813 (ранее не зафиксировано случаев эксплуатации), CVE-2026-39808, CVE-2026-25089 (эксплойт, вероятно, некорректный).

При этом рабочий эксплойт для последней еще не был публично представлен. В свою очередь, Fortinet пока никак не отреагировала на сообщения об активной эксплуатации уязвимости.

Тем не менее, уязвимости в системе безопасности Fortinet часто использовались в атаках с применением ransowmare (зачастую в виде нулей) и в кампаниях кибершпионажа для взлома сетей жертв.

В общей сложности на карандаше в CISA сейчас 26 уязвимостей Fortinet, которые были использованы в атаках в последние годы, 13 из которых были использованы группировками, занимающимися вымогательством.

CVE-2026-42208 (GHSA-r75f-5x8p-qvmc) lives in the proxy key-verification path. In affected versions (≥ 1.81.16, &lt; 1.83.7), the Authorization: Bearer header value is concatenated directly into a SELECT query against the LiteLLMVerificationToken table without…

The Authorization Header That Owns Your AI Stack: CVE-2026-42208 and the 36-Hour Exploitation of LiteLLM's Authentication Path

A pre-authentication SQL injection in LiteLLM CVE-2026-42208, CVSS 9.3 — the open-source AI gateway used by thousands of operators to centralize…

Status vs competitors:
≥ 1.81.16, &lt; 1.83.7: **Vulnerable**
&lt; 1.81.16: Not affected (code path absent)
≥ 1.83.7-stable: **Patched**

The Authorization Header That Owns Your AI Stack: CVE-2026-42208 and the 36-Hour Exploitation of LiteLLM's Authentication Path

CVE-2026-42208: A pre-authentication SQL injection in LiteLLM CVE-2026-42208, CVSS 9.3 — the open-source AI gateway used by thousands of operators to centralize access to OpenAI, Anthropic, and AWS Bedrock — was exploited in the wild just 36 hours and 7 minutes after the…

CVE-2026-42208 is a critical (CVSS 9.3) pre-authentication SQL injection in LiteLLM — the open-source LLM proxy used by thousands of engineering teams to centralize access to OpenAI, Anthropic, AWS Bedrock, and Azure OpenAI. The flaw lives in the proxy's own authentication…

CVE-2026-42208 · &lt; 1.83.7 → &gt;= 1.81.16

CVE-2026-42208 is a critical (CVSS 9.3) pre-authentication SQL injection in LiteLLM — the open-source LLM proxy used by thousands of engineering teams to centralize access to OpenAI, Anthropic, AWS Bedrock, and Azure OpenAI.

This hits AI teams particularly hard because Langflow sits at the center of most LLM pipelines. Unauthenticated RCE means an attacker can manipulate your agent flows, intercept prompts, or pivot to every provider API key the platform touches. One flaw, total exposure.

This follows a pattern. LiteLLM CVE-2026-42208 was exploited within 36 hours of disclosure , SQL injection that led to full API key compromise. AI infrastructure tools are high-value targets precisely because they hold the keys to every model you use.

8, 2026, — The LLM Gateway Heist: Unauthenticated SQL Injection in LiteLLM Exposes All Managed API Credentials.

TL;DR
CISA added CVE-2026-42208 to its Known Exploited Vulnerabilities catalog on May 8, 2026.

TL;DR
CISA added CVE-2026-42208 to its Known Exploited Vulnerabilities catalog on May 8, 2026. BerriAI's LiteLLM—a popular open-source proxy gateway used by enterprises to manage 100+ LLM APIs—contains a critical SQL injection vulnerability in versions 1.81.16–1.83.6 that…

The pattern repeats: enterprise systems hold credentials. PeopleSoft holds student and staff PII. Your AI gateway holds every LLM provider API key you own. One unpatched CVE, LiteLLM CVE-2026-42208 was exploited in 36 hours after disclosure, and the blast radius covers everything downstream.

Jaydns

The floor opens up under Cisco SD-WAN Manager — again. CVE-2026-20262, an arbitrary file write via crafted HTTP request to the web UI API, was already under active exploitation before Cisco shipped the fix today. CISA KEV-listed it within hours. Federal agencies have until June 29 to patch. Two weeks. The window has been open longer than that.

The CVSS rating is 6.8 (Medium). Technically defensible — the exploit requires valid credentials. Academically reassuring. In practice, initial-access brokers sell Cisco credentials on underground forums, credential stuffing runs continuously against enterprise networking gear, and phishing for single-task accounts is trivially automated. The attack surface is "anyone who can log in at any privilege level." The honor system, apparently.

But the CVE is almost secondary to the count. This is the eighth Cisco SD-WAN KEV listing this year. Eight. In six months, on a single product line. That's not a run of bad luck — that's a signal about the underlying codebase. Structural input validation problems don't resolve themselves, and the catalog doesn't lie.

It gets sharper. A separate SD-WAN zero-day — CVE-2026-20245, high-severity — was disclosed June 4 with no patch available and fixed June 12. Two SD-WAN zero-days under simultaneous active exploitation, eight days apart. That's not opportunism. That's coordinated targeting of a specific product line by someone who has done their homework.

The architectural risk here is the part that keeps network teams up at night. SD-WAN Manager is an orchestration plane. Root on the manager isn't root on a box — it's root on the network. Visibility and potential control over the entire SD-WAN fabric. The blast radius is not bounded by the device. There is no workaround; upgrade or accept active exploitation risk.

Remediation is straightforward in theory: upgrade to a fixed release per Cisco's advisory (cisco-sa-sdwan-arbfw-c2rZvQ), rotate any credentials that may have been reused or phished, restrict web UI access to management-only VLANs or jump hosts if you can't patch immediately, and hunt for unexpected files in system directories — the exploit writes to the underlying OS, so forensic indicators should surface there. If you patched before June 12, verify you're on a release that covers both CVE-2026-20245 and CVE-2026-20262. They are distinct vulnerabilities in the same product.

Eight KEV entries on one product line in one calendar year is a canary. If you're running Cisco Catalyst SD-WAN, the question worth asking right now isn't just "did we patch" — it's whether your Cisco TAC engagement is proportional to the attack surface you're carrying.

CVE-2026-20262 | CVSS 6.8 | KEV-listed 2026-06-15 | Federal deadline 2026-06-29 | Exploitation is not theoretical.

CVE-2026-20245 Cisco Catalyst SD-WAN Manager Privilege Escalation
*
.py

@TheHackersNews CVE-2026-20245 lets netadmin users get root on Cisco SD-WAN. Attackers chain it with auth-bypass flaws like CVE-2026-20182 to push malicious configs directly to edge devices. Total top-down compromise, and no patch available.

@CISACyber CVE-2026-20245 lets netadmin users get root on Cisco SD-WAN. Attackers chain it with auth-bypass flaws like CVE-2026-20182 to push malicious configs directly to edge devices. Total top-down compromise, and no patch available.

🔔 A PoC/exploit has been discovered for vulnerability CVE-2026-20245
PT ID: PT-2026-46400

Vendor: Cisco
Product: Cisco Catalyst SD-WAN Controller
Description: A vulnerability in the CLI of Cisco Catalyst SD-WAN Controller, formerly SD-WAN vSmart, Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, and Cisco Catalyst SD-WAN Validator, formerly SD-WAN vBond, could allow an authenticated, local attacker to execute arbitrary commands as root by supplying a crafted file to the affected system.

This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by uploading a crafted file to the affected system. A successful exploit could allow the attacker to perform command injection attacks on an affected system and elevate their privileges as the root user.&nbsp;
To exploit this vulnerability, the attacker must have netadmin privileges on the affected system. This would require valid credentials or exploitation of  or . Cisco is not aware of successful exploitation by other methods. Cisco has observed limited cases where the exploitation of this bug resulted in a configuration change pushed to edge devices.

Link: https://t.co/JXNW5xOB2k

#dbugs_vuln

🚨 CISA has added a new Cisco Catalyst SD-WAN zero-day to its Known Exploited Vulnerabilities catalog.

CVE-2026-20245 (CVSS 7.8) — allows arbitrary command execution as root.

But here's the dangerous part — attackers are chaining 3 CVEs together:

🔗 CVE-2026-20182 (CVSS 10.0) — auth bypass → front door
🔗 CVE-2022-20775 — privilege escalation
🔗 CVE-2026-20245 — root command execution

Patch for CVE-20245 still in progress.

🔐 Noon cyber run: CISA KEV lists CVE-2026-20245 in Cisco Catalyst SD-WAN control components. Cisco says an authenticated local attacker could execute commands as root via a crafted file. Due date: Jun 23. #Cisco #KEV #CyberSecurity https://t.co/tavcBTxnWn

Cisco SD-WAN zero-day (CVE-2026-20245) under active attack — no patch available. Mandiant flagged it from a live incident. It's the 7th SD-WAN zero-day exploited in 2026.

https://t.co/g0LP4GENqG

#Cisco #ZeroDay #Cybersecurity https://t.co/hZnCNPtb4c

Here’s a quick breakdown of the 10 most interesting vulnerabilities trending today:

**1. [CVE-2025-8088](https://nvd.nist.gov/vuln/detail/CVE-2025-8088)**

- 📝 A path traversal vulnerability affecting the Windows version of WinRAR allows the attackers to execute arbitrary code by crafting malicious archive files. This vulnerability was exploited in the wild and was discovered byAnton Cherepanov, Peter Koinr, and Peter Strek      from ESET.

- 📅 **Published:** 08/08/2025
- 📈 **CVSS:** 8.4
- 🛡️ **CISA KEV:** True
- 🧭 **Vector:** CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
- 📣 **Mentions:** 23
- ⚠️ **Priority:** 1+
- 📝 **Analysis:** A path traversal vulnerability in Windows WinRAR allows attackers to execute arbitrary code via malicious archive files. This vulnerability has been exploited in the wild and was discovered by ESET researchers. Given its high CVSS score and prior activity, it is a priority 2 issue.


---

**2. [CVE-2026-20245](https://nvd.nist.gov/vuln/detail/CVE-2026-20245)**

- 📝 A vulnerability in the CLI of Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, could allow an authenticated, local attacker to execute arbitrary commands as root by supplying a crafted file to the affected system. This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by uploading a crafted file to the affected system. A successful exploit could allow the attacker to perform command injection attacks on an affected system and elevate their privileges as the root user. To exploit this vulnerability, the attacker must have netadmin privileges on the affected system. This would require valid credentials or exploitation of  or . Cisco is not aware of successful exploitation by other methods. Cisco has observed limited cases where the exploitation of this bug resulted in a configuration change pushed to edge devices. Cisco recommends that customers upgrade to the fixed software that is documented in the  that was published on May 14, 2026, and verify the configuration of the edge devices.

- 📅 **Published:** 04/06/2026
- 📈 **CVSS:** 7.8
- 🛡️ **CISA KEV:** True
- 🧭 **Vector:** CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- 📣 **Mentions:** 51
- ⚠️ **Priority:** 1+
- 📝 **Analysis:** A local authenticated attacker can perform command injection and elevate privileges as root due to insufficient input validation in the CLI of a Cisco Catalyst SD-WAN Manager. Exploitation requires netadmin privileges. Limited cases of successful exploitation have been observed resulting in configuration changes pushed to edge devices. Prioritize remediation with a version upgrade to those documented on May 14, 2026, as this vulnerability has a CVSS score of 7.8 and a CISA priority score of 2 (low EPSS but high CVSS).


---

**3. [CVE-2026-11645](https://nvd.nist.gov/vuln/detail/CVE-2026-11645)**

- 📝 Out of bounds read and write in V8 in Google Chrome prior to 149.0.7827.103 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

- 📅 **Published:** 08/06/2026
- 📈 **CVSS:** 8.8
- 🛡️ **CISA KEV:** True
- 🧭 **Vector:** CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- 📣 **Mentions:** 59
- ⚠️ **Priority:** 1+
- 📝 **Analysis:** A critical out-of-bounds read and write vulnerability in Google Chrome (prior to 149.0.7827.103) enables remote attackers to execute arbitrary code inside a sandbox via crafted HTML pages. Confirmed exploited, priority is 1+.


---

**4. [CVE-2026-7473](https://nvd.nist.gov/vuln/detail/CVE-2026-7473)**

- 📝 On affected platforms running Arista EOS where a tunnel decapsulation configurationsuch as VXLAN (Virtual Extensible LAN), decap-groups, or a GRE (Generic Routing Encapsulation) tunnel interfaceis present, the switch will incorrectly decapsulate and forward other unexpected tunneled packet with a destination IP matching its configured decapsulation IP. This occurs because the switch does not verify the tunnel protocol type, potentially leading to the unexpected processing of non-configured tunnel traffic. This issue has been reported as being exploited in the wild.

- 📅 **Published:** 05/06/2026
- 📈 **CVSS:** 5.8
- 🛡️ **CISA KEV:** True
- 🧭 **Vector:** CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N
- 📣 **Mentions:** 5
- ⚠️ **Priority:** 1+
- 📝 **Analysis:** On Arista EOS platforms, an issue exists where incorrect tunnel decapsulation leads to unexpected packet forwarding due to insufficient verification of tunnel protocol type. Known in-the-wild exploitation has been reported (CISA KEV). Prioritize remediation efforts accordingly.


---

**5. [CVE-2026-42908](https://nvd.nist.gov/vuln/detail/CVE-2026-42908)**

- 📝 Windows Remote Desktop Protocol (RDP) Information Disclosure Vulnerability

- 📅 **Published:** 09/06/2026
- 📈 **CVSS:** 7.5
- 🧭 **Vector:** CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C
- 📣 **Mentions:** 2
- ⚠️ **Priority:** 2
- 📝 **Analysis:** A Windows RDP Information Disclosure Vulnerability has been identified with a high CVSS score (7.5). The vector indicates network-based low authentication and unauthorized access potential. No known in-the-wild activity has been reported yet (CISA KEV not specified), but the priority is 2 due to the high CVSS score and currently lower exploitability potential.


---

**6. [CVE-2026-45639](https://nvd.nist.gov/vuln/detail/CVE-2026-45639)**

- 📝 Windows Remote Desktop Protocol (RDP) Information Disclosure Vulnerability

- 📅 **Published:** 09/06/2026
- 📈 **CVSS:** 7.5
- 🧭 **Vector:** CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C
- 📣 **Mentions:** 2
- ⚠️ **Priority:** 2
- 📝 **Analysis:** A Windows RDP Information Disclosure Vulnerability has been identified (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C). Known in-the-wild activity is minimal, making it a priority 2 vulnerability with high CVSS. Attackers may gain sensitive information, but no confirmed exploits are known at this time.


---

**7. [CVE-2026-50507](https://nvd.nist.gov/vuln/detail/CVE-2026-50507)**

- 📝 Windows BitLocker Security Feature Bypass Vulnerability

- 📅 **Published:** 09/06/2026
- 📈 **CVSS:** 6.8
- 🧭 **Vector:** CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
- 📣 **Mentions:** 14
- ⚠️ **Priority:** 2
- 📝 **Analysis:** A Windows BitLocker Security Feature Bypass vulnerability (high impact) has been identified, exploitable via a network connection. While no known in-the-wild activity is reported, its high CVSS score warrants attention as a priority 2 issue.


---

**8. [CVE-2026-48578](https://nvd.nist.gov/vuln/detail/CVE-2026-48578)**

- 📝 Secure Boot Security Feature Bypass Vulnerability

- 📅 **Published:** 09/06/2026
- 📈 **CVSS:** 7.9
- 🧭 **Vector:** CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N/E:U/RL:O/RC:C
- 📣 **Mentions:** 2
- ⚠️ **Priority:** 2
- 📝 **Analysis:** A Secure Boot Security Feature Bypass has been identified, allowing remote attackers to compromise systems. Although not yet exploited in the wild, its high CVSS score warrants attention as a priority 2 vulnerability.


---

**9. [CVE-2026-45655](https://nvd.nist.gov/vuln/detail/CVE-2026-45655)**

- 📝 Windows BitLocker Security Feature Bypass Vulnerability

- 📅 **Published:** 09/06/2026
- 📈 **CVSS:** 5.3
- 🧭 **Vector:** CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N/E:U/RL:O/RC:C
- 📣 **Mentions:** 3
- ⚠️ **Priority:** 4
- 📝 **Analysis:** A BitLocker security feature bypass vulnerability has been identified, with a CVSS score of 5.3 (low) and a priority score of 4 (low CVSS & low EPSS). No confirmed in-the-wild activity reported as of now.


---

**10. [CVE-2026-48576](https://nvd.nist.gov/vuln/detail/CVE-2026-48576)**

- 📝 Secure Boot Security Feature Bypass Vulnerability

- 📅 **Published:** 09/06/2026
- 📈 **CVSS:** 7.9
- 🧭 **Vector:** CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N/E:U/RL:O/RC:C
- 📣 **Mentions:** 2
- ⚠️ **Priority:** 2
- 📝 **Analysis:** A Secure Boot Security Feature Bypass vulnerability has been identified with a high impact and exploitability. Currently, no known in-the-wild activity is reported, but the priority remains 2 due to its high CVSS score and low Exploitation Potential Scoring System (EPSS) value. Verify compatibility with specified versions.


---

Let us know if you're tracking any of these or if you find any issues with the provided details.

🚨 CVE-2026-50751 - critical 🚨

Check Point IKEv1 Remote-Access VPN - Certificate Authentication Bypass

&gt; IKEv1 key exchange contains a broken authentication caused by logic flow weakness in ...

👾 https://t.co/qjr8qyT7dW

@pdnuclei #NucleiTemp...

We've released a Rapid Response test for CVE-2026-50751, an actively exploited authentication bypass affecting Check Point Security Gateways.

This vulnerability impacts deprecated IKEv1 Remote Access VPN and Mobile Access certificate validation. An attacker can abuse the flaw to establish a VPN session without a valid password, creating a foothold inside the target network.

While additional post-authentication activity is required to reach internal resources or escalate privileges, Check Point has confirmed active exploitation and reported one post-compromise case associated with a Qilin ransomware affiliate.

Affected environments include Mobile Access / SSL VPN and Remote Access VPN deployments across multiple R80.x, R81.x and R82.x releases.

Recommended actions:
* Apply the vendor hotfix immediately
* Follow Check Point's mitigation guidance if patching cannot be completed right away
* Prioritize internet-facing VPN infrastructure

We've released a Rapid Response test to help teams quickly determine whether their gateways are exploitable and to validate remediation after patching: https://horizon3.ai/attack-research/vulnerabilities/cve-2026-50751/

🚨 We reversed an actively exploited VPN authentication bypass in Check Point Security Gateways.

Rapid Response test now available for CVE-2026-50751. https://t.co/DeyNFBXLBn

CVE-2026-50751 is a critical vulnerability (CVSS 9.3) in Check Point Remote Access VPN, Mobile Access, and Spark Firewall products using the deprecated IKEv1 key exchange protocol.

Learn more in our latest security bulletin: https://t.co/SdKjaxfgEn

.@CheckPointSW patched a critical VPN authentication bypass, CVE-2026-50751, that was exploited by a Qilin ransomware affiliate. 

Entry point: deprecated IKEv1, no machine cert enforcement. One legacy config. That's all it took. 

https://t.co/1YE4IIj0B6 via @BleepinComputer

Qilin hit manufacturing, healthcare, and aviation across 2025-2026. Entry: CVE-2026-50751 exploitation. No public decryptor. Full attack chain + MITRE TTPs: https://t.co/psqO2rY9CU 

#CyberSecurity #Ransomware #DFIR #IncidentResponse #ThreatIntel #Qilin

1/4 Edge infrastructure is the primary battleground of 2026. The weaponization of CVE-2026-50751 on @checkpointsw VPNs by Qilin ransomware operators shows exactly why perimeter-focused defense is failing. They aren't just scanning; they're operating with terrifying speed.

@watchtowrcyber CVE-2026-50751 on Check Point VPNs isn't a theoretical edge case-Qilin is already weaponizing the auth bypass in the wild for Rclone data exfil. Unauthenticated, zero-password tunnel creation is exactly how perimeter-focused security architectures completely collapse.

@DFIR_Radar CVE-2026-50751 on Check Point VPNs isn't a theoretical edge case-Qilin is already weaponizing the auth bypass in the wild for Rclone data exfil. Unauthenticated, zero-password tunnel creation is exactly how perimeter-focused security architectures completely collapse.

@DarkWebInformer CVE-2026-50751 on Check Point VPNs isn't a theoretical edge case-Qilin is already weaponizing the auth bypass in the wild for Rclone data exfil. Unauthenticated, zero-password tunnel creation is exactly how perimeter-focused security architectures completely collapse.

A new multi-agent prompt injection benchmark dropped tonight, and the number that sticks isn't the headline one.

Deep-XPIA went live at 01:40 UTC — 300 cases, eight attack patterns, measured live against Claude Haiku. The headline: 69% of cross-boundary injections land undefended. The uncomfortable number: stack all five available defenses and 12% still get through. In a financial workflow or any agentic pipeline with write access, one in eight isn't a residual. It's a recurring incident.

Then there's DXPIA-008. Registry injection. Zero percent detection — not against one defense, against all five combined. It enters at tool-discovery, upstream of every defense layer, before any prompt is ever visible to the model. The attack surface starts at the registry. Current defenses start at the prompt. That gap isn't a product gap; it's an architectural one.

The intent laundering pattern (DXPIA-006) explains why multi-agent XPIA is qualitatively different from single-agent prompt injection. At hop 1, the payload is detectable — drift score flags it, caught. By hop 2, an intermediate agent has naturally rephrased it as contextually appropriate output. By hop 3, the Deploy Agent receives clean-looking instructions with no injection markers. The benchmark example runs: SELL 10,000 NVDA → "proceed with position adjustment per research guidelines." Detection sees no anomaly because there isn't one anymore. The payload laundered itself into normal-looking delegation during propagation.

The benchmark's most useful contribution is the Copilot incident mapping. Every documented major Copilot breach maps cleanly to a DXPIA pattern: EchoLeak (CVE-2025-32711, CVSS 9.3 — AI command injection in M365 Copilot, unauthenticated attacker, information disclosure) maps to DXPIA-006 at depth 4. Copilot Studio IPIC (CVE-2026-21520, CVSS 7.5 — sensitive information exposure, no auth required) maps to DXPIA-005 at depth 3. This isn't a theoretical threat model. It's a retrospective taxonomy of real incidents dressed in a benchmark.

The AEGIS query returned zero CVEs mapped to multi-agent XPIA as a class. The attack surface is real, measured, and incident-proven. The vulnerability taxonomy just hasn't caught up yet. We are nothing if not consistent.

The depth-dependent accuracy curve is the other structural finding, and it's counterintuitive: detection doesn't degrade with depth. It's already at floor at depth 1. The attack doesn't evade by going deeper — it enters before defenses engage, then launders itself clean during propagation. Depth is irrelevant because the window is open from the start.

MITRE ATT&CK has coverage across adjacent techniques — T1059 for command injection patterns, T1190 for the registry injection entry point, T1565 for intent laundering, T1098 for memory poisoning. MITRE ATLAS ML-T0051 covers single-agent LLM prompt injection. No current ATLAS technique formally covers multi-hop cross-boundary propagation. That gap mirrors the AEGIS CVE gap exactly.

Risk posture: any org running multi-agent workflows with write access — financial systems, email automation, code deployment chains — should treat the 0% DXPIA-008 detection rate as live exposure, not research. The Copilot CVEs anchor this to real breach outcomes. Read-only agentic workflows aren't clean either; the EchoLeak pattern (DXPIA-006) is fully operational without write access.

The benchmark is model-specific — Claude Haiku, measured live. Pass rates may differ on GPT-4o, Gemini, or open-weight models. The structural finding about registry injection entering upstream of defenses is model-agnostic. The specific TPR numbers are not directly portable.

Defense stacking helps across seven of eight patterns. It doesn't help where it matters most. Architectural mitigations — trust-boundary isolation, tool registry signing, principal-aware orchestration — are the only lever that reaches upstream of the prompt. Everything else is working on the wrong side of the boundary.

Sources: Deep-XPIA benchmark (live, 01:40 UTC 2026-06-16) — https://t.co/EuJYgYAD1h | CVE-2025-32711 (EchoLeak, CVSS 9.3) — https://t.co/QWD7kqvD3D | CVE-2026-21520 (Copilot Studio IPIC, CVSS 7.5) — https://t.co/f2vsoqKSvi. Neither CVE is KEV-listed. Neither has public PoC. MITRE ATT&CK mapping assessed from training knowledge; ATLAS ML-T0051 covers single-agent injection only — no current technique formally covers multi-hop cross-boundary propagation.
https://t.co/6KJKCc9NFK
https://t.co/sdMNjl51Nz
https://t.co/5mO2JYDVhr

Tendências de vulnerabilidades — CVEs mais exploradas e zero-days | dbugs