Generated 8 findings · 3 CVEs
On this page

Exploitation Report

Executive Summary

Active exploitation campaigns are targeting critical infrastructure and enterprise systems across multiple vectors. A NetScaler zero-day (CVE-2026-88779) has been exploited in targeted attacks against SAML deployments, while Rejetto HFS servers face active scanning and exploitation attempts for a critical session forgery flaw (CVE-2026-61500) that enables remote code execution. Microsoft issued out-of-band updates for Exchange Server privilege escalation (CVE-2026-96940). The linked report says exploitation has not been observed; Microsoft assesses future exploitation as more likely. Meanwhile, threat actors are weaponizing both old and new SharePoint vulnerabilities for ransomware deployment, and a Realtek Jungle SDK flaw is being exploited to deliver the Cling botnet with novel STUN-based command-and-control infrastructure.

China-aligned threat group TA419 is conducting sophisticated adversary-in-the-middle phishing campaigns against U.S. AI policy experts, impersonating prominent officials and Anthropic employees. The suspected China-linked actor Warlock continues exploiting SharePoint flaws against critical infrastructure, government, and education sectors in Portuguese- and Spanish-speaking countries. The ShinyHunters extortion group faces disruption with the reported detention of a key member in Jordan who is cooperating with the FBI. Additionally, IoT devices are being compromised at scale through 24 known vulnerabilities to form proxy networks via the ClingSTUN operation.

Active Exploitation Details

HighActive exploitationPatchCVE-2026-88779#

  • Description: A memory overflow vulnerability in Citrix NetScaler ADC and NetScaler Gateway that can lead to denial-of-service conditions. Researchers are investigating whether it can also be exploited for remote code execution. The flaw specifically impacts SAML deployments.
  • Impact: Attackers can knock SAML deployments offline, disrupting authentication services. Potential for remote code execution remains under investigation.
  • Status: Emergency security updates released by Citrix. Actively exploited in targeted zero-day attacks.

CriticalActive exploitationPatchCVE-2026-61500#

  • Description: A critical vulnerability in Rejetto HTTP File Server (HFS) stemming from a weak pseudo-random number generator (PRNG) that produces predictable signing keys. This enables session forgery, administrative account takeover, and remote code execution.
  • Impact: Attackers can forge admin sessions, take over accounts, and achieve remote code execution on vulnerable HFS servers.
  • Status: Actively scanned and exploited in the wild per VulnCheck telemetry. CVSS 9.3.

HighNot observedPatchCVE-2026-96940#

  • Description: Weak authorization in Microsoft Exchange Server allows an authenticated attacker to elevate privileges and read other users' mailboxes under certain conditions.
  • Impact: Authenticated attackers can escalate privileges to access and read mailboxes of other users, compromising email confidentiality.
  • Status: Microsoft released out-of-band updates. No evidence of exploitation in the wild was reported; the Exploitation More Likely assessment describes risk, not confirmed attacks.
  • Affected Versions: Microsoft Exchange Server Subscription Edition RTM; Microsoft Exchange Server 2016 Cumulative Update 23; Microsoft Exchange Server 2019 Cumulative Update 15; Microsoft Exchange Server 2019 Cumulative Update 14
  • Exceptions: Exchange Online already received a service-side fix and needs no customer action. Cross-tenant access is not enabled by this flaw.
  • Recommended Actions: Install the security updates on affected on-premises Exchange Server deployments.

CriticalObservedPatch#

  • Description: A critical vulnerability in the Dell System Update (DSU) command-line interface deployment tool that allows attackers to gain root privileges.
  • Impact: Local or remote attackers can achieve root-level code execution on affected systems.
  • Status: Dell has warned customers to patch as soon as possible.

CriticalActive exploitationPatch#

  • Description: A now-patched critical security flaw in the Realtek Jungle software development kit (SDK) being exploited to deploy the Cling botnet malware. The botnet repurposes ordinary STUN (Session Traversal Utilities for NAT) behavior into a practical command-and-control channel.
  • Impact: Compromised IoT devices are enrolled into a botnet with resilient STUN-based C2 infrastructure that obscures communications.
  • Status: Vulnerability is patched; exploit attempts observed in the wild delivering Cling botnet.

HighActive exploitationPatch#

  • Description: Suspected China-linked threat actor Warlock is weaponizing both old and new Microsoft SharePoint vulnerabilities to disable security tools and deploy ransomware.
  • Impact: Ransomware deployment, security tool disablement, compromise of critical infrastructure, government, and education organizations.
  • Status: Active exploitation observed by Symantec and Carbon Black Threat Hunter Team targeting Portuguese- and Spanish-speaking countries.

HighActive exploitationPatch#

  • Description: A Linux backdoor operation exploiting 24 known vulnerabilities in IoT devices to compromise them and repurpose legitimate public STUN servers as proxy nodes to obscure communications.
  • Impact: Large-scale IoT device compromise for proxy networks, enabling further attacks while hiding origin.
  • Status: Active exploitation of known flaws across IoT device fleets.

CriticalActive exploitationInvestigate#

  • Description: An actively exploited zero-day vulnerability in FortiMail referenced in weekly threat recap.
  • Impact: Details not fully disclosed; active exploitation confirmed.
  • Status: Actively exploited; patch status unclear from available reporting.

Affected Systems and Products

Attack Vectors and Techniques

Threat Actor Activities