Generated · Archived snapshot 7 findings · 3 CVEs
On this page

Exploitation Report

Executive Summary

The current report covers confirmed exploitation alongside vulnerabilities with no observed exploitation. A zero-day in Citrix NetScaler (CVE-2026-88779) has been weaponized in targeted attacks against SAML deployments, prompting emergency patches. Microsoft issued out-of-band updates for Exchange Server privilege escalation (CVE-2026-96940). The linked report says exploitation has not been observed; Microsoft assesses future exploitation as more likely. The Rejetto HTTP File Server flaw (CVE-2026-61500) is undergoing active exploitation attempts leveraging predictable session keys for remote code execution.

Simultaneously, multiple threat actors are conducting sustained campaigns. China-aligned TA419 is targeting U.S. AI policy experts through adversary-in-the-middle phishing that impersonates legitimate officials and Anthropic employees. The suspected China-linked Warlock group continues weaponizing Microsoft SharePoint vulnerabilities—both older and newer flaws—to disable security tools and deploy ransomware across Portuguese- and Spanish-speaking critical infrastructure, government, and education sectors. The Cling botnet operators are exploiting a now-patched critical Realtek Jungle SDK vulnerability, innovating with STUN-based command-and-control channels.

Law enforcement actions have disrupted two notable operations: the alleged developer of Ploutus ATM jackpotting malware appeared in U.S. court, and a suspected ShinyHunters member known as "Rey" was detained in Jordan while cooperating with the FBI. Large-scale data breaches continue to surface, including Denmark's population registry exposing 8.8 million records, a Danish university breach affecting 200,000 individuals, and Frontline Education's compromise of school district employee data via third-party software exploitation.

Active Exploitation Details

HighActive exploitationPatchCVE-2026-88779#

  • Description: A memory overflow vulnerability in Citrix NetScaler ADC and NetScaler Gateway that can lead to denial of service and is under investigation for potential remote code execution. The flaw resides in SAML authentication processing and has been exploited as a zero-day in targeted attacks.
  • Impact: Attackers can knock SAML deployments offline, disrupting authentication for affected organizations. Researchers are investigating whether the memory overflow can be leveraged for remote code execution, which would significantly increase impact.
  • Status: Emergency security updates released by Citrix. Actively exploited in targeted zero-day attacks prior to patch availability.

HighNot observedPatchCVE-2026-96940#

  • Description: Weak authorization in Microsoft Exchange Server allows an authenticated attacker to elevate privileges over a network. The flaw enables attackers to read other users' mailboxes after authenticating with valid credentials.
  • Impact: Authenticated attackers can access and read email communications of other users within the same Exchange environment, compromising confidentiality of sensitive communications.
  • Status: Microsoft released out-of-band updates. No evidence of exploitation in the wild was reported; the Exploitation More Likely assessment describes risk, not confirmed attacks.
  • Affected Versions: Microsoft Exchange Server Subscription Edition RTM; Microsoft Exchange Server 2016 Cumulative Update 23; Microsoft Exchange Server 2019 Cumulative Update 15; Microsoft Exchange Server 2019 Cumulative Update 14
  • Exceptions: Exchange Online already received a service-side fix and needs no customer action. Cross-tenant access is not enabled by this flaw.
  • Recommended Actions: Install the security updates on affected on-premises Exchange Server deployments.

CriticalActive exploitationPatchCVE-2026-61500#

  • Description: A critical session forgery vulnerability stemming from a weak pseudo-random number generator (PRNG) that produces predictable session keys. Attackers can forge administrative sessions and achieve remote code execution on affected Rejetto HFS instances.
  • Impact: Unauthorized administrative access and remote code execution on vulnerable HTTP File Server instances, leading to full system compromise.
  • Status: Actively exploited in the wild. VulnCheck reports active exploitation attempts. Patch status not specified in source articles.

CriticalActive exploitationPatch#

  • Description: A critical vulnerability in the Dell System Update (DSU) command-line interface deployment tool that allows attackers to gain root privileges on affected systems.
  • Impact: Local or remote attackers can escalate to root privileges, achieving full control over the compromised system.
  • Status: Dell has warned customers to patch immediately. Specific CVE not provided in source article.

CriticalActive exploitationPatch#

  • Description: A now-patched critical security flaw in the Realtek Jungle software development kit (SDK) that threat actors are attempting to exploit to deploy the Cling botnet malware. The botnet repurposes STUN (Session Traversal Utilities for NAT) behavior as a command-and-control channel.
  • Impact: Compromised devices are enrolled into the Cling botnet with stealthy C2 communications over STUN, enabling persistent remote control.
  • Status: Vulnerability is patched, but active exploitation attempts observed. No CVE provided in source article.

HighActive exploitationPatch#

  • Description: The China-linked threat actor Warlock is weaponizing both older and newer Microsoft SharePoint vulnerabilities to disable security tools and deploy ransomware. Specific CVEs not identified in source articles.
  • Impact: Security tool disablement followed by ransomware deployment affecting critical infrastructure, government, and education organizations in Portuguese- and Spanish-speaking countries.
  • Status: Active exploitation observed by Symantec and Carbon Black Threat Hunter Team. Patch status varies by specific vulnerability.

HighObservedInvestigate#

  • Description: Attackers exploited a vulnerability in third-party software used by Frontline Education to gain unauthorized access and steal employee information including Social Security numbers.
  • Impact: Exposure of school district employee PII including Social Security numbers, enabling identity theft and fraud.
  • Status: Breach confirmed and notifications sent. Specific vulnerability and patch status not detailed in source article.

Affected Systems and Products

Attack Vectors and Techniques

Threat Actor Activities