Generated · Archived snapshot 8 findings · 3 CVEs
On this page

Exploitation Report

Executive Summary

CISA has added a critical authentication bypass in Cisco Catalyst SD-WAN Manager (CVE-2026-76504, CVSS 9.8) to its Known Exploited Vulnerabilities catalog following confirmed active exploitation. Cisco and CISA both report that attackers are leveraging this zero-day flaw to gain unauthenticated administrative API access, and fixed releases are available with no workaround. Simultaneously, Microsoft Security Research has documented active exploitation of a Zimbra Collaboration Suite command injection flaw (CVE-2026-73570, CVSS 8.9) to deploy web shells and harvest mailbox data. A public proof-of-concept has also emerged for an Apple CoreGraphics vulnerability (CVE-2026-86950) that Apple acknowledges may have been used in targeted attacks against specific individuals via malicious PDFs.

Beyond these actively exploited CVEs, multiple high-impact campaigns are underway. Russian state actor Star Blizzard has adopted a novel "RedFlick" technique to deliver its CosmicPulse backdoor. The Dutch Institute for Vulnerability Disclosure confirmed its network was breached through a chain of two zero-days in the Zammad ticketing system. A 16-year-old alleged administrator of the KillSec ransomware group was arrested in Spain during "Operation KillSwitch," which seized the group's leak site and servers. Meanwhile, Bitget disclosed a $387.5 million cryptocurrency theft enabled by a zero-day in third-party security products, and researchers uncovered a self-healing WordPress backdoor that rebuilds itself from files, database, and shared memory.

Active Exploitation Details

CriticalActive exploitationPatchCVE-2026-76504#

  • Description: Critical authentication bypass vulnerability in Cisco Catalyst SD-WAN Manager that allows an unauthenticated, remote attacker to access the affected system with administrative privileges via the Manager's API.
  • Impact: Full administrative control over SD-WAN management plane, enabling network manipulation, traffic interception, and lateral movement across managed infrastructure.
  • Status: Actively exploited in the wild; fixed releases available from Cisco; no workaround exists; added to CISA KEV catalog.

HighActive exploitationPatchCVE-2026-73570#

  • Description: Unauthenticated operating system command injection flaw in Zimbra Collaboration Suite (ZCS) that can lead to remote code execution when Simple Network Management Protocol (SNMP) is enabled.
  • Impact: Attackers deploy web shells and access mailbox data, enabling persistent access, email exfiltration, and credential harvesting.
  • Status: Now-patched vulnerability being actively weaponized; Microsoft Security Research observed exploitation across multiple environments.

Severity unknownObservedInvestigateCVE-2026-86950#

  • Description: Memory corruption flaw in Apple CoreGraphics triggered by a malicious PDF with a crafted embedded font, causing crashes on unpatched iPhones and Macs.
  • Impact: Denial-of-service via application crash; Apple states the flaw may have been used in attacks against specific targeted individuals; public proof-of-concept now available.
  • Status: PoC published; Apple acknowledges possible targeted exploitation; patch status not specified in source.

CriticalStatus unknownPatch#

  • Description: Maximum-severity code injection vulnerability among 126 flaws patched in Kiteworks Email Protection Gateway (EPG) security solution.
  • Impact: Remote code execution potential on the email protection gateway, enabling email interception, modification, and network pivot.
  • Status: Security updates released addressing all 126 vulnerabilities; exploitation status not specified in source.

CriticalActive exploitationPatch#

  • Description: Critical pre-authentication command injection vulnerability in Citrix NetScaler ADC and NetScaler Gateway.
  • Impact: Threat actors drop web shells, create superuser accounts, map web shells to CSS-like URLs for stealth, and attempt theft of configuration data.
  • Status: Actively exploited across multiple customer environments; LevelBlue THOR team analyzed post-exploitation payloads.

CriticalPotentialPatch#

  • Description: Critical pre-authentication remote code execution vulnerability in MikroTik RouterOS that could also cause denial-of-service.
  • Impact: Unauthenticated remote code execution on routing infrastructure, enabling network compromise, traffic manipulation, and persistence.
  • Status: CISA warning issued; exploitation status not explicitly confirmed in source.

CriticalActive exploitationInvestigate#

  • Description: Chain of two zero-day vulnerabilities in the open-source Zammad ticketing system.
  • Impact: Enabled AI-driven network breach of the Dutch Institute for Vulnerability Disclosure (DIVD); full network compromise achieved.
  • Status: Two zero-days exploited in combination; DIVD confirmed breach; CVE IDs not yet assigned in public reporting.

CriticalActive exploitationInvestigate#

  • Description: Zero-day vulnerability in third-party security products used by cryptocurrency exchange Bitget.
  • Impact: $387.5 million cryptocurrency theft; attackers used customized tooling; SlowMist investigation recovered malicious artifacts.
  • Status: Actively exploited in targeted attack; specific product and CVE not disclosed.

Affected Systems and Products

Attack Vectors and Techniques

Threat Actor Activities