Generated · Archived snapshot 10 findings · 2 CVEs
On this page

Exploitation Report

Executive Summary

Critical exploitation activity is ongoing across multiple fronts, with two high-severity vulnerabilities confirmed as actively exploited in the wild. Fortinet FortiMail CVE-2026-104286, a zero-day allowing unauthenticated arbitrary file writes, has been added to CISA's Known Exploited Vulnerabilities catalog following confirmed attacks. Simultaneously, Dell Container Storage Modules (CSM) CVE-2026-63688 carries a maximum CVSS 10.0 score and enables unauthenticated administrative access and root compromise on Kubernetes nodes.

China-nexus threat actors are conducting sustained campaigns leveraging both known and zero-day vulnerabilities. The Warlock ransomware group continues weaponizing Microsoft SharePoint flaws—described as both old and new—to breach critical infrastructure, government, water utilities, telecom providers, and educational institutions across Portuguese- and Spanish-speaking regions. Separately, TA419 employs adversary-in-the-middle (AitM) phishing impersonating AI policymakers and Anthropic employees to harvest credentials from U.S. think tanks and universities, while the newly documented Antino backdoor uses Outlook and OneDrive for command-and-control in espionage targeting government entities across seven Asian nations.

Active Exploitation Details

CriticalActive exploitationPatchCVE-2026-104286#

  • Description: An improper neutralization vulnerability in Fortinet FortiMail that allows unauthenticated attackers to write arbitrary files on the underlying system. The flaw carries a CVSS score of 9.8 and was exploited as a zero-day before disclosure.
  • Impact: Attackers can achieve unauthenticated arbitrary file writes on FortiMail appliances, potentially leading to remote code execution, persistent access, and full system compromise without requiring credentials.
  • Status: Actively exploited in the wild; added to CISA Known Exploited Vulnerabilities catalog. Fortinet has released patches.

CriticalNot observedPatchCVE-2026-63688#

  • Description: Multiple critical vulnerabilities in Dell Container Storage Modules (CSM) that connect Dell enterprise storage arrays to Kubernetes environments. CVE-2026-63688 is a missing authentication for critical function vulnerability in the csm-authorization-storage gRPC server with a CVSS score of 10.0.
  • Impact: Unauthenticated attackers can gain administrative access and achieve root compromise on Kubernetes nodes, enabling full control over storage infrastructure and containerized workloads.
  • Status: Patches released; Dell urges immediate patching. No public exploitation reported at time of advisory.

HighActive exploitationPatch#

  • Description: The China-linked Warlock ransomware group is actively exploiting Microsoft SharePoint vulnerabilities—characterized as both older known flaws and likely new zero-days—to gain initial access, disable security tools, and deploy ransomware across targeted sectors.
  • Impact: Initial access to critical infrastructure, government, education, water utilities, and telecommunications organizations; security tool disablement; ransomware deployment and data encryption.
  • Status: Actively exploited in ongoing campaigns observed by Symantec and Carbon Black Threat Hunter Team. Specific CVE identifiers not disclosed in reporting.

HighActive exploitationMitigate#

  • Description: China-nexus espionage group TA419 conducts credential phishing campaigns using adversary-in-the-middle (AitM) techniques targeting AI policy experts at U.S. think tanks, universities, and legal sector organizations. Campaigns impersonate prominent economists, AI policymakers, and an Anthropic employee.
  • Impact: Credential theft and account compromise of high-value targets in AI policy and research sectors; potential follow-on espionage and intellectual property theft.
  • Status: Active campaigns observed; no software vulnerability exploited—relies on social engineering and AitM phishing infrastructure.

HighActive exploitationInvestigate#

  • Description: A previously undocumented backdoor codenamed Antino is deployed by a China-nexus threat actor against government and policy organizations across Taiwan, India, the Philippines, Cambodia, Pakistan, Thailand, and Myanmar. The backdoor uses Microsoft Outlook and OneDrive for command-and-control communications, blending with legitimate traffic.
  • Impact: Persistent remote access, data exfiltration, and espionage against government and policy entities in Asia; stealthy C2 via trusted cloud services.
  • Status: Active campaign tracked by Cisco Talos; no specific vulnerability exploited—malware delivery vector not specified in reporting.

CriticalNot observedPatch#

  • Description: A critical remote code execution vulnerability in GitLab's AI Gateway service (CVSS 9.9) that allows a logged-in user with Duo Agent Platform access to execute arbitrary commands on the gateway under certain conditions. Affects self-hosted GitLab instances running their own AI Gateway.
  • Impact: Arbitrary command execution on the AI Gateway server, potentially leading to lateral movement, data access, and supply chain compromise.
  • Status: Patched in gateway versions 19.2.4, 19.3.2, and 19.4.1. No active exploitation reported at time of advisory.

HighObservedInvestigate#

  • Description: Attackers exploited a vulnerability in third-party software used by Frontline Education to gain unauthorized access to systems and steal employee information including Social Security numbers for school district employees.
  • Impact: Exposure of sensitive personally identifiable information (PII) including Social Security numbers for education sector employees across multiple districts.
  • Status: Breach confirmed and notifications underway; specific third-party software and CVE not identified in reporting.

HighObservedInvestigate#

  • Description: Hackers accessed DTU's identity and access management system and downloaded a large volume of data potentially affecting up to 200,000 users.
  • Impact: Large-scale exposure of user data from a major European university's identity infrastructure.
  • Status: Breach confirmed; attack vector and specific vulnerability not disclosed in reporting.

CriticalNot observedPatch#

  • Description: Remote code execution vulnerabilities in middleware used in SWIFT banking and government environments that could enable hardware-based MFA bypass in ultra-sensitive environments.
  • Impact: Potential RCE in financial messaging infrastructure; possible bypass of hardware-based multi-factor authentication.
  • Status: Patches available; urgent patching recommended. No active exploitation confirmed in reporting.

CriticalActive exploitationPatch#

  • Description: Zero-day vulnerabilities in Kiteworks data-protection platform and Citrix products that demonstrated challenges in zero-day response. One vendor instructed customers to power down the platform during a nine-hour window; the other remained silent on reported attacks prior to patch release.
  • Impact: Active exploitation of zero-days in file transfer and virtual desktop infrastructure; operational disruption from emergency mitigation measures.
  • Status: Patches eventually released; active exploitation confirmed for at least one zero-day during the response window.

Affected Systems and Products

Attack Vectors and Techniques

Threat Actor Activities