Find what you’re looking for

CISA Highlights Five Actively Exploited Vulnerabilities in March 2026

In March 2026, the Cybersecurity and Infrastructure Security Agency (CISA) added five vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, indicating active exploitation. These include CVE-2025-31277 and CVE-2025-43520, both affecting Apple products with buffer overflow vulnerabilities that could lead to arbitrary code execution. CVE-2025-32432 pertains to Craft CMS, allowing code injection through improper input validation. CVE-2025-43510, another Apple-related issue, involves improper locking, potentially causing unexpected memory changes. Lastly, CVE-2025-54068 affects Laravel Livewire, enabling arbitrary code injection via the component hydration process. The inclusion of these vulnerabilities underscores the persistent threat posed by unpatched software. Organizations are urged to prioritize remediation to mitigate risks associated with these actively exploited flaws. This action aligns with CISA's Binding Operational Directive 22-01, emphasizing the importance of addressing known vulnerabilities to protect federal networks and urging all organizations to adopt similar practices.

Critical Vulnerability in Cisco Secure Firewall Management Center: CVE-2026-20131

In March 2026, a critical vulnerability (CVE-2026-20131) was identified in the web-based management interface of Cisco Secure Firewall Management Center (FMC) Software. This flaw allows unauthenticated, remote attackers to execute arbitrary Java code as root by exploiting insecure deserialization of user-supplied Java byte streams. Successful exploitation could lead to full system compromise, granting attackers complete control over affected devices. ([sec.cloudapps.cisco.com](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fmc-rce-NKhnULJh?utm_source=openai)) The vulnerability underscores the persistent risks associated with deserialization flaws in network management systems. Organizations are urged to apply Cisco's security patches promptly and restrict public internet access to FMC management interfaces to mitigate potential exploitation. ([sec.cloudapps.cisco.com](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fmc-rce-NKhnULJh?utm_source=openai))

GSocket Backdoor Delivered Through Bash Script

In March 2026, a malicious Bash script was discovered installing a GSocket backdoor on compromised systems. GSocket, a networking tool, enables peer-to-peer communication using a shared secret, bypassing traditional security controls. The script downloads and executes a copy of gs-netcat, establishing a connection to a remote server. It employs persistence mechanisms such as cron jobs and modifications to the .profile file, ensuring the backdoor remains active. Additionally, the script utilizes anti-forensic techniques by manipulating file timestamps to conceal its activities. This incident underscores the evolving sophistication of malware targeting Unix-based systems, including Linux and macOS, and highlights the need for vigilant security practices to detect and mitigate such threats.

EDR Killer Malware Exploits Vulnerable Drivers to Disable Security Tools

In early February 2026, threat actors exploited compromised SonicWall SSLVPN credentials to infiltrate a corporate network. Once inside, they deployed a custom 'EDR killer' malware that utilized a signed but revoked EnCase forensic driver to disable 59 endpoint detection and response (EDR) and antivirus tools. This 'Bring Your Own Vulnerable Driver' (BYOVD) technique allowed attackers to gain kernel-level access, effectively neutralizing security defenses and facilitating further malicious activities. The intrusion was disrupted before ransomware deployment, but it underscores the growing trend of adversaries weaponizing legitimate drivers to bypass endpoint security measures. ([huntress.com](https://www.huntress.com/blog/encase-byovd-edr-killer?utm_source=openai)) This incident highlights the critical need for organizations to enforce multi-factor authentication (MFA) on VPN access, regularly update and monitor security tools, and implement strict controls over driver installations to prevent the exploitation of vulnerable drivers. ([helpnetsecurity.com](https://www.helpnetsecurity.com/2026/02/05/edr-killer-vulnerable-encase-driver/?utm_source=openai))

Magento's 'SessionReaper' Vulnerability: A Critical Threat to E-Commerce Security

In October 2025, a critical vulnerability known as 'SessionReaper' (CVE-2025-54236) was discovered in Adobe Commerce and Magento Open Source platforms. This flaw, stemming from improper input validation, allows unauthenticated attackers to execute arbitrary code via the Commerce REST API, leading to potential full system compromise and unauthorized access to sensitive customer data. Despite Adobe releasing a patch in September 2025, reports indicate that as of late October, approximately 62% of Magento stores had not applied the necessary fixes, leaving them vulnerable to exploitation. ([threatprotect.qualys.com](https://threatprotect.qualys.com/2025/10/24/adobe-magento-improper-input-validation-vulnerability-exploited-in-attack-cve-2025-54236/?utm_source=openai)) The active exploitation of SessionReaper underscores the critical importance of timely patch management in e-commerce platforms. With attackers increasingly targeting unpatched systems, organizations must prioritize the application of security updates to mitigate risks associated with such vulnerabilities.

Insider Threat: North Carolina Tech Worker Convicted in $2.5M Data Extortion Case

In December 2023, Cameron Curry, a 25-year-old contract employee from North Carolina, exploited his access to a Washington D.C.-based technology company's sensitive data. Upon learning his contract would not be renewed, Curry stole confidential employee information and, under the alias "Loot," sent over 60 emails threatening to publish the data unless a $2.5 million ransom was paid. The company reported the extortion to the FBI on December 14, 2023, and subsequently paid the ransom in January 2024. Curry was arrested on January 24, 2024, after authorities traced the extortion communications and cryptocurrency transactions back to him. He pleaded guilty to felony extortion on September 27, 2024, and faces sentencing on January 28, 2025. This incident underscores the significant risks posed by insider threats, especially when employees or contractors have access to sensitive information. Organizations must implement robust access controls, monitor for unusual activities, and foster a culture of security awareness to mitigate such risks.

Justice Department Dismantles Major Botnets in 2026

In March 2026, the U.S. Department of Justice, in collaboration with international law enforcement agencies, successfully dismantled four major botnets—Aisuru, Kimwolf, JackSkid, and Mossad—that collectively hijacked over 3 million devices worldwide. These botnets were responsible for launching more than 300,000 distributed denial-of-service (DDoS) attacks, including record-breaking incidents such as a 31.4 terabits-per-second attack attributed to Aisuru. The compromised devices included digital video recorders, web cameras, Wi-Fi routers, and TV boxes, many of which were located in the United States. The operation involved seizing the command-and-control infrastructure, effectively disrupting the botnets' ability to launch further attacks. This takedown underscores the escalating threat posed by large-scale botnets and highlights the critical need for robust cybersecurity measures to protect internet-connected devices from exploitation. The incident also reflects a growing trend of cybercriminals leveraging vast networks of compromised devices to conduct massive DDoS attacks, emphasizing the importance of international cooperation in combating cyber threats.

Schneider Electric's 2026 Hard-Coded Credentials Vulnerability: What You Need to Know

In March 2026, Schneider Electric disclosed a critical vulnerability in its EcoStruxure IT Data Center Expert software, identified as CVE-2025-13957. This flaw involves hard-coded credentials that, if exploited, could lead to information disclosure and remote code execution, particularly when the SOCKS Proxy feature is enabled. The affected versions include EcoStruxure IT Data Center Expert v9.0 and prior. Schneider Electric has released version 9.1 to address this issue and recommends users update promptly to mitigate potential risks. ([cyber.gc.ca](https://www.cyber.gc.ca/en/alerts-advisories/control-systems-schneider-electric-security-advisory-av26-210?utm_source=openai)) This incident underscores the persistent threat posed by hard-coded credentials in critical infrastructure software. Organizations are urged to review their systems for similar vulnerabilities and implement robust credential management practices to prevent unauthorized access and potential operational disruptions.

Siemens SICAM SIAPP SDK Vulnerabilities: What You Need to Know

In March 2026, Siemens disclosed multiple vulnerabilities in its SICAM SIAPP SDK versions prior to 2.1.7. These vulnerabilities include out-of-bounds write, stack-based buffer overflow, improper handling of length parameter inconsistency, and external control of file name or path. Exploitation could lead to denial of service, data corruption, or arbitrary code execution. Siemens has released version 2.1.7 to address these issues and recommends users update promptly. ([cert-portal.siemens.com](https://cert-portal.siemens.com/productcert/html/ssa-903736.html?utm_source=openai)) This incident underscores the critical importance of timely software updates and robust input validation in industrial control systems to prevent potential exploitation and ensure operational integrity.

Interlock Ransomware's 2026 Exploitation of Cisco Firewall Vulnerability

In early 2026, the Interlock ransomware group exploited a zero-day vulnerability (CVE-2026-20131) in Cisco Secure Firewall Management Center (FMC) Software, allowing unauthenticated remote code execution as root. This critical flaw, due to insecure deserialization of user-supplied Java byte streams, enabled attackers to gain full control over affected devices. The exploitation began on January 26, 2026, 36 days prior to Cisco's public disclosure on March 4, 2026. Interlock's campaign involved deploying custom remote access trojans, reconnaissance scripts, and evasion techniques, leading to significant operational disruptions for targeted organizations. ([sec.cloudapps.cisco.com](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fmc-rce-NKhnULJh?utm_source=openai)) This incident underscores the persistent threat posed by ransomware groups leveraging zero-day vulnerabilities. Organizations must prioritize timely patching, implement defense-in-depth strategies, and maintain continuous threat monitoring to mitigate such risks.

Claude Code's 2026 Security Flaw: A Wake-Up Call for Agentic AI

In February 2026, a critical vulnerability (CVE-2026-24052) was identified in Claude Code, an agentic coding tool developed by Anthropic. The flaw involved insufficient URL validation in the trusted domain verification mechanism for WebFetch requests. Specifically, the application used the `startsWith()` function to validate trusted domains, allowing attackers to register subdomains that could bypass this validation. This vulnerability enabled automatic requests to attacker-controlled domains without user consent, potentially leading to data exfiltration. Anthropic addressed this issue by releasing a patch in version 1.0.111. ([nvd.nist.gov](https://nvd.nist.gov/vuln/detail/CVE-2026-24052?utm_source=openai)) This incident underscores the growing security challenges associated with agentic AI systems, which operate autonomously and can interact with external resources. The exploitation of such vulnerabilities highlights the need for robust validation mechanisms and comprehensive security assessments in AI-driven tools to prevent unauthorized data access and exfiltration.

DarkSword iOS Exploit Kit: A New Threat in 2026

In early 2026, cybersecurity researchers discovered 'DarkSword,' an advanced iOS exploit kit attributed to Russian hackers. This toolkit repurposes vulnerabilities believed to have been originally developed by the U.S. government. DarkSword targets iOS devices through sophisticated attack chains, enabling unauthorized access to sensitive user data, including messages, passwords, and cryptocurrency wallets. The exploit kit has been deployed in espionage campaigns against individuals in Ukraine, Saudi Arabia, Turkey, and Malaysia, affecting potentially millions of iPhone users worldwide. The emergence of DarkSword underscores the escalating trend of nation-state actors leveraging leaked or repurposed cyber tools to conduct widespread surveillance and financial theft. This incident highlights the critical need for robust cybersecurity measures and timely software updates to mitigate the risks posed by such sophisticated threats.