Cisco SD-WAN Zero-Day CVE-2026-20245 ExploitedCisco SD-WAN Zero-Day CVE-2026-20245 Exploited
In June 2026, a high-severity zero-day vulnerability, CVE-2026-20245, was discovered in Cisco Catalyst SD-WAN Manager. This flaw allows authenticated attackers with netadmin privileges to execute arbitrary commands as root by uploading specially crafted files. Exploitation of this vulnerability has been observed in the wild, leading to unauthorized configuration changes on edge devices. Notably, attackers have been exploiting this vulnerability for months prior to its public disclosure, highlighting significant security gaps in the SD-WAN infrastructure.
The exploitation of CVE-2026-20245 underscores a concerning trend of increasing attacks targeting SD-WAN solutions. Organizations relying on Cisco's SD-WAN products must prioritize immediate mitigation strategies, as the absence of a patch leaves systems vulnerable to potential breaches and operational disruptions.
High impact
Kill Chain
ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(low)
IImpact(low)
Kaspersky SMB Threat Report 2026: Unveiling New Cyber Threats
In early 2026, Kaspersky's analysis revealed a significant surge in cyberattacks targeting small and medium-sized businesses (SMBs). Notably, over 92,000 malware attacks were disguised as popular AI services, with fake ChatGPT applications accounting for 49% of these incidents. This trend underscores cybercriminals' exploitation of trusted AI brands to distribute malicious software. Additionally, the report highlighted a rise in 'encryption-less' extortion attacks, where attackers focus on stealing and leaking sensitive data rather than encrypting systems. The emergence of ransomware groups adopting post-quantum cryptography standards further complicates the threat landscape. ([me-en.kaspersky.com](https://me-en.kaspersky.com/about/press-releases/kaspersky-detected-more-than-92000-malware-attacks-disguised-as-ai-services-in-2026?utm_source=openai))
This escalation in sophisticated cyber threats against SMBs emphasizes the urgent need for enhanced cybersecurity measures. The increasing use of AI as a lure, coupled with advanced extortion tactics, indicates a shift in cybercriminal strategies that SMBs must proactively address to safeguard their operations and sensitive data.
High impact
Kill Chain
ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Gaslight Malware: A New Threat Targeting AI-Assisted Security on macOS
In June 2026, cybersecurity researchers identified 'Gaslight,' a Rust-based macOS malware attributed to North Korean threat actors. Gaslight employs a novel prompt injection technique, embedding 38 fabricated system messages to deceive AI-assisted malware analysis tools into aborting or refusing analysis. The malware establishes persistence via a LaunchAgent labeled 'com.apple.system.services.activity' and utilizes the Telegram Bot API for command-and-control communication. It collects sensitive data, including browser information, terminal histories, and the macOS Keychain database, exfiltrating this data through encrypted channels. ([infosecurity-magazine.com](https://www.infosecurity-magazine.com/news/macos-gaslight-rust-backdoor/?utm_source=openai))
This incident underscores the evolving tactics of threat actors who are now targeting AI-based security tools. The use of prompt injection to manipulate AI analysis represents a significant shift in cyberattack methodologies, highlighting the need for enhanced security measures to protect AI-driven systems from such adversarial inputs. ([infosecurity-magazine.com](https://www.infosecurity-magazine.com/news/macos-gaslight-rust-backdoor/?utm_source=openai))
High impact
Kill Chain
ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(low)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Cisco SD-WAN Vulnerability Exploited Two Months Before Disclosure
In March 2026, attackers began exploiting a critical vulnerability (CVE-2026-20245) in Cisco Catalyst SD-WAN, two months prior to its public disclosure. This flaw allows authenticated users with netadmin privileges to escalate to root-level access by uploading a crafted file, due to insufficient input validation in the command-line interface. Exploitation was observed in service provider environments, where attackers gained initial access via rogue peering connections, potentially by leveraging other vulnerabilities such as CVE-2026-20182 or CVE-2026-20127.
The incident underscores the increasing targeting of network infrastructure by threat actors, highlighting the necessity for organizations to promptly apply security patches and monitor for unauthorized access. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-20245 to its catalog of known exploited vulnerabilities on June 4, 2026, emphasizing the urgency of remediation efforts.
Critical impact
Kill Chain
ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
Terrabot Botnet's 2026 Exploitation of IoT Vulnerabilities
In June 2026, the Terrabot botnet, an aggressive IoT malware variant derived from Mirai and Gafgyt frameworks, was observed scanning the internet for vulnerabilities to exploit and expand its network of compromised devices. The botnet targeted known vulnerabilities in legacy D-Link DSL routers (CVE-2016-20017) and Dasan GPON routers (CVE-2018-10561), attempting unauthenticated command injections. However, due to automation errors, such as empty POST request bodies and malformed payloads, many of these exploit attempts failed, highlighting the botnet's technical limitations. ([isc.sans.edu](https://isc.sans.edu/diary?utm_source=openai))
This incident underscores the persistent threat posed by IoT botnets, even those with flawed execution, as they continue to exploit unpatched vulnerabilities in widely used devices. The rapid proliferation of such botnets emphasizes the need for robust security measures, timely patching, and vigilant monitoring to protect against automated cyber threats.
Critical impact
Kill Chain
ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(low)
IImpact(high)
Understanding 'Prompt Injection as Role Confusion' and Its Implications for AI Security
In February 2026, researchers Charles Ye, Jasmine Cui, and Dylan Hadfield-Menell published a study titled "Prompt Injection as Role Confusion," highlighting a critical vulnerability in large language models (LLMs). The study reveals that LLMs often misinterpret the source of text based on its style rather than its origin, leading to 'role confusion.' This flaw allows malicious actors to craft inputs that mimic authoritative roles, effectively bypassing safety protocols and manipulating the model's behavior. The researchers demonstrated that by injecting deceptive reasoning into user prompts and tool outputs, they achieved success rates of 60% on StrongREJECT and 61% on agent exfiltration tasks across various LLMs. This indicates a significant security gap where models assign authority in latent space, making them susceptible to prompt injection attacks. ([arxiv.org](https://arxiv.org/abs/2603.12277?utm_source=openai))
The study underscores the urgent need for enhanced security measures in AI systems, as prompt injection attacks exploit fundamental weaknesses in LLMs' role recognition. As AI integration expands across industries, understanding and mitigating such vulnerabilities is crucial to prevent unauthorized data access and manipulation. ([arxiv.org](https://arxiv.org/abs/2603.12277?utm_source=openai))
Medium impact
Kill Chain
ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
DraftKings 2022 Credential Stuffing Attack: A Case Study
In November 2022, DraftKings, a prominent fantasy sports and betting platform, experienced a credential stuffing attack that compromised approximately 60,000 user accounts. The attackers, led by Nathan Austad, known online as "Snoopy," exploited reused login credentials to gain unauthorized access. In about 1,600 cases, they added new payment methods to the compromised accounts and withdrew funds, resulting in approximately $600,000 in losses. The remaining compromised accounts were sold on cybercriminal marketplaces. Austad was sentenced to 18 months in federal prison, ordered to serve three years of supervised release, pay over $1.3 million in restitution, and forfeit an additional $463,000.
This incident underscores the persistent threat of credential stuffing attacks, particularly in the online betting industry, where user accounts often contain sensitive financial information. It highlights the critical need for robust password policies, multi-factor authentication, and user education to prevent unauthorized access and financial losses.
High impact
Kill Chain
ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Critical Check Point VPN Vulnerability Exploited by Ransomware
In May 2026, a critical authentication bypass vulnerability (CVE-2026-50751) was discovered in Check Point's Remote Access VPN and Mobile Access products, specifically affecting configurations using the deprecated IKEv1 protocol. This flaw allowed unauthenticated attackers to establish VPN sessions without valid credentials, granting them unauthorized access to internal networks. Exploitation of this vulnerability began on May 7, 2026, with at least one incident linked to a Qilin ransomware affiliate. The vulnerability was publicly disclosed on June 8, 2026, and patches were subsequently released. ([mishcon.com](https://www.mishcon.com/news/active-exploitation-of-check-point-vpn-authentication-bypass-vulnerability-cve202650751?utm_source=openai))
The incident underscores the risks associated with relying on outdated protocols and the importance of timely patching. It also highlights the evolving tactics of ransomware groups, who are increasingly exploiting vulnerabilities in widely used security products to gain initial access. Organizations must reassess their security architectures to ensure they are not solely dependent on perimeter defenses, which can be compromised through such vulnerabilities.
Critical impact
Kill Chain
ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Operation Endgame: A Major Blow to Amadey and StealC Malware Networks
In June 2026, an international coalition led by Europol, in partnership with Microsoft and other private entities, executed Operation Endgame to dismantle the infrastructure supporting the Amadey and StealC malware operations. This coordinated effort resulted in the disruption of 326 servers and 142 domains, the identification of over €41 million in illicit cryptocurrency, and the recovery of approximately 27 million stolen credentials from more than 385,000 compromised systems. The operation targeted the cybercrime assembly line, aiming to increase friction for cybercriminals and hinder their ability to conduct attacks.
The significance of this operation lies in its comprehensive approach to disrupting malware-as-a-service platforms that facilitate initial access, credential theft, and subsequent deployment of ransomware or financial fraud. By targeting the foundational infrastructure of these malware families, law enforcement and private partners have set a precedent for future collaborative efforts to combat cybercrime at its roots.
High impact
Kill Chain
ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Mistic Backdoor: A New Threat in Ransomware Attacks
In April 2026, a new backdoor named Mistic was identified in attacks targeting sectors such as insurance, education, IT, and professional services. Linked to the initial access broker KongTuke (also known as Woodgnat), Mistic facilitates unauthorized access to corporate networks, which is then sold to ransomware groups including Qilin, Interlock, Rhysida, Akira, 8Base, and Black Basta. The malware employs DLL side-loading techniques to maintain stealth and persistence, allowing attackers to execute commands, manipulate files, and exfiltrate data without detection.
The emergence of Mistic underscores a growing trend where initial access brokers develop sophisticated tools to infiltrate networks, subsequently enabling ransomware operations. This development highlights the critical need for organizations to enhance their cybersecurity measures to detect and prevent such stealthy intrusions.
High impact
Kill Chain
ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(medium)
Cisco SD-WAN Zero-Day CVE-2026-20245: Active Exploitation with No Patch Available
In June 2026, Cisco disclosed CVE-2026-20245, a high-severity zero-day vulnerability in its Catalyst SD-WAN Manager, which was actively exploited in the wild. This flaw allows authenticated attackers with netadmin privileges to upload crafted files and execute arbitrary commands as root, potentially compromising the entire SD-WAN infrastructure. The vulnerability affects all deployment types, including on-premises, Cloud-Pro, Cisco Managed Cloud, and FedRAMP environments. Notably, this marks the seventh SD-WAN zero-day exploited in 2026, highlighting a concerning trend of targeted attacks on Cisco's SD-WAN solutions. Organizations utilizing Cisco SD-WAN should prioritize mitigating this vulnerability by restricting and auditing netadmin accounts, isolating management interfaces, and monitoring for anomalous command executions. ([thecybersignal.com](https://www.thecybersignal.com/cisco-catalyst-sd-wan-manager-cve-2026-20245-zero-day-exploited-no-patch-2026/?utm_source=openai))
High impact
Kill Chain
ICInitial Compromise(medium)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
DraftKings 2022 Credential Stuffing Attack: A Case Study
In November 2022, DraftKings, a prominent sports betting platform, experienced a credential stuffing attack that compromised approximately 68,000 user accounts. Attackers exploited reused or weak passwords to gain unauthorized access, leading to the theft of nearly $300,000 from customer accounts. The company promptly reimbursed affected users and emphasized the importance of unique passwords and two-factor authentication to enhance account security.
This incident underscores the growing threat of credential stuffing attacks, where cybercriminals leverage stolen credentials from previous breaches to infiltrate accounts on other platforms. The DraftKings case highlights the critical need for robust password practices and multi-factor authentication to mitigate such risks.
High impact
Kill Chain
ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(low)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
