Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Government Administration

Breach intelligence, attack campaigns, and threat reports targeting the Government Administration sector.

3243 threat reports
Page 109 of 271
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Government Administration Threat Reports

Showing 1297–1308 / 3243 reports
CISA Adds Cisco, Chrome, and Arista Flaws to KEV Catalog Amid Active Exploitation
Telecommunications5 months ago

CISA Adds Cisco, Chrome, and Arista Flaws to KEV Catalog Amid Active Exploitation

On June 10, 2026, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added three vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, indicating active exploitation. These include CVE-2026-20245, an improper encoding vulnerability in Cisco Catalyst SD-WAN Manager; CVE-2026-11645, an out-of-bounds read and write flaw in Google Chrome's V8 engine; and CVE-2026-7473, an incomplete comparison vulnerability in Arista's Extensible Operating System (EOS). These vulnerabilities could allow attackers to execute arbitrary code or process unauthorized tunnel traffic, posing significant risks to affected systems. The inclusion of these vulnerabilities in the KEV catalog underscores the persistent threat posed by actively exploited flaws in widely used software and hardware. Organizations are urged to apply the necessary patches or mitigations promptly to safeguard their systems against potential attacks.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
Read report
CISA Highlights Active Exploitation of Three New Vulnerabilities
Telecommunications5 months ago

CISA Highlights Active Exploitation of Three New Vulnerabilities

On June 9, 2026, the Cybersecurity and Infrastructure Security Agency (CISA) added three new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, indicating active exploitation in the wild. The vulnerabilities include CVE-2026-7473 affecting Arista's Extensible Operating System, CVE-2026-11645 in Google Chromium's V8 engine, and CVE-2026-20245 in Cisco Catalyst SD-WAN Manager. These vulnerabilities pose significant risks to federal enterprises, as they are commonly targeted by malicious cyber actors. The inclusion of these vulnerabilities in the KEV Catalog underscores the ongoing threat posed by unpatched software flaws. Organizations are urged to prioritize remediation efforts to mitigate potential exploitation and protect their networks against active threats.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
NSO Group's Continued Targeting of WhatsApp Users Despite Legal Prohibitions
Telecommunications5 months ago

NSO Group's Continued Targeting of WhatsApp Users Despite Legal Prohibitions

In June 2026, WhatsApp identified and disrupted a spear-phishing campaign linked to the NSO Group, a spyware firm previously barred by a court order from targeting WhatsApp users. The attackers attempted to deceive users into clicking malicious links leading to external websites, aiming to install spyware on their devices. This incident follows a 2019 campaign where NSO exploited a WhatsApp vulnerability to target approximately 1,400 users, leading to a lawsuit and a permanent injunction against NSO. ([techcrunch.com](https://techcrunch.com/2026/06/08/whatsapp-says-it-caught-new-spyware-attacks-linked-to-nso-group-in-violation-of-court-order/?utm_source=openai)) The recurrence of such attacks underscores the persistent threat posed by spyware firms and highlights the challenges in enforcing legal restrictions against them. Organizations must remain vigilant and proactive in defending against sophisticated phishing and spyware campaigns that continue to evolve despite legal deterrents.

Low impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Anthropic's Claude Fable 5: Advancing AI with Built-in Safeguards
Computer Software/Engineering5 months ago

Anthropic's Claude Fable 5: Advancing AI with Built-in Safeguards

In June 2026, Anthropic released Claude Fable 5, a public version of its advanced AI model, Claude Mythos. To mitigate potential misuse in areas like cybersecurity and bioweapons research, Fable 5 incorporates safeguards that redirect certain sensitive queries to the less capable Claude Opus 4.8 model. The company conducted extensive internal and external testing to ensure the effectiveness of these safety measures. This release highlights the ongoing challenge of balancing AI innovation with security concerns. As AI models become more powerful, implementing robust safeguards is crucial to prevent their exploitation for malicious purposes.

Low impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(low)
EExfiltration(high)
IImpact(high)
Read report
French Government's Tchap Messaging Service Compromised in Account Hijacking Incident
Government Administration5 months ago

French Government's Tchap Messaging Service Compromised in Account Hijacking Incident

In June 2026, the French government's encrypted messaging platform, Tchap, suffered a security breach due to the hijacking of a legitimate user account. The attacker accessed public chat rooms, which are not end-to-end encrypted, and exfiltrated over 643,000 messages and more than 59,000 media files from approximately 73,000 public servants. The compromised account was promptly identified and blocked to prevent further unauthorized access. This incident underscores the critical importance of securing user accounts and the potential risks associated with unencrypted public communication channels. Organizations must reassess their security protocols to ensure that sensitive information is adequately protected, even in public forums.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
CISA Mandates Immediate Patching of Check Point VPN Vulnerability Exploited by Qilin Ransomware
Government Administration5 months ago

CISA Mandates Immediate Patching of Check Point VPN Vulnerability Exploited by Qilin Ransomware

In early May 2026, a critical vulnerability (CVE-2026-50751) in Check Point's Remote Access VPN and Mobile Access products was exploited by Qilin ransomware affiliates. This flaw allowed unauthenticated remote attackers to bypass authentication and establish VPN connections on systems configured with the deprecated IKEv1 protocol. The attacks led to breaches in several organizations worldwide, prompting Check Point to release security updates on June 8, 2026. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/cisa-orders-feds-to-patch-check-point-flaw-exploited-by-ransomware-gangs/?utm_source=openai)) The exploitation of this vulnerability underscores the persistent threat posed by ransomware groups targeting outdated protocols. Organizations are urged to apply patches promptly and review their VPN configurations to mitigate similar risks. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/cisa-orders-feds-to-patch-check-point-flaw-exploited-by-ransomware-gangs/?utm_source=openai))

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
Read report
Google Patches Actively Exploited Chrome Zero-Day Vulnerability CVE-2026-11645
Financial Services5 months ago

Google Patches Actively Exploited Chrome Zero-Day Vulnerability CVE-2026-11645

In June 2026, Google addressed a high-severity zero-day vulnerability, CVE-2026-11645, in its Chrome browser. This flaw, an out-of-bounds read and write issue in the V8 JavaScript engine, allowed remote attackers to execute arbitrary code via crafted HTML pages. The vulnerability was actively exploited in the wild before the patch was released, highlighting the critical need for prompt updates. ([helpnetsecurity.com](https://www.helpnetsecurity.com/2026/06/09/google-chrome-zero-day-cve-2026-11645/?utm_source=openai)) The incident underscores the persistent threat posed by zero-day vulnerabilities in widely used software. Organizations must prioritize timely patch management and maintain robust security protocols to mitigate risks associated with such exploits.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Microsoft's June 2026 Patch Tuesday: A Record-Breaking Security Update
Government Administration5 months ago

Microsoft's June 2026 Patch Tuesday: A Record-Breaking Security Update

In June 2026, Microsoft released its largest Patch Tuesday update to date, addressing approximately 200 vulnerabilities across its product suite. This unprecedented update included fixes for 33 critical vulnerabilities, with 28 being remote code execution flaws, and three zero-day vulnerabilities that had been publicly disclosed prior to the release. The scale and severity of this update underscore the increasing complexity and volume of security threats facing organizations today. The record-breaking number of vulnerabilities patched highlights the growing challenge of maintaining secure systems in an era of rapid technological advancement and sophisticated cyber threats. Organizations are urged to prioritize the deployment of these updates to mitigate potential risks and to reassess their vulnerability management strategies to keep pace with the evolving threat landscape.

Low impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Microsoft Defender 'RoguePlanet' Zero-Day Grants SYSTEM Privileges
Computer/Network Security5 months ago

Microsoft Defender 'RoguePlanet' Zero-Day Grants SYSTEM Privileges

On June 9, 2026, security researcher Nightmare Eclipse disclosed a zero-day vulnerability in Microsoft Defender, termed 'RoguePlanet.' This flaw exploits a race condition, enabling attackers to gain SYSTEM-level privileges on fully patched Windows 10 and Windows 11 systems. The proof-of-concept exploit was released publicly, demonstrating the potential for unauthorized command prompt access with elevated privileges. The disclosure underscores ongoing challenges in vulnerability management and the critical need for timely patching. Organizations are urged to implement application allowlisting and monitor for unusual activity to mitigate potential exploitation risks.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
ServiceNow Security Incident 2026: API Vulnerability Exposes Customer Data
Information Technology/IT5 months ago

ServiceNow Security Incident 2026: API Vulnerability Exposes Customer Data

In June 2026, ServiceNow disclosed a security incident where attackers exploited an unauthenticated access flaw in a vulnerable API endpoint, allowing unauthorized queries to customer instance tables. The company detected anomalous activity and applied a security update on June 5, 2026, to restrict the API endpoint to authenticated users only. While specific data accessed was not disclosed, ServiceNow instances typically store sensitive enterprise information, including IT support tickets, employee records, and internal documentation. This incident underscores the critical importance of securing API endpoints against unauthorized access. As API usage continues to dominate web traffic, organizations must prioritize robust authentication and authorization mechanisms to prevent similar vulnerabilities and protect sensitive data from potential breaches.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(low)
LMLateral Movement(low)
C&CCommand & Control(low)
EExfiltration(low)
IImpact(low)
Read report
Critical RCE Vulnerability in Veeam Backup & Replication: CVE-2026-44963
Information Technology/IT5 months ago

Critical RCE Vulnerability in Veeam Backup & Replication: CVE-2026-44963

In June 2026, Veeam disclosed a critical vulnerability (CVE-2026-44963) in its Backup & Replication software, affecting versions up to 12.3.2.4465. This flaw allows authenticated domain users to execute remote code on domain-joined backup servers, potentially compromising backup infrastructure and associated data. Veeam promptly released version 12.3.2.4854 to address this issue. ([veeam.com](https://www.veeam.com/kb4869?utm_source=openai)) The incident underscores the persistent threat of remote code execution vulnerabilities in critical infrastructure. Organizations are urged to apply patches swiftly and review access controls to mitigate risks associated with authenticated user exploits.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Check Point VPN Vulnerability Exploited by Qilin Ransomware
Financial Services5 months ago

Check Point VPN Vulnerability Exploited by Qilin Ransomware

In early May 2026, a critical zero-day vulnerability (CVE-2026-50751) was exploited in Check Point's Remote Access VPN and Mobile Access products configured with the deprecated IKEv1 protocol. This flaw allowed unauthenticated attackers to bypass authentication and establish VPN sessions without valid credentials. The Qilin ransomware group was identified as exploiting this vulnerability, leading to unauthorized access and potential data breaches in several organizations. ([darkreading.com](https://www.darkreading.com/vulnerabilities-threats/check-point-vpn-flaw-exploited-early-may?utm_source=openai)) The exploitation of this vulnerability underscores the risks associated with using outdated protocols like IKEv1. Organizations must prioritize updating their systems to supported protocols and apply security patches promptly to mitigate such threats. ([darkreading.com](https://www.darkreading.com/vulnerabilities-threats/check-point-vpn-flaw-exploited-early-may?utm_source=openai))

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports