Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Government Administration

Breach intelligence, attack campaigns, and threat reports targeting the Government Administration sector.

3243 threat reports
Page 68 of 271
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Government Administration Threat Reports

Showing 805–816 / 3243 reports
Urgent: Patch Critical Vulnerability in Progress Kemp LoadMaster Now
Financial Services3 months ago

Urgent: Patch Critical Vulnerability in Progress Kemp LoadMaster Now

In June 2026, a critical vulnerability (CVE-2026-8037) was identified in Progress Kemp LoadMaster appliances, allowing unauthenticated attackers to execute arbitrary commands remotely. This command injection flaw, present in the 'escape_quotes()' function, enables attackers to gain root access without valid credentials. ([hackerposts.org](https://www.hackerposts.org/en/blog/progress-kemp-loadmaster-cve-2026-8037-preauth-rce?utm_source=openai)) Exploitation attempts began on June 29, 2026, following the public release of a proof-of-concept exploit. ([esentire.com](https://www.esentire.com/security-advisories/progress-kemp-loadmaster-vulnerability-targeted-cve-2026-8037?utm_source=openai)) The inclusion of this vulnerability in CISA's Known Exploited Vulnerabilities catalog underscores the urgency for organizations to apply the necessary patches promptly to mitigate potential threats. ([aha.org](https://www.aha.org/h-isac-white-reports/2026-07-01-h-isac-tlp-white-threat-bulletin-observed-exploitation-attempts-targeting-critical-progress?utm_source=openai))

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Citrix NetScaler CVE-2025-7775: Critical Vulnerability Exploited in the Wild
Airlines/Aviation3 months ago

Citrix NetScaler CVE-2025-7775: Critical Vulnerability Exploited in the Wild

On August 26, 2025, Citrix disclosed a critical vulnerability (CVE-2025-7775) in NetScaler ADC and NetScaler Gateway products, which was actively exploited in the wild. This memory overflow flaw allows unauthenticated remote code execution and denial of service attacks on unpatched devices. The vulnerability affects versions 14.1 before 14.1-47.48, 13.1 before 13.1-59.22, 13.1-FIPS/NDcPP before 13.1-37.241-FIPS/NDcPP, and 12.1-FIPS/NDcPP up to 12.1-55.330-FIPS/NDcPP. Citrix released security updates to address this issue and urged immediate patching due to the lack of available mitigations. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/citrix-fixes-critical-netscaler-rce-flaw-exploited-in-zero-day-attacks/amp/?utm_source=openai)) The active exploitation of CVE-2025-7775 underscores the persistent targeting of critical infrastructure by threat actors. Organizations relying on NetScaler products must prioritize patching to mitigate potential risks. This incident highlights the importance of timely vulnerability management and the need for robust security practices to defend against evolving cyber threats.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
Read report
CISA Highlights Critical Vulnerability in Progress LoadMaster: CVE-2026-8037
Financial Services3 months ago

CISA Highlights Critical Vulnerability in Progress LoadMaster: CVE-2026-8037

In August 2026, the Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-8037 to its Known Exploited Vulnerabilities (KEV) Catalog, highlighting active exploitation of this critical command injection vulnerability in Progress Software's LoadMaster appliance. This flaw allows unauthenticated attackers to execute arbitrary commands via unsanitized input in multiple API endpoints, potentially leading to full system compromise. Organizations utilizing affected versions are urged to apply patches immediately to mitigate the risk of unauthorized access and data breaches. The inclusion of CVE-2026-8037 in the KEV Catalog underscores the persistent threat posed by command injection vulnerabilities, which remain a favored attack vector for cyber adversaries. This incident serves as a critical reminder for organizations to prioritize timely remediation of known vulnerabilities and to implement robust input validation mechanisms to prevent similar exploits.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
The Rise of Identity-Based Cyber Attacks in 2026
Financial Services3 months ago

The Rise of Identity-Based Cyber Attacks in 2026

In 2026, the cybersecurity landscape witnessed a significant shift towards identity-based attacks, with nearly 90% of incidents involving compromised identities. Attackers increasingly utilized techniques such as credential theft, multifactor authentication (MFA) manipulation, session hijacking, and social engineering to gain unauthorized access. Once inside, they established persistence, escalated privileges, and moved laterally across environments, often mimicking legitimate administrative behavior, making detection challenging. This trend underscores the critical need for organizations to enhance identity security measures and adopt a zero-trust approach to mitigate such threats. The rise in identity-driven attacks highlights the evolving tactics of threat actors who exploit human factors and identity weaknesses rather than traditional technical vulnerabilities. This shift necessitates a reevaluation of security strategies, emphasizing robust identity and access management, continuous monitoring, and user education to prevent unauthorized access and potential data breaches.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
July 2026 CVE Landscape: A 44% Surge in High-Impact Vulnerabilities
Information Technology/IT3 months ago

July 2026 CVE Landscape: A 44% Surge in High-Impact Vulnerabilities

In July 2026, Insikt Group identified 85 high-impact vulnerabilities, with 36 rated as Very Critical. This marks a 44% increase from the previous month. Notably, 26 vulnerabilities were listed in CISA's Known Exploited Vulnerabilities catalog, 55 were reported by vendors, and four were discovered through honeypot data. The affected products spanned 61 vendors, including Microsoft, Fortinet, Langflow, ServiceNow, WordPress, and Joomla. Of these vulnerabilities, 57 enabled remote code execution, posing significant risks to enterprise software, security products, network infrastructure, developer tools, and cloud platforms. ([hackmageddon.com](https://www.hackmageddon.com/?utm_source=openai)) This surge underscores the persistent exploitation of both new and longstanding vulnerabilities, emphasizing the critical need for organizations to prioritize timely patching and robust vulnerability management practices to mitigate potential threats.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(low)
IImpact(high)
Read report
AI-Generated Patches: A 2026 Study Reveals High Failure Rates
Computer Software/Engineering3 months ago

AI-Generated Patches: A 2026 Study Reveals High Failure Rates

In August 2026, 1Password's Off-By-1 research team evaluated the effectiveness of AI-generated patches by testing 6,080 patches created for six vulnerabilities using OpenAI's ChatGPT-5.5 and Anthropic's Opus 4.8. The study revealed that only 46% of these patches successfully addressed the vulnerabilities, with many introducing new issues or being easily bypassed. This highlights significant challenges in relying on AI for automated vulnerability remediation. The findings underscore the current limitations of AI in generating reliable security patches, emphasizing the need for human oversight and validation in the patching process. As AI continues to evolve, organizations must remain vigilant and not solely depend on automated solutions for critical security tasks.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
Bridging the Coordination Gap: Law Enforcement vs. Evolving Cyber Threats
Law Enforcement3 months ago

Bridging the Coordination Gap: Law Enforcement vs. Evolving Cyber Threats

In August 2026, cybersecurity experts highlighted a significant coordination gap between cybercriminals and law enforcement agencies. Threat actors have rapidly adapted their strategies, leveraging artificial intelligence and cryptocurrency to enhance the sophistication and scale of their operations. This evolution has led to the emergence of affiliate models, enabling less technically skilled individuals to execute complex cybercrimes such as ransomware-as-a-service and various scams, resulting in substantial financial losses for individuals and organizations. ([europol.europa.eu](https://www.europol.europa.eu/media-press/newsroom/news/new-2026-iocta-highlights-sophisticated-tactics-and-emerging-challenges-in-digital-landscape?utm_source=openai)) The current relevance of this issue is underscored by the increasing convergence of cybercrime tactics and the fragmentation of traditional ransomware cartels into volatile splinter groups. This shift complicates law enforcement efforts, as these smaller, less organized groups exhibit erratic and aggressive behaviors, making them more challenging to track and dismantle. ([itpro.com](https://www.itpro.com/security/cyber-crime/ransomware-cartels-are-fragmenting-into-volatile-splinter-groups-warns-met-police-cyber-chief?utm_source=openai))

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
AI Unveils New HTTP Desynchronization Techniques and Apache Zero-Day Vulnerability
Banking/Mortgage3 months ago

AI Unveils New HTTP Desynchronization Techniques and Apache Zero-Day Vulnerability

In August 2026, PortSwigger's AI-assisted research system, HTTP Terminator, identified novel HTTP desynchronization techniques and uncovered a zero-day vulnerability in Apache Traffic Server, designated as CVE-2026-63078. The system analyzed 30,000 websites, revealing approximately 700 vulnerable targets, including financial institutions, government infrastructure, and security products. Key findings include new desynchronization triggers, a dual-matching Content-Length pattern, and a 'dangling-byte' technique enhancing the reliability of response queue poisoning (RQP) attacks. These vulnerabilities could allow attackers to intercept sensitive user data, such as session cookies and API keys. The discovery underscores the evolving threat landscape, highlighting the increasing sophistication of AI-driven security research and the critical need for organizations to proactively address emerging vulnerabilities to safeguard sensitive information and maintain trust.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Microsoft 365 AiTM Phishing Campaign Exposes Financial Data
Health Care / Life Sciences3 months ago

Microsoft 365 AiTM Phishing Campaign Exposes Financial Data

In August 2026, a widespread phishing campaign employing adversary-in-the-middle (AiTM) techniques targeted Microsoft 365 accounts across multiple sectors in the U.S., Canada, and Europe. Attackers used voicemail-themed phishing emails to direct victims to decoy pages that proxied legitimate Microsoft authentication flows, capturing credentials and multi-factor authentication (MFA) codes. The campaign utilized residential proxies to disguise malicious sign-ins, maintaining compromised sessions at regular intervals. Once access was obtained, threat actors focused on identifying personnel involved in financial workflows to collect related emails, potentially facilitating further financial fraud. This incident underscores the evolving sophistication of phishing attacks, particularly those capable of bypassing MFA through AiTM methods. Organizations must enhance their security posture by implementing phishing-resistant MFA solutions, monitoring for anomalous sign-in activities, and educating employees about emerging phishing tactics to mitigate the risk of similar breaches.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Critical Vulnerability in Johnson Controls TL280 Devices: CVE-2026-27871
Commercial Real Estate3 months ago

Critical Vulnerability in Johnson Controls TL280 Devices: CVE-2026-27871

In August 2026, a critical vulnerability (CVE-2026-27871) was identified in Johnson Controls' TL280 devices, affecting versions prior to 5.63. This flaw involves the use of a broken or risky cryptographic algorithm, potentially allowing unauthorized access to sensitive information. The vulnerability impacts sectors such as Critical Manufacturing, Commercial Facilities, Government Services, Transportation Systems, and Energy, with deployments worldwide. Johnson Controls has released firmware update 5.63 to address this issue and recommends restricting network access to trusted management VLANs, monitoring device access logs, rotating shared credentials, implementing network segmentation, and using secure remote access methods like VPNs. ([johnsoncontrols.com](https://www.johnsoncontrols.com/trust-center/cybersecurity/security-advisories?utm_source=openai)) The discovery of CVE-2026-27871 underscores the ongoing challenges in securing industrial control systems against evolving cyber threats. Organizations are urged to promptly apply the recommended mitigations and stay vigilant against potential exploitation attempts targeting this vulnerability.

Low impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Atuin Shell History Tool: Forensic Analysis and Security Implications
Information Technology/IT3 months ago

Atuin Shell History Tool: Forensic Analysis and Security Implications

Atuin is an open-source tool that replaces traditional shell history files with a SQLite database, capturing additional context such as working directory, exit code, execution duration, and hostname for each command. It offers end-to-end encrypted synchronization across devices, enhancing shell history management. However, from a forensic perspective, Atuin's features present both opportunities and challenges. The enriched metadata can aid in reconstructing user activities, but the encrypted synchronization may obscure command histories if the encryption keys are inaccessible. Additionally, the ability to self-host the synchronization server means that forensic evidence could be distributed across multiple locations, complicating investigations. As Atuin gains popularity among developers, understanding its forensic implications becomes increasingly important for security professionals.

Low impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
Read report
Cyberattacks Reveal Critical Vulnerabilities in U.S. Water Systems
Utilities3 months ago

Cyberattacks Reveal Critical Vulnerabilities in U.S. Water Systems

In late July 2026, a series of cyberattacks targeted water and wastewater systems across at least 12 U.S. states, including Michigan, South Dakota, and Georgia. Attackers exploited internet-exposed Rockwell Automation and Allen-Bradley programmable logic controllers (PLCs), specifically the MicroLogix 1100 and 1400 models, to remotely alter configurations, leading to operational disruptions such as pressure loss and flooding. Despite prior federal warnings, over 4,000 such controllers remained accessible online, with 2,844 located in the United States. This incident underscores the persistent vulnerabilities in critical infrastructure due to inadequate cybersecurity measures. The exploitation of known vulnerabilities in widely used industrial equipment highlights the urgent need for enhanced security protocols and the removal of operational technology from direct internet exposure to prevent future attacks.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(low)
IImpact(high)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports