Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Health Care / Life Sciences

Breach intelligence, attack campaigns, and threat reports targeting the Health Care / Life Sciences sector.

3490 threat reports
Page 142 of 291
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Health Care / Life Sciences Threat Reports

Showing 1693–1704 / 3490 reports
Critical Ivanti EPMM Vulnerability (CVE-2026-6973) Under Active Exploitation
Health Care / Life Sciences6 months ago

Critical Ivanti EPMM Vulnerability (CVE-2026-6973) Under Active Exploitation

In May 2026, Ivanti disclosed a high-severity vulnerability (CVE-2026-6973) in its Endpoint Manager Mobile (EPMM) software, which allows authenticated administrative users to execute remote code due to improper input validation. This flaw affects EPMM versions prior to 12.6.1.1, 12.7.0.1, and 12.8.0.1. Exploitation of this vulnerability has been observed in a limited number of cases, potentially leading to full system compromise. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added this vulnerability to its Known Exploited Vulnerabilities catalog, mandating federal agencies to apply patches by May 10, 2026. Organizations are urged to update their EPMM installations promptly to mitigate the risk of exploitation.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(low)
Read report
State-Sponsored Exploitation of Palo Alto Networks Firewall Zero-Day (CVE-2026-0300)
Financial Services6 months ago

State-Sponsored Exploitation of Palo Alto Networks Firewall Zero-Day (CVE-2026-0300)

In early April 2026, Palo Alto Networks identified a critical buffer overflow vulnerability (CVE-2026-0300) in the User-ID Authentication Portal of its PAN-OS software, affecting PA-Series and VM-Series firewalls. This flaw allows unauthenticated attackers to execute arbitrary code with root privileges by sending specially crafted packets. Exploitation attempts began on April 9, with successful breaches occurring a week later. Attackers deployed tools like Earthworm and ReverseSocks5 to establish covert communications and bypass network defenses. This incident underscores a growing trend of state-sponsored actors targeting network edge devices, which often lack comprehensive logging and security measures. Organizations are urged to implement robust access controls and promptly apply security patches to mitigate such vulnerabilities. ([helpnetsecurity.com](https://www.helpnetsecurity.com/2026/05/07/state-sponsored-hackers-zero-day-attacks-palo-alto-firewalls/?utm_source=openai))

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(medium)
Read report
Critical Zero-Day Vulnerability in Ivanti EPMM: CVE-2026-6973 Under Active Exploitation
Government Administration6 months ago

Critical Zero-Day Vulnerability in Ivanti EPMM: CVE-2026-6973 Under Active Exploitation

In May 2026, Ivanti disclosed a high-severity remote code execution vulnerability, CVE-2026-6973, in its Endpoint Manager Mobile (EPMM) software. This flaw, stemming from improper input validation, allows authenticated users with administrative privileges to execute arbitrary code on affected systems running EPMM versions 12.8.0.0 and earlier. Ivanti confirmed limited exploitation of this zero-day vulnerability in the wild and urged customers to update to patched versions 12.6.1.1, 12.7.0.1, or 12.8.0.1 to mitigate the risk. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-6973 to its Known Exploited Vulnerabilities catalog, mandating federal agencies to apply the fixes by May 10, 2026. This incident underscores the persistent threat posed by zero-day vulnerabilities and the critical importance of timely patching to maintain system security. ([securityaffairs.com](https://securityaffairs.com/191822/security/u-s-cisa-adds-a-flaw-in-ivanti-endpoint-manager-mobile-epmm-to-its-known-exploited-vulnerabilities-catalog.html?utm_source=openai))

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(low)
Read report
Critical Microsoft Vulnerabilities Exploited in Q1 2026: A Call for Immediate Action
Financial Services6 months ago

Critical Microsoft Vulnerabilities Exploited in Q1 2026: A Call for Immediate Action

In Q1 2026, threat actors exploited three critical vulnerabilities—CVE-2026-21509, CVE-2026-21514, and CVE-2026-21513—to compromise systems running Microsoft Office and Windows OS components. These vulnerabilities allowed attackers to bypass security features, execute malicious code, and escalate privileges, leading to unauthorized access and potential data breaches. The exploitation of these flaws underscores the importance of timely software updates and robust security measures to mitigate such risks. The active exploitation of these vulnerabilities highlights a broader trend of attackers leveraging newly discovered flaws to infiltrate systems. Organizations must remain vigilant, ensuring prompt patch management and adopting comprehensive security strategies to defend against evolving threats.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Quantum Risk Explained: Immediate Threats to Cryptography in 2026
Financial Services6 months ago

Quantum Risk Explained: Immediate Threats to Cryptography in 2026

In 2026, advancements in quantum computing have significantly reduced the cost and complexity of breaking traditional cryptographic systems, posing immediate threats to data security. Techniques like Shor's algorithm can now be executed with fewer qubits, making previously secure encryption methods vulnerable. Organizations must urgently assess and upgrade their cryptographic protocols to mitigate these emerging risks. ([techradar.com](https://www.techradar.com/pro/encryption-breaking-technology-is-now-20x-cheaper-and-ceos-should-be-very-worried?utm_source=openai)) The urgency is underscored by the potential for 'harvest now, decrypt later' attacks, where adversaries collect encrypted data today to decrypt once quantum capabilities mature. This scenario highlights the need for immediate action to protect sensitive information from future quantum decryption threats. ([deloitte.com](https://www.deloitte.com/us/en/insights/topics/technology-management/tech-trends/2025/tech-trends-quantum-computing-and-cybersecurity.html?utm_source=openai))

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
TrustFall Vulnerability in AI Coding Tools: A Critical Security Alert
Computer Software/Engineering6 months ago

TrustFall Vulnerability in AI Coding Tools: A Critical Security Alert

In May 2026, researchers at Adversa AI identified a critical security issue in AI coding tools such as Claude Code, Cursor CLI, Gemini CLI, and CoPilot CLI. Malicious repositories can exploit insufficient warning dialogs to auto-approve and launch Model Context Protocol (MCP) servers without explicit user consent, leading to potential full-system compromises. This vulnerability allows attackers to execute arbitrary code, access sensitive files, install backdoors, and establish command-and-control channels, especially in continuous integration environments where no user interaction is required. The 'TrustFall' issue underscores the urgent need for enhanced security measures in AI-assisted development tools. As the adoption of such tools grows, ensuring robust permission systems and clear user warnings becomes paramount to prevent supply chain attacks and protect development environments from unauthorized code execution.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
VoidStealer Trojan Exploits Debugger-Based Technique to Bypass Chrome's Encryption
Financial Services6 months ago

VoidStealer Trojan Exploits Debugger-Based Technique to Bypass Chrome's Encryption

In May 2026, the VoidStealer Trojan emerged with a novel method to bypass Google Chrome's App-Bound Encryption (ABE), a security feature introduced in July 2024 to protect sensitive browser data. Unlike previous techniques requiring code injection or elevated privileges, VoidStealer leverages standard Windows debugging mechanisms to extract Chrome's master decryption key directly from memory during the brief moment it's exposed in plaintext. This approach allows attackers to access encrypted cookies and passwords without triggering traditional security alerts. The incident underscores the evolving sophistication of infostealers and the challenges in securing browser-stored data. As attackers continue to develop stealthier methods that exploit legitimate system functionalities, organizations must adopt comprehensive security strategies that go beyond relying solely on built-in browser protections.

Medium impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(high)
LMLateral Movement(low)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(medium)
Read report
Critical Vulnerabilities in vm2 Node.js Library: Immediate Action Required
Computer Software/Engineering6 months ago

Critical Vulnerabilities in vm2 Node.js Library: Immediate Action Required

In May 2026, multiple critical vulnerabilities were disclosed in the vm2 Node.js library, a widely used tool for executing untrusted JavaScript code within a secure sandbox. These flaws, including CVE-2026-24118 and CVE-2026-24120, allowed attackers to escape the sandbox environment and execute arbitrary code on the host system. The vulnerabilities affected versions up to 3.10.4, with patches released in version 3.11.0. Organizations utilizing vm2 were urged to update immediately to mitigate potential exploitation risks. ([thehackernews.com](https://thehackernews.com/2026/05/vm2-nodejs-library-vulnerabilities.html?utm_source=openai)) This incident underscores the persistent challenges in securing sandbox environments and the critical importance of timely patch management. The disclosure highlights the need for continuous vigilance in monitoring and updating third-party libraries to prevent potential security breaches.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
ZiChatBot Malware: A New Threat via PyPI Packages
Computer Software/Engineering6 months ago

ZiChatBot Malware: A New Threat via PyPI Packages

In July 2025, cybersecurity researchers identified three malicious packages—uuid32-utils, colorinal, and termncolor—on the Python Package Index (PyPI). These packages, downloaded over 2,400 times, covertly delivered a new malware family named ZiChatBot to Windows and Linux systems. Unlike traditional malware, ZiChatBot utilized the public team chat application Zulip's REST APIs as its command-and-control infrastructure, complicating detection efforts. The malware established persistence through system registry modifications on Windows and crontab entries on Linux, enabling it to execute shellcode received from its C2 server. ([thehackernews.com](https://thehackernews.com/2026/05/pypi-packages-deliver-zichatbot-malware.html?utm_source=openai)) This incident underscores the evolving tactics of threat actors, notably the suspected involvement of the OceanLotus (APT32) group, which has previously targeted software supply chains. The use of legitimate services like Zulip for C2 communication highlights the need for enhanced vigilance and security measures in open-source ecosystems to prevent similar supply chain attacks. ([thehackernews.com](https://thehackernews.com/2026/05/pypi-packages-deliver-zichatbot-malware.html?utm_source=openai))

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(low)
C&CCommand & Control(high)
EExfiltration(low)
IImpact(medium)
Read report
CISA Adds CVE-2026-0300 to Known Exploited Vulnerabilities Catalog
Government Administration6 months ago

CISA Adds CVE-2026-0300 to Known Exploited Vulnerabilities Catalog

On May 6, 2026, the Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-0300 to its Known Exploited Vulnerabilities Catalog. This critical buffer overflow vulnerability affects the User-ID™ Authentication Portal in Palo Alto Networks' PAN-OS software, allowing unauthenticated attackers to execute arbitrary code with root privileges on PA-Series and VM-Series firewalls. The vulnerability has been actively exploited in the wild, posing significant risks to organizations using affected devices. The inclusion of CVE-2026-0300 in CISA's catalog underscores the urgency for organizations to apply mitigations or patches promptly. With active exploitation confirmed, delaying remediation increases the risk of unauthorized access and potential data breaches. Organizations should prioritize securing their network infrastructure by following vendor guidelines and implementing best practices to mitigate this vulnerability.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Critical PAN-OS Vulnerability (CVE-2026-0300) Under Active Exploitation
Computer/Network Security6 months ago

Critical PAN-OS Vulnerability (CVE-2026-0300) Under Active Exploitation

In early May 2026, Palo Alto Networks disclosed a critical buffer overflow vulnerability (CVE-2026-0300) in its PAN-OS software's User-ID Authentication Portal service. This flaw allows unauthenticated attackers to execute arbitrary code with root privileges on PA-Series and VM-Series firewalls by sending specially crafted packets. Active exploitation of this vulnerability has been observed, with threat actors gaining unauthorized access to affected devices. ([security.paloaltonetworks.com](https://security.paloaltonetworks.com/CVE-2026-0300?utm_source=openai)) The exploitation of CVE-2026-0300 underscores a growing trend of attackers targeting edge-network devices, such as firewalls and routers, which often lack robust logging and security agents. Organizations must prioritize securing these assets to prevent unauthorized access and potential data breaches. ([security.paloaltonetworks.com](https://security.paloaltonetworks.com/CVE-2026-0300?utm_source=openai))

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Exploitation of PAN-OS Captive Portal Zero-Day (CVE-2026-0300) for Unauthenticated Remote Code Execution
Financial Services6 months ago

Exploitation of PAN-OS Captive Portal Zero-Day (CVE-2026-0300) for Unauthenticated Remote Code Execution

On May 6, 2026, Palo Alto Networks disclosed CVE-2026-0300, a critical buffer overflow vulnerability in the User-ID™ Authentication Portal (Captive Portal) service of PAN-OS software. This flaw allows unauthenticated attackers to execute arbitrary code with root privileges on PA-Series and VM-Series firewalls by sending specially crafted packets. Limited exploitation has been observed, with attackers deploying tools like EarthWorm and ReverseSocks5, conducting Active Directory enumeration, and systematically erasing logs to conceal their activities. ([unit42.paloaltonetworks.com](https://unit42.paloaltonetworks.com/captive-portal-zero-day/?utm_source=openai)) This incident underscores the escalating trend of state-sponsored actors targeting edge-network devices to gain privileged access. The use of publicly available tools and meticulous operational tactics highlights the need for organizations to secure their network perimeters and implement robust monitoring to detect and mitigate such sophisticated threats. ([unit42.paloaltonetworks.com](https://unit42.paloaltonetworks.com/captive-portal-zero-day/?utm_source=openai))

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(low)
IImpact(high)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports