Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Health Care / Life Sciences

Breach intelligence, attack campaigns, and threat reports targeting the Health Care / Life Sciences sector.

3490 threat reports
Page 181 of 291
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Health Care / Life Sciences Threat Reports

Showing 2161–2172 / 3490 reports
Salesforce Experience Cloud Guest User Misconfiguration Breach 2026
Computer Software/Engineering8 months ago

Salesforce Experience Cloud Guest User Misconfiguration Breach 2026

In March 2026, the cybercriminal group ShinyHunters exploited misconfigured guest user profiles in Salesforce's Experience Cloud, leading to unauthorized access to sensitive customer data. By utilizing a modified version of the open-source tool AuraInspector, the attackers scanned public-facing Experience Cloud sites and extracted data without authentication. This breach impacted approximately 400 organizations, including high-profile companies such as Snowflake, Okta, LastPass, Sony, AMD, and Salesforce itself. The compromised data included names, phone numbers, and other CRM information, which were subsequently used for social engineering and voice phishing campaigns. Salesforce confirmed that the issue stemmed from customer-configured settings rather than a vulnerability in its platform. ([techradar.com](https://www.techradar.com/pro/security/shinyhunters-claims-its-behind-ongoing-salesforce-aura-data-theft-assault-warns-more-attacks-to-come?utm_source=openai)) This incident underscores the critical importance of proper configuration and regular auditing of cloud-based services. Misconfigurations, especially in widely used platforms like Salesforce, can lead to significant data breaches, emphasizing the need for organizations to adhere to security best practices and continuously monitor their systems for potential vulnerabilities.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
AWS Data Centers in Middle East Targeted by Drone Strikes in 2026
Defense/Space8 months ago

AWS Data Centers in Middle East Targeted by Drone Strikes in 2026

In early March 2026, Iranian drone strikes targeted Amazon Web Services (AWS) data centers in the United Arab Emirates (UAE) and Bahrain, causing significant structural damage and service disruptions. Two facilities in the UAE were directly hit, while a third in Bahrain sustained damage from a nearby strike. These attacks led to outages across multiple AWS services, including EC2, S3, and RDS, affecting businesses, financial institutions, and government entities in the region. AWS reported that recovery efforts would be prolonged due to the extent of the physical damage. ([thenationalnews.com](https://www.thenationalnews.com/business/2026/03/03/drone-strikes-damage-amazon-data-centres-in-uae-and-bahrain-disrupting-services/?utm_source=openai)) This incident underscores the vulnerability of cloud infrastructure to physical attacks, especially in geopolitically volatile regions. Organizations relying on cloud services must reassess their disaster recovery and data sovereignty strategies to ensure resilience against both cyber and kinetic threats. ([apnews.com](https://apnews.com/article/71066b0a822c4cfd88b61e3fe79af917?utm_source=openai))

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
Critical Security Flaws in Apeman Cameras: A 2025 Analysis
Security/Investigations8 months ago

Critical Security Flaws in Apeman Cameras: A 2025 Analysis

In late 2025, multiple critical vulnerabilities were identified in Apeman ID71 cameras, including hard-coded credentials (CVE-2025-11126), cross-site scripting (CVE-2025-11851), and missing authentication for critical functions (CVE-2025-11852). These flaws could allow remote attackers to gain unauthorized access, manipulate device settings, or intercept camera feeds. Despite early notifications, Apeman did not respond to these disclosures, leaving devices exposed to potential exploitation. The prevalence of IoT devices with unpatched vulnerabilities underscores the urgent need for manufacturers to implement robust security measures and for users to apply timely updates. This incident highlights the critical importance of proactive vulnerability management in safeguarding connected devices against emerging threats.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
Microsoft's March 2026 Patch Tuesday: Addressing 83 Vulnerabilities, Including Two Zero-Days
Health Care / Life Sciences8 months ago

Microsoft's March 2026 Patch Tuesday: Addressing 83 Vulnerabilities, Including Two Zero-Days

In March 2026, Microsoft released security updates addressing 83 vulnerabilities across its product suite, including Windows, Office, SQL Server, Azure, and .NET. Among these, eight were rated as critical, and two vulnerabilities—CVE-2026-26127 and CVE-2026-21262—were publicly disclosed prior to patch release, though neither had been exploited in the wild. CVE-2026-21536, a remote code execution flaw in Microsoft's Devices Pricing Program, received the highest severity rating with a CVSS score of 9.8. Microsoft has proactively mitigated this issue within its cloud infrastructure, requiring no customer action. ([anonhaven.com](https://anonhaven.com/en/news/microsoft-march-2026-patch-tuesday-83-cves/?utm_source=openai)) This update marks the first Patch Tuesday in six months without any actively exploited zero-day vulnerabilities. The absence of active exploitation provides organizations a crucial window to apply patches without the immediate pressure of ongoing attacks. However, the disclosure of vulnerabilities like CVE-2026-26127 and CVE-2026-21262 underscores the importance of timely patch management to preempt potential exploitation. ([cyberscoop.com](https://cyberscoop.com/microsoft-patch-tuesday-march-2026/?utm_source=openai))

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Critical Unauthenticated Access Vulnerability in Honeywell IQ4x BMS Controllers (2026)
Health Care / Life Sciences8 months ago

Critical Unauthenticated Access Vulnerability in Honeywell IQ4x BMS Controllers (2026)

In March 2026, a critical vulnerability (CVE-2026-3611) was identified in Honeywell's IQ4x Building Management System (BMS) controllers. The flaw allows unauthenticated access to the web-based Human-Machine Interface (HMI) in factory-default configurations, enabling remote attackers to create administrative accounts, manipulate building controls, and potentially lock out legitimate operators. This vulnerability affects multiple models, including IQ4E, IQ412, IQ422, IQ4NC, IQ41x, IQ3, and IQECO, across firmware versions from v3.50_3.44 to v4.36_build_4.3.7.9. ([community.itbible.org](https://community.itbible.org/t/honeywell-iq4x-bms-controller/2685?utm_source=openai)) The discovery underscores the critical need for secure default configurations in industrial control systems. With thousands of these controllers potentially exposed online, the risk of unauthorized access to critical infrastructure is heightened, emphasizing the importance of immediate remediation and robust security practices in operational technology environments. ([cybersecuritynews.com](https://cybersecuritynews.com/thousand-of-honeywell-controllers-exposed/?utm_source=openai))

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Unveiling Critical Reverse Proxy Header Vulnerabilities in 2025
Financial Services8 months ago

Unveiling Critical Reverse Proxy Header Vulnerabilities in 2025

In 2025, critical vulnerabilities were identified in reverse proxy applications, notably Fabio and OAuth2-Proxy, exposing significant security risks. CVE-2025-48865 in Fabio allowed attackers to manipulate or remove security-critical headers like X-Forwarded-Host and X-Real-IP by exploiting the HTTP Connection header, potentially leading to access control bypasses. Similarly, CVE-2025-64484 in OAuth2-Proxy enabled authenticated users to inject underscore variants of X-Forwarded-* headers, bypassing the proxy's filtering logic and potentially escalating privileges in upstream applications. These vulnerabilities underscore the importance of stringent header validation and normalization practices in reverse proxy configurations. ([nvd.nist.gov](https://nvd.nist.gov/vuln/detail/CVE-2025-48865?utm_source=openai)) The discovery of these vulnerabilities highlights a systemic issue in how reverse proxies handle HTTP headers, emphasizing the need for organizations to reassess and fortify their security measures to prevent similar exploits.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
SolarWinds Web Help Desk 2025 AjaxProxy RCE Vulnerability
Information Technology/IT8 months ago

SolarWinds Web Help Desk 2025 AjaxProxy RCE Vulnerability

In September 2025, a critical vulnerability (CVE-2025-26399) was identified in SolarWinds Web Help Desk, allowing unauthenticated remote attackers to execute arbitrary code on affected systems. This flaw, rooted in insecure deserialization within the AjaxProxy component, enables attackers to run commands on the host machine without authentication. Despite previous patches for related vulnerabilities (CVE-2024-28986 and CVE-2024-28988), this issue persisted, leading to active exploitation in the wild. Organizations using versions up to 12.8.7 are at significant risk and should apply the latest hotfix immediately. The recurrence of such vulnerabilities underscores the importance of comprehensive security reviews and prompt patch management. As attackers increasingly exploit deserialization flaws, organizations must prioritize securing their software supply chains and implementing robust monitoring to detect and respond to such threats promptly.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Critical Authentication Bypass Vulnerability Discovered in pac4j-jwt Java Library
Financial Services8 months ago

Critical Authentication Bypass Vulnerability Discovered in pac4j-jwt Java Library

In March 2026, a critical authentication bypass vulnerability (CVE-2026-29000) was discovered in the pac4j-jwt Java library, affecting versions prior to 4.5.9, 5.7.9, and 6.3.3. This flaw allows remote attackers to forge authentication tokens by exploiting improper verification of cryptographic signatures in the JwtAuthenticator component when processing encrypted JSON Web Tokens (JWTs). By crafting a JWE-wrapped PlainJWT with arbitrary subject and role claims, attackers can bypass signature verification and authenticate as any user, including administrators. ([arcticwolf.com](https://arcticwolf.com/resources/blog/cve-2026-29000/?utm_source=openai)) The vulnerability poses a significant risk due to the widespread use of pac4j-jwt in various Java applications and frameworks. Organizations utilizing affected versions are urged to upgrade to the latest fixed releases immediately to mitigate potential exploitation. ([arcticwolf.com](https://arcticwolf.com/resources/blog/cve-2026-29000/?utm_source=openai))

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(low)
EExfiltration(low)
IImpact(low)
Read report
Microsoft's March 2026 Patch Tuesday: Addressing 83 Vulnerabilities, Including Two Publicly Disclosed Zero-Days
Financial Services8 months ago

Microsoft's March 2026 Patch Tuesday: Addressing 83 Vulnerabilities, Including Two Publicly Disclosed Zero-Days

In March 2026, Microsoft released its Patch Tuesday updates, addressing 83 vulnerabilities across its software portfolio, including Windows, Office, SQL Server, Azure, and .NET. Notably, this release included two publicly disclosed zero-day vulnerabilities: CVE-2026-21262, an elevation of privilege flaw in Microsoft SQL Server, and CVE-2026-26127, a denial-of-service vulnerability in .NET. Additionally, six vulnerabilities were identified as more likely to be exploited, emphasizing the importance of timely patch application. This update marks the first in six months without any actively exploited zero-day vulnerabilities, indicating a positive trend in Microsoft's vulnerability management efforts. ([cyberscoop.com](https://cyberscoop.com/microsoft-patch-tuesday-march-2026/?utm_source=openai)) The absence of actively exploited zero-day vulnerabilities in this release suggests improved security measures and proactive patching strategies. However, the presence of publicly disclosed vulnerabilities underscores the need for organizations to remain vigilant and prioritize the deployment of these updates to mitigate potential risks.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(medium)
Read report
Critical Ivanti EPM Vulnerability Exploited: Immediate Action Required
Government Administration8 months ago

Critical Ivanti EPM Vulnerability Exploited: Immediate Action Required

In February 2026, a critical authentication bypass vulnerability (CVE-2026-1603) was identified in Ivanti Endpoint Manager (EPM) versions prior to 2024 SU5. This flaw allows remote, unauthenticated attackers to access stored credential data by exploiting improper authentication mechanisms, specifically through malformed header concatenation in the WSAuth.dll component. Successful exploitation enables attackers to retrieve encrypted credential blobs for high-privilege accounts, potentially compromising the entire endpoint management trust model and facilitating lateral movement within networks. ([dbugs.ptsecurity.com](https://dbugs.ptsecurity.com/vulnerability/CVE-2026-1603?utm_source=openai)) The Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2026-1603 to its Known Exploited Vulnerabilities (KEV) Catalog, indicating active exploitation in the wild. Organizations are urged to upgrade to Ivanti EPM 2024 SU5 immediately to mitigate this risk. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/cisa-recently-patched-ivanti-epm-flaw-now-actively-exploited/?utm_source=openai))

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(low)
EExfiltration(low)
IImpact(low)
Read report
Understanding LummaC2: The 2025 Advanced Evasion Malware
Financial Services8 months ago

Understanding LummaC2: The 2025 Advanced Evasion Malware

In 2025, LummaC2 emerged as a highly sophisticated information-stealing malware targeting Windows systems. Distributed through phishing emails, malicious advertisements, and compromised software, LummaC2 exfiltrated sensitive data, including browser credentials and cryptocurrency wallets. Notably, its v4.0 introduced advanced evasion techniques, such as trigonometry-based anti-sandbox mechanisms that detect human-like mouse movements to avoid detection. This evolution underscores a significant shift towards stealthy, persistent cyber threats that can bypass traditional security measures. The rise of LummaC2 highlights the increasing sophistication of malware-as-a-service platforms, enabling even low-skilled threat actors to deploy advanced attacks. Organizations must enhance their security postures by adopting proactive threat detection and response strategies to mitigate such evolving threats.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
KadNap Botnet: A New Threat Targeting ASUS Routers in 2026
Telecommunications8 months ago

KadNap Botnet: A New Threat Targeting ASUS Routers in 2026

In August 2025, cybersecurity researchers identified a new malware strain named KadNap, which primarily targets ASUS routers and other edge networking devices. The malware infiltrates these devices, transforming them into nodes within a botnet that proxies malicious traffic. KadNap employs a customized version of the Kademlia Distributed Hash Table (DHT) protocol, enabling decentralized communication and complicating efforts to detect and disrupt its command-and-control (C2) infrastructure. By March 2026, the botnet had expanded to over 14,000 infected devices, with approximately 60% located in the United States. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/new-kadnap-botnet-hijacks-asus-routers-to-fuel-cybercrime-proxy-network/?utm_source=openai)) The emergence of KadNap underscores a growing trend of sophisticated malware leveraging decentralized protocols to enhance resilience against traditional network monitoring and takedown efforts. This incident highlights the critical need for robust security measures in consumer-grade networking equipment, as such devices are increasingly exploited to facilitate large-scale cybercriminal operations.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports