Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Health Care / Life Sciences

Breach intelligence, attack campaigns, and threat reports targeting the Health Care / Life Sciences sector.

3490 threat reports
Page 67 of 291
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Health Care / Life Sciences Threat Reports

Showing 793–804 / 3490 reports
Microsoft's August 2026 Patch Tuesday: Addressing 398 Vulnerabilities Including Active Zero-Day Exploits
Government Administration2 months ago

Microsoft's August 2026 Patch Tuesday: Addressing 398 Vulnerabilities Including Active Zero-Day Exploits

In August 2026, Microsoft released a comprehensive security update addressing 398 vulnerabilities, including CVE-2026-68820, a zero-day flaw actively exploited in the wild. This vulnerability resides in the Windows kernel's Ancillary Function Driver for WinSock (afd.sys) and allows attackers with existing access to escalate privileges to SYSTEM level by exploiting a race condition. Notably, the Lazarus Group has been linked to the exploitation of this flaw in their Operation Dream Job campaign. Additionally, the update addressed four critical remote code execution vulnerabilities (CVE-2026-62878, CVE-2026-62893, CVE-2026-62815, and CVE-2026-59124) that require no user interaction, emphasizing the urgency for organizations to apply these patches promptly. The release also completed a two-part fix for a SharePoint vulnerability chain, with the initial authentication bypass (CVE-2026-55040) patched in July and the subsequent remote code execution component (CVE-2026-63520) addressed in August. This underscores the importance of timely patch management to mitigate potential exploitation risks.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
AI-Assisted Exploit Chain Unveiled: Unauthenticated RCE in Microsoft SharePoint
Government Administration2 months ago

AI-Assisted Exploit Chain Unveiled: Unauthenticated RCE in Microsoft SharePoint

In August 2026, security researchers identified a critical vulnerability in Microsoft SharePoint, designated as CVE-2026-55040, which allows unauthenticated attackers to impersonate any user, including administrators, without valid credentials. This flaw affects SharePoint Server Subscription Edition, SharePoint Server 2019, and SharePoint Server 2016. Exploiting this vulnerability requires knowledge of the target account's Active Directory security identifier (SID) or user principal name (UPN). Rapid7 further discovered that chaining this authentication bypass with another vulnerability, CVE-2026-63520, enables remote code execution on the server without authentication. Microsoft released patches in July 2026 to address these issues. The discovery underscores the evolving threat landscape, where attackers increasingly leverage AI-assisted tools to identify and exploit vulnerabilities. Organizations must remain vigilant, ensuring timely application of security patches and adopting proactive measures to mitigate such sophisticated attack vectors.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Zoom Annotation Vulnerabilities Expose Clients to Hijacking - August 2026
Information Technology/IT2 months ago

Zoom Annotation Vulnerabilities Expose Clients to Hijacking - August 2026

In August 2026, critical vulnerabilities were discovered in Zoom's annotation feature, allowing meeting participants to hijack other attendees' clients without any user interaction. These flaws, identified as CVE-2026-53413, CVE-2026-53414, and CVE-2026-53415, stemmed from improper input validation and message handling within the annotation tool. Exploitation could lead to unauthorized control over participants' systems, posing significant security risks. Zoom addressed these issues by releasing patches in June and July 2026, with no reported exploitation as of the disclosure date. This incident underscores the growing concerns over the security of widely-used collaboration tools, especially as remote work continues to be prevalent. The rapid identification and patching of such vulnerabilities highlight the importance of proactive security measures and the need for organizations to stay vigilant against potential threats in digital communication platforms.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
GhostJacking: Unveiling AI Agent Security Vulnerabilities
Financial Services2 months ago

GhostJacking: Unveiling AI Agent Security Vulnerabilities

In August 2026, Tenet Security unveiled 'GhostJacking,' a sophisticated attack technique exploiting AI agents' reliance on trusted data sources. By embedding malicious instructions into security alerts, logs, and error reports, attackers can manipulate AI agents to execute unauthorized actions, including code execution, credential theft, and infrastructure takeover. Demonstrations highlighted vulnerabilities in platforms like Cloudflare, Datadog, and Sentry, where AI agents misinterpreted poisoned data as legitimate commands, leading to significant security breaches. This incident underscores the critical need for robust identity governance and operational safeguards in AI agent deployments. As AI systems become integral to organizational operations, ensuring they can discern and resist malicious manipulations is paramount to maintaining security and trust.

High impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Critical Metabase SQL Injection Zero-Day Vulnerability Discovered
Financial Services2 months ago

Critical Metabase SQL Injection Zero-Day Vulnerability Discovered

In August 2026, Metabase disclosed a critical SQL injection vulnerability affecting versions 1.58 and above of its Cloud platform. This flaw allowed remote attackers to inject SQL statements into the application database, granting them administrator access. Exploiting this access, attackers could alter configurations, steal stored credentials, and access connected databases. Metabase promptly blocked the exploited endpoints and released patches to address the vulnerability. Self-hosted instances with exposed /api/session/reset_password endpoints remained at risk until updated. This incident underscores the persistent threat posed by SQL injection vulnerabilities, which continue to be prevalent despite longstanding awareness. Organizations are reminded of the importance of implementing prepared statements and other secure coding practices to mitigate such risks.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(medium)
Read report
Gunra Ransomware Exploits Fortinet and Schneider Electric Vulnerabilities
Health Care / Life Sciences2 months ago

Gunra Ransomware Exploits Fortinet and Schneider Electric Vulnerabilities

In August 2026, cybersecurity agencies from South Korea and the U.S. issued warnings about Gunra ransomware attacks targeting critical infrastructure sectors worldwide. The attackers exploited vulnerabilities in Schneider Electric PowerLogic P5 (CVE-2024-5559) and Fortinet FortiOS and FortiProxy (CVE-2025-24472) appliances to gain initial access. Employing a double extortion model, they encrypted data and exfiltrated sensitive information, threatening to publish it unless a ransom was paid within five to seven days. Since its emergence in April 2025, Gunra has listed 51 victims, primarily in South Korea, Brazil, Spain, Thailand, and Hong Kong. The group utilizes phishing campaigns and advanced encryption methods like Salsa20 and ChaCha20 to execute their attacks. This incident underscores the evolving tactics of ransomware groups, highlighting the critical need for organizations to promptly patch known vulnerabilities and implement robust security measures to protect against such sophisticated threats.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Exploiting Windows 11 Plug and Play: A Path to SYSTEM-Level Access
Government Administration2 months ago

Exploiting Windows 11 Plug and Play: A Path to SYSTEM-Level Access

In August 2026, security researchers Alejandro Hernando and Borja Martinez unveiled a method to exploit Windows Plug and Play (PnP) auto-installation processes, enabling unprivileged users to achieve SYSTEM-level code execution on fully updated Windows 11 systems. By emulating specific USB devices, they triggered the installation of signed vendor software containing vulnerabilities, which they chained to escalate privileges. Notably, this attack vector can be executed both physically and remotely via Remote Desktop Protocol (RDP) when USB redirection is enabled. This discovery underscores the critical need for organizations to scrutinize device installation processes and enforce strict policies on USB device usage and redirection settings. The ability to escalate privileges through such mechanisms highlights potential gaps in endpoint security, emphasizing the importance of comprehensive monitoring and control over peripheral device interactions.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
OpenAI's GPT-5.6-Cyber: A Leap Forward in AI-Driven Cybersecurity
Computer Software/Engineering2 months ago

OpenAI's GPT-5.6-Cyber: A Leap Forward in AI-Driven Cybersecurity

In August 2026, OpenAI introduced GPT-5.6-Cyber, a specialized AI model designed to enhance cybersecurity tasks such as vulnerability research, penetration testing, and incident response. Built upon GPT-5.6 Sol, this model reduces refusals for high-risk, dual-use cyber tasks, achieving a 95% completion rate for complex cybersecurity requests. Notably, GPT-5.6-Cyber identified CVE-2026-15903, a critical out-of-bounds read and write vulnerability in the V8 JavaScript engine, which could allow remote code execution via crafted HTML pages. This vulnerability was promptly patched by Google in mid-July 2026. The release of GPT-5.6-Cyber underscores the growing integration of AI in cybersecurity, providing defenders with advanced tools to proactively identify and mitigate vulnerabilities. This development highlights the importance of balancing AI capabilities with safety measures to prevent potential misuse, as AI models become increasingly adept at both offensive and defensive cyber operations.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(low)
C&CCommand & Control(low)
EExfiltration(low)
IImpact(low)
Read report
Critical Python Privilege Escalation Vulnerability (CVE-2026-12003) Discovered
Computer Software/Engineering2 months ago

Critical Python Privilege Escalation Vulnerability (CVE-2026-12003) Discovered

In June 2026, a critical vulnerability (CVE-2026-12003) was identified in Python versions 3.11.0a3 through 3.15.0b2, affecting Windows installations. This flaw allowed low-privilege users to execute arbitrary code with elevated privileges by exploiting improper handling of the VPATH variable, leading to unauthorized access to alternative library folders. The vulnerability was introduced in December 2021 and publicly disclosed on June 16, 2026. ([securityvulnerability.io](https://securityvulnerability.io/vulnerability/CVE-2026-12003?utm_source=openai)) This incident underscores the importance of securing software installation paths and the need for organizations to promptly apply security patches to prevent privilege escalation attacks. The Python Software Foundation has released updates to address this issue, and users are advised to upgrade to the latest versions to mitigate potential risks.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Gunra Ransomware Group: A Growing Global Threat
Government Administration2 months ago

Gunra Ransomware Group: A Growing Global Threat

In August 2026, U.S. and South Korean cyber agencies issued a joint advisory regarding the Gunra ransomware group, a ransomware-as-a-service (RaaS) operation that has been active since April 2025. Gunra employs double-extortion tactics, encrypting victims' data and threatening to publish it unless a ransom is paid. The group has targeted a wide range of sectors, including academia, financial services, government facilities, healthcare, manufacturing, and utilities, across multiple continents. Notably, Gunra has been recruiting ethical hackers and penetration testers as initial access brokers, offering them a share of the ransom profits in exchange for access to enterprise networks. This advisory underscores the evolving nature of ransomware threats, highlighting the increasing sophistication of RaaS operations and their global reach. Organizations are urged to bolster their cybersecurity defenses, particularly by addressing known vulnerabilities in internet-facing devices and implementing robust access controls to mitigate the risk of such attacks.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
SonicWall SMA1000 Vulnerabilities Exploited by Ransomware Gangs
Financial Services3 months ago

SonicWall SMA1000 Vulnerabilities Exploited by Ransomware Gangs

In July 2026, SonicWall disclosed two critical vulnerabilities in its SMA1000 series appliances: CVE-2026-15409, a server-side request forgery flaw, and CVE-2026-15410, a code injection vulnerability. These flaws allowed unauthenticated attackers to execute arbitrary commands, leading to unauthorized access and potential data breaches. ([sonicwall.com](https://www.sonicwall.com/support/notices/%E8%A3%BD%E5%93%81%E3%81%AB%E9%96%A2%E3%81%99%E3%82%8B%E9%87%8D%E8%A6%81%E3%81%AA%E3%81%8A%E7%9F%A5%E3%82%89%E3%81%9B-sma-1000%E3%82%B7%E3%83%AA%E3%83%BC%E3%82%BA%E3%81%AB%E8%A4%87%E6%95%B0%E3%81%AE%E8%84%86%E5%BC%B1%E6%80%A7/kA1VN000001nv6D0AQ?utm_source=openai)) The U.S. Cybersecurity and Infrastructure Security Agency (CISA) confirmed that ransomware groups have actively exploited these vulnerabilities, emphasizing the urgency for organizations to apply the available patches promptly. The exploitation of these vulnerabilities underscores a growing trend of attackers targeting remote access solutions to infiltrate corporate networks. Organizations must prioritize securing their remote access infrastructure to prevent such breaches.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
Read report
StormEncryptor Ransomware: Exploiting N-central Vulnerability CVE-2026-18577
Information Technology/IT3 months ago

StormEncryptor Ransomware: Exploiting N-central Vulnerability CVE-2026-18577

In August 2026, the financially motivated threat actor Storm-1175, previously associated with Medusa ransomware, began deploying a new ransomware strain named StormEncryptor. The attacks were likely initiated by exploiting an authentication-bypass vulnerability (CVE-2026-18577) in the N-central remote monitoring and management tool. Once inside the network, the attackers utilized tools like AnyDesk and SimpleHelp for remote management, Advanced IP Scanner for network discovery, and Mimikatz to extract credentials. StormEncryptor, written in C++, appends the ".encrypted" extension to files and drops a ransom note titled '!!!README_FIRST!!!.txt' in each directory, demanding contact within three days to prevent data leakage. This incident underscores the evolving tactics of ransomware groups, highlighting the rapid transition from initial access to data exfiltration and encryption. The exploitation of vulnerabilities in widely used management tools like N-central emphasizes the critical need for organizations to promptly apply security patches and monitor for signs of compromise to mitigate such threats.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports