Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Health Care / Life Sciences

Breach intelligence, attack campaigns, and threat reports targeting the Health Care / Life Sciences sector.

3490 threat reports
Page 68 of 291
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Health Care / Life Sciences Threat Reports

Showing 805–816 / 3490 reports
Critical Check Point VPN Vulnerability Exploited by Qilin Ransomware Group
Health Care / Life Sciences3 months ago

Critical Check Point VPN Vulnerability Exploited by Qilin Ransomware Group

In May 2026, a critical authentication bypass vulnerability, CVE-2026-50751, was discovered in Check Point's Remote Access VPN and Mobile Access products utilizing the deprecated IKEv1 protocol. This flaw allowed unauthenticated remote attackers to establish VPN connections without valid credentials, effectively granting unauthorized access to internal networks. The Qilin ransomware group exploited this vulnerability, initiating attacks as early as May 7, 2026, targeting several organizations globally. Check Point became aware of these exploits by June 4, 2026, and promptly released patches and mitigation measures to address the issue. The exploitation of CVE-2026-50751 underscores the persistent threat posed by ransomware groups like Qilin, who rapidly adapt to exploit known vulnerabilities. This incident highlights the critical importance of timely vulnerability management and the need for organizations to deprecate outdated protocols to prevent unauthorized access and potential data breaches.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
Read report
Storm-1175's New StormEncryptor Ransomware Exploits N-central Vulnerability
Information Technology/IT3 months ago

Storm-1175's New StormEncryptor Ransomware Exploits N-central Vulnerability

In August 2026, Microsoft disclosed that Storm-1175, a financially motivated threat actor linked to China, deployed a new ransomware strain named StormEncryptor. This malware, written in C++, appends the ".encrypted" extension to files and drops a ransom note titled "!!!README_FIRST!!!.txt" in each directory. The group likely exploited CVE-2026-18577, a critical authentication bypass vulnerability in N-able's N-central platform, to gain initial access. This flaw allows unauthenticated attackers to obtain full control over managed endpoints. Storm-1175's rapid exploitation of such vulnerabilities underscores the urgency for organizations to apply patches promptly and monitor their environments for signs of compromise. The emergence of StormEncryptor signifies a shift in Storm-1175's tactics, moving from the previously used Medusa ransomware to a new, custom-developed strain. This evolution highlights the group's adaptability and the increasing sophistication of ransomware campaigns targeting critical infrastructure sectors globally.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Critical Metabase Vulnerability Exposes Sensitive Data
Information Technology/IT3 months ago

Critical Metabase Vulnerability Exposes Sensitive Data

In February 2026, a critical vulnerability was discovered in Metabase, an open-source business intelligence tool. This flaw allowed authenticated users, including those with embedding permissions, to craft specially formatted notification templates to extract sensitive information, such as database connection details and credentials, and send them via outbound email. Metabase promptly addressed the issue by releasing security advisories and urging all self-hosted users to upgrade to the latest versions to mitigate potential exploitation. ([metabase.com](https://www.metabase.com/blog/security-vulnerability?utm_source=openai)) This incident underscores the importance of timely software updates and vigilant monitoring of open-source tools. As organizations increasingly rely on such platforms, ensuring their security becomes paramount to prevent unauthorized data access and potential breaches.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(low)
EExfiltration(low)
IImpact(low)
Read report
Operation Lunar Peek: A Deep Dive into the Exploitation of PAN-OS Vulnerabilities
Computer Software/Engineering3 months ago

Operation Lunar Peek: A Deep Dive into the Exploitation of PAN-OS Vulnerabilities

In November 2024, Palo Alto Networks disclosed two critical vulnerabilities in its PAN-OS software: CVE-2024-0012, an authentication bypass flaw, and CVE-2024-9474, a privilege escalation issue. Exploited together in a campaign dubbed 'Operation Lunar Peek,' these vulnerabilities allowed unauthenticated attackers to gain root access to firewall management interfaces. Approximately 2,000 devices were compromised, primarily in the United States and India, leading to unauthorized administrative actions and potential configuration tampering. This incident underscores the escalating sophistication of cyber threats, where attackers rapidly exploit vulnerabilities before patches are widely applied. It highlights the necessity for organizations to adopt proactive vulnerability management strategies, including timely patching and restricting access to critical management interfaces, to mitigate the risk of similar exploits.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Critical Passkey Vulnerabilities Uncovered: Bypassing Phishing-Resistant MFA
Banking/Mortgage3 months ago

Critical Passkey Vulnerabilities Uncovered: Bypassing Phishing-Resistant MFA

In August 2026, researchers identified multiple vulnerabilities in passkey authentication systems, revealing methods to bypass phishing-resistant multi-factor authentication (MFA) without compromising underlying cryptographic protocols. These attacks exploited weaknesses in Windows Event Logging Service (CVE-2026-34348), Google Password Manager's synced passkeys, and Windows Hello for Business, allowing unauthorized access through replayed authentication materials and malware manipulation. The incidents underscore the necessity for organizations to reassess the security of passkey implementations and enhance endpoint protections to mitigate such sophisticated threats. As passkeys gain popularity as a passwordless authentication method, these findings highlight the importance of continuous vigilance and adaptation to emerging attack vectors targeting authentication mechanisms.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Critical Security Flaws Uncovered in AI Agent Skills: Snyk's 2026 Audit Findings
Computer Software/Engineering3 months ago

Critical Security Flaws Uncovered in AI Agent Skills: Snyk's 2026 Audit Findings

In early 2026, Snyk conducted a comprehensive security audit of the AI Agent Skills ecosystem, analyzing 3,984 skills from platforms like ClawHub and skills.sh. The audit revealed that 13.4% of these skills contained critical security vulnerabilities, including malware distribution, prompt injection attacks, and exposed secrets. Notably, 36.82% of the skills had at least one security flaw, posing significant risks to users of AI agents such as OpenClaw, Claude Code, and Cursor. ([snyk.io](https://snyk.io/blog/toxicskills-malicious-ai-agent-skills-clawhub/?utm_source=openai)) This incident underscores the escalating threat landscape associated with AI agents, particularly as they become more integrated into development workflows. The prevalence of prompt injection attacks highlights the urgent need for robust security measures and continuous monitoring to safeguard against the exploitation of AI systems.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Critical Metabase Zero-Day Vulnerability Exploited in August 2026
Financial Services3 months ago

Critical Metabase Zero-Day Vulnerability Exploited in August 2026

In August 2026, Metabase, a business intelligence and data visualization platform, disclosed a critical zero-day vulnerability that allowed unauthenticated remote attackers to inject arbitrary SQL into the application database. This flaw enabled attackers to gain administrator access, modify configurations, steal stored credentials, and access connected databases. The vulnerability affected versions 1.58 and above, with patches released to address the issue. Organizations using self-hosted versions were urged to apply these patches immediately to mitigate potential exploitation. This incident underscores the persistent threat posed by zero-day vulnerabilities in widely used software platforms. It highlights the importance of proactive security measures, timely patch management, and continuous monitoring to detect and respond to unauthorized access attempts promptly.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
Urgent: Patch Critical Vulnerability in Progress Kemp LoadMaster Now
Financial Services3 months ago

Urgent: Patch Critical Vulnerability in Progress Kemp LoadMaster Now

In June 2026, a critical vulnerability (CVE-2026-8037) was identified in Progress Kemp LoadMaster appliances, allowing unauthenticated attackers to execute arbitrary commands remotely. This command injection flaw, present in the 'escape_quotes()' function, enables attackers to gain root access without valid credentials. ([hackerposts.org](https://www.hackerposts.org/en/blog/progress-kemp-loadmaster-cve-2026-8037-preauth-rce?utm_source=openai)) Exploitation attempts began on June 29, 2026, following the public release of a proof-of-concept exploit. ([esentire.com](https://www.esentire.com/security-advisories/progress-kemp-loadmaster-vulnerability-targeted-cve-2026-8037?utm_source=openai)) The inclusion of this vulnerability in CISA's Known Exploited Vulnerabilities catalog underscores the urgency for organizations to apply the necessary patches promptly to mitigate potential threats. ([aha.org](https://www.aha.org/h-isac-white-reports/2026-07-01-h-isac-tlp-white-threat-bulletin-observed-exploitation-attempts-targeting-critical-progress?utm_source=openai))

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
CISA Highlights Critical Vulnerability in Progress LoadMaster: CVE-2026-8037
Financial Services3 months ago

CISA Highlights Critical Vulnerability in Progress LoadMaster: CVE-2026-8037

In August 2026, the Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-8037 to its Known Exploited Vulnerabilities (KEV) Catalog, highlighting active exploitation of this critical command injection vulnerability in Progress Software's LoadMaster appliance. This flaw allows unauthenticated attackers to execute arbitrary commands via unsanitized input in multiple API endpoints, potentially leading to full system compromise. Organizations utilizing affected versions are urged to apply patches immediately to mitigate the risk of unauthorized access and data breaches. The inclusion of CVE-2026-8037 in the KEV Catalog underscores the persistent threat posed by command injection vulnerabilities, which remain a favored attack vector for cyber adversaries. This incident serves as a critical reminder for organizations to prioritize timely remediation of known vulnerabilities and to implement robust input validation mechanisms to prevent similar exploits.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Atlassian Rovo Vulnerability: A Wake-Up Call for AI Security
Computer Software/Engineering3 months ago

Atlassian Rovo Vulnerability: A Wake-Up Call for AI Security

In August 2026, security researchers identified vulnerabilities in Atlassian's Rovo AI assistant that could be exploited to exfiltrate data from Jira and Confluence. PromptArmor discovered that embedding malicious instructions within content processed by Rovo allowed unauthorized data collection and transmission to external servers. Separately, Varonis Threat Labs found that manipulating the 'rovoChatPrompt' URL parameter enabled attackers to execute commands with a user's privileges, leading to data exfiltration. Atlassian addressed the URL parameter issue on July 8, 2026, but the content-based vulnerability remained unpatched as of August 5, 2026. This incident underscores the growing security challenges associated with integrating AI assistants into enterprise environments. It highlights the necessity for organizations to implement stringent access controls, continuously monitor AI interactions, and promptly address vulnerabilities to prevent unauthorized data access and exfiltration.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
The Rise of Identity-Based Cyber Attacks in 2026
Financial Services3 months ago

The Rise of Identity-Based Cyber Attacks in 2026

In 2026, the cybersecurity landscape witnessed a significant shift towards identity-based attacks, with nearly 90% of incidents involving compromised identities. Attackers increasingly utilized techniques such as credential theft, multifactor authentication (MFA) manipulation, session hijacking, and social engineering to gain unauthorized access. Once inside, they established persistence, escalated privileges, and moved laterally across environments, often mimicking legitimate administrative behavior, making detection challenging. This trend underscores the critical need for organizations to enhance identity security measures and adopt a zero-trust approach to mitigate such threats. The rise in identity-driven attacks highlights the evolving tactics of threat actors who exploit human factors and identity weaknesses rather than traditional technical vulnerabilities. This shift necessitates a reevaluation of security strategies, emphasizing robust identity and access management, continuous monitoring, and user education to prevent unauthorized access and potential data breaches.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
New CSS Attacks Expose Webmail Vulnerabilities: Protect Your Accounts
Financial Services3 months ago

New CSS Attacks Expose Webmail Vulnerabilities: Protect Your Accounts

In August 2026, PortSwigger researcher Gareth Heyes unveiled a series of CSS-based attacks capable of breaching webmail defenses across platforms like Outlook, Gmail, Fastmail, Proton Mail, Yahoo Mail, and AOL Mail. These techniques exploit vulnerabilities in HTML and CSS handling within webmail interfaces, allowing attackers to capture passwords, hijack third-party accounts, leak tokens, and manipulate AI tools that process emails. The research, presented at Black Hat USA 2026, demonstrated proof-of-concept attacks without evidence of malicious exploitation. Some providers have since addressed specific vulnerabilities, but others remain unpatched. This incident underscores the evolving nature of web-based threats, highlighting the need for continuous vigilance and proactive security measures. As attackers develop more sophisticated methods to exploit webmail platforms, organizations must prioritize regular security assessments and updates to protect sensitive user information.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports