## Executive Summary The threat landscape is dominated by **widespread, active exploitation of critical vulnerabilities** across core enterprise infrastructure, including network appliances, endpoint security, and web platforms. Urgent patching is required for **Cisco SD-WAN**, **Fortinet FortiClientEMS**, and **Citrix NetScaler**, all of which are under active attack with CISA-mandated deadlines. A new wave of **Linux kernel privilege escalation** and **AI-assisted exploitation** marks a significant escalation in attacker capabilities, while major breaches via **supply chain attacks (GitHub)** and **phishing-as-a-service (Tycoon2FA)** underscore persistent risks to software development and identity security.

## ⚠️ Immediate Action Required * **🏢 Cisco Catalyst SD-WAN Manager Authentication Bypass** A critical vulnerability (CVE-2026-20127) allows unauthenticated attackers to gain administrative access. This flaw is actively exploited and has been added to CISA's Known Exploited Vulnerabilities catalog. * **CVE:** CVE-2026-20127 (CVSS: 10.0) * **Status:** Active exploitation detected * **Vulnerable:** Multiple versions of Cisco Catalyst SD-WAN Manager * **Fixed:** Not specified in source — check vendor advisory * **Workaround:** None mentioned in source * **Reference:** [SC Media: 10.0 Cisco Catalyst SD-WAN Controller bug added to CISA’s KEV list](https://www.scworld.com/news/10-0-cisco-catalyst-sd-wan-controller-bug-added-to-cisas-kev-list)

* **🏢 Fortinet FortiClientEMS SQL Injection & Access Control Flaws** Critical vulnerabilities (CVE-2026-21643, CVE-2026-35616) are being exploited to deploy infostealer malware. Unauthenticated attackers can execute arbitrary code and bypass security controls. * **CVE:** CVE-2026-21643 & CVE-2026-35616 (CVSS: Not specified) * **Status:** Active exploitation detected * **Vulnerable:** Versions 7.4.0 through 7.4.6 * **Fixed:** Patches and hotfixes are available * **Workaround:** None mentioned in source * **Reference:** [BleepingComputer: Hackers exploit FortiClient EMS flaw to push infostealer malware](https://www.bleepingcomputer.com/news/security/hackers-exploit-forticlient-ems-flaw-to-push-infostealer-malware/)

* **Citrix NetScaler SAML Memory Overread Vulnerability** A critical out-of-bounds read flaw (CVE-2026-3055) in NetScaler ADC/Gateway configured as a SAML IdP allows unauthenticated attackers to leak sensitive memory data. It is being actively exploited. * **CVE:** CVE-2026-3055 (CVSS: 9.3) * **Status:** Active exploitation detected * **Vulnerable:** Multiple prior releases * **Fixed:** Not specified in source — check vendor advisory * **Workaround:** None mentioned in source * **Reference:** [FortiGuard Outbreak Alerts: Citrix NetScaler Memory Overread Vulnerability](https://fortiguard.fortinet.com/outbreak-alert/citrix-netscaler-memory-overread)

* **cPanel & WHM Authentication Bypass** A critical flaw (CVE-2026-41940) allows unauthenticated attackers to gain administrative control of web hosting servers, leading to ransomware deployment and server takeover. Over 40,000 servers have been compromised. * **CVE:** CVE-2026-41940 (CVSS: 9.8) * **Status:** Active exploitation detected * **Vulnerable:** cPanel 11.40 through 130.0.19 * **Fixed:** Patches are available in specific builds * **Workaround:** None mentioned in source * **Reference:** [FortiGuard Threat Signal: cPanel & WHM Authentication Bypass](https://fortiguard.fortinet.com/threat-signal-report/6447)

* **Linux Kernel 'Dirty Frag' Local Privilege Escalation** A critical flaw in the Linux kernel allows unprivileged users to gain root access by exploiting page-cache write flaws. It affects kernel versions 4.11 to 6.7 and is actively exploited. * **CVE:** CVE-2026-43284 (CVSS: Not specified) * **Status:** Active exploitation detected * **Vulnerable:** Linux kernel versions 4.11 to 6.7 * **Fixed:** Not specified in source — check vendor advisory * **Workaround:** None mentioned in source * **Reference:** [SC Media: New Linux privilege escalation flaw ‘Fragnesia’ disclosed; PoC available](https://www.scworld.com/news/new-linux-privilege-escalation-flaw-fragnesia-disclosed-poc-available)

## 🔍 Threat Activity * **GitHub Supply Chain Breach via Malicious VS Code Extension:** Threat actor TeamPCP breached GitHub's internal repositories using a malicious Visual Studio Code extension, compromising 3,800 repos. The attack involved credential theft and data exfiltration. GitHub contained the breach by isolating the affected endpoint and removing the extension. Reference: [The Hacker News: GitHub Internal Repositories Breached via Malicious Nx Console VS Code Extension](https://thehackernews.com/2026/05/github-internal-repositories-breached.html) * **Tycoon2FA Phishing-as-a-Service Persists Post-Takedown:** Despite a global law enforcement takedown, the Tycoon2FA platform, which bypasses MFA using adversary-in-the-middle techniques targeting Microsoft 365 and Gmail, has quickly resumed operations. Reference: [CrowdStrike: Tycoon2FA persists post-takedown](https://www.crowdstrike.com/?p=289702) * **AI-Generated Zero-Day Bypasses 2FA:** Google identified the first known instance of an AI-developed zero-day exploit, a Python script targeting a popular open-source web administration tool to bypass two-factor authentication. It was discovered before mass exploitation. Reference: [Infosecurity Magazine: Hackers Observed Using AI to Develop Zero-Day for the First Time](https://www.infosecurity-magazine.com/news/hackers-using-ai-zero-day-first/) * **Cryptojacking Campaign Uses AI Chatbots & SEO Poisoning:** A campaign uses AI chatbot recommendations and SEO poisoning to redirect users to malicious sites impersonating system utilities, leading to remote access via ScreenConnect and .NET for GPU cryptojacking. Reference: [The Hacker News: AI Chatbot Recommendations Redirect Users to Cryptojacking Malware Sites](https://thehackernews.com/2026/05/ai-chatbot-recommendations-redirect.html)

## 📋 Patches & Updates * **🏢 Microsoft SharePoint:** Multiple critical RCE and spoofing vulnerabilities (CVE-2026-20963, CVE-2026-32201) are under active exploitation. Patches were released in April 2026 for SharePoint Server 2016, 2019, and other versions. Reference: [Microsoft Security Response Center: CVE-2026-45659 Microsoft SharePoint Remote Code Execution Vulnerability](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45659) * **Microsoft Defender:** Two actively exploited vulnerabilities (CVE-2026-41091, CVE-2026-45498) allowing privilege escalation and DoS have been patched in Microsoft Defender Antimalware Platform version 4.18.2604+. Reference: [Microsoft Security Response Center: CVE-2026-45498 Microsoft Defender Denial of Service Vulnerability](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45498) * **Trend Micro Apex One:** Multiple critical RCE and privilege escalation flaws (CVE-2026-34926, CVSS 9.4) exploited in the wild have been patched for Windows and macOS versions. Reference: [Help Net Security: Actively exploited Trend Micro Apex One flaw gets CISA warning (CVE-2026-34926)](https://www.helpnetsecurity.com/?p=371992) * **Drupal:** A critical SQL injection vulnerability (CVE-2026-9082) leading to RCE is actively exploited. Patches are available for Drupal 10.x and 11.x prior to specific updates. CISA has mandated patching for federal agencies. Reference: [BleepingComputer: CISA orders feds to patch actively exploited Drupal vulnerability](https://www.bleepingcomputer.com/news/security/cisa-orders-feds-to-patch-actively-exploited-drupal-vulnerability/)

## Today's Priorities 1. **Emergency Patching:** Immediately patch **Cisco SD-WAN Manager**, **Fortinet FortiClientEMS**, and **Citrix NetScaler** appliances, as these are under active attack with critical authentication bypass and code execution flaws. 2. **Linux Kernel Assessment:** Review and prioritize patching for Linux systems running kernel versions 4.11 to 6.7 against the 'Dirty Frag' LPE vulnerability, prioritizing internet-facing and multi-tenant systems. 3. **Web Platform Review:** Audit and patch **cPanel/WHM**, **Drupal**, and **Ghost CMS** installations, as these are being exploited at scale for server takeover and malware delivery. 4. **Supply Chain Vigilance:** Review developer access controls and monitor for unauthorized VS Code extensions following the GitHub breach, and reinforce awareness of SEO-poisoning and AI chatbot-based social engineering tactics.

## 🔗 References

• [SC Media: 10.0 Cisco Catalyst SD-WAN Controller bug added to CISA’s KEV list](https://www.scworld.com/news/10-0-cisco-catalyst-sd-wan-controller-bug-added-to-cisas-kev-list)
• [BleepingComputer: Hackers exploit FortiClient EMS flaw to push infostealer malware](https://www.bleepingcomputer.com/news/security/hackers-exploit-forticlient-ems-flaw-to-push-infostealer-malware/)
• [FortiGuard Outbreak Alerts: Citrix NetScaler Memory Overread Vulnerability](https://fortiguard.fortinet.com/outbreak-alert/citrix-netscaler-memory-overread)
• [The Hacker News: GitHub Internal Repositories Breached via Malicious Nx Console VS Code Extension](https://thehackernews.com/2026/05/github-internal-repositories-breached.html)
• [Infosecurity Magazine: Hackers Observed Using AI to Develop Zero-Day for the First Time](https://www.infosecurity-magazine.com/news/hackers-using-ai-zero-day-first/)