# Morning Executive Threat Briefing **Date:** 2026-06-18 | **Time:** 08:00 UTC | **Classification:** CRITICAL

## Executive Summary The threat landscape remains at a critical level, with active exploitation of vulnerabilities in core enterprise infrastructure and a surge in sophisticated supply chain attacks. Urgent patching is required for **Fortinet FortiSandbox**, **Cisco SD-WAN Manager**, and **Palo Alto Networks PAN-OS GlobalProtect**, all under active attack. A newly disclosed mass credential breach affecting **75,000 Fortinet firewalls** poses a severe risk to internal networks. Supply chain attacks have escalated, compromising the **Mastra npm scope** and the **JetBrains Marketplace**, directly targeting developers and their credentials.

## ⚠️ Immediate Action Required * **Fortinet FortiSandbox Critical RCE Vulnerabilities** Multiple critical vulnerabilities in FortiSandbox are being actively exploited, allowing unauthenticated remote code execution. * **CVE:** CVE-2026-39813, CVE-2026-39808, CVE-2026-25089, CVE-2026-26083, CVE-2026-44277 (CVSS: Up to 9.8) * **Status:** Active exploitation detected * **Vulnerable:** Versions prior to 5.0.6 and 4.4.9 * **Fixed:** FortiSandbox 5.0.6, 4.4.9 * **Workaround:** None mentioned in source * **Reference:** [SC Media: 3 Recently Patched Fortinet FortiSandbox Vulnerabilities in Hacker Crosshairs](https://www.securityweek.com/?p=47207)

* **Cisco Catalyst SD-WAN Manager Authentication Bypass** A critical flaw allows unauthenticated attackers to gain administrative access to the SD-WAN Manager. * **CVE:** CVE-2026-20127 (CVSS: 10.0) * **Status:** Active exploitation detected * **Vulnerable:** Multiple releases prior to 20.9.8.2 * **Fixed:** Version 20.9.8.2 * **Workaround:** None mentioned in source * **Reference:** [Cisco Security: Cisco Catalyst SD-WAN Controller Authentication Bypass Vulnerability](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-rpa-EHchtZk)

* **Palo Alto Networks PAN-OS GlobalProtect Auth Bypass** Attackers are exploiting this vulnerability to establish unauthorized VPN connections. * **CVE:** CVE-2026-0257 (CVSS: 9.1) * **Status:** Active exploitation detected * **Vulnerable:** PAN-OS versions prior to 10.2.7 * **Fixed:** PAN-OS 10.2.7 * **Workaround:** None mentioned in source * **Reference:** [The Hacker News: Palo Alto Warns of Active Exploitation of PAN-OS GlobalProtect VPN Flaw](https://thehackernews.com/2026/06/palo-alto-warns-of-active-exploitation.html)

* **Oracle PeopleSoft Zero-Day RCE** A critical zero-day is being exploited by the ShinyHunters group for data theft. * **CVE:** CVE-2026-35273 (CVSS: 9.8) * **Status:** Active exploitation detected * **Vulnerable:** PeopleTools 8.61, 8.62 * **Fixed:** Mitigations released; full patches pending * **Workaround:** Apply Oracle-provided mitigations * **Reference:** [Rapid7 Research: Active Exploitation of Oracle PeopleSoft Zero-Day (CVE-2026-35273)](https://www.rapid7.com/blog/post/etr-active-exploitation-of-oracle-peoplesoft-zero-day-cve-2026-35273)

## 🔍 Threat Activity * 🏢 **Massive Fortinet Firewall Credential Breach:** Credentials from approximately 75,000 compromised Fortinet firewalls have been exposed, with attackers pivoting into internal networks and Active Directory. The initial attack vector is unspecified. * **Mastra npm Scope Compromised:** A hijacked contributor account led to 142-144 malicious Mastra packages being republished with the `easy-day-js` crypto-stealer/RAT dependency. This is a direct supply chain attack on npm users. * **JetBrains Marketplace Malware:** 15 malicious plugins, installed 70,000 times, have been stealing AI API keys from developers' systems by posing as legitimate AI coding assistants. * **North Korean APT37 Phishing Campaign:** The state-sponsored group is deploying NarwhalRAT malware via spear-phishing emails that impersonate Microsoft security alerts, using malicious LNK files in ZIP attachments. * **SprySOCKS Backdoor Expands to Windows:** New Windows variants (WIN_DRV, WIN_PLUS) of this China-linked backdoor use signed kernel drivers for stealth, targeting government organizations for espionage.

## 📋 Patches & Updates * **Google Chrome Zero-Day:** CVE-2026-2441, a critical zero-day allowing remote code execution, has been patched in Chrome version 145. Users must update immediately. * **Microsoft Defender Vulnerabilities:** Two actively exploited vulnerabilities (CVE-2026-41091, CVE-2026-45498) allowing privilege escalation and DoS have been patched. Update Microsoft Defender Antimalware Platform to version 4.18.2604 or later. * **Multiple Critical Redis Vulnerabilities:** Patches are available for critical RCE and DoS flaws (CVE-2026-23479, CVE-2026-23631, CVE-2026-25243) affecting Redis 6.x, 7.x, and 8.x. Update to the latest patched version. * **Langflow Critical Vulnerabilities:** Multiple critical RCE and information disclosure flaws in the open-source AI dev platform are under active exploitation. Update to Langflow version 1.9.2 or later.

## Today's Priorities 1. **Patch Immediately:** Prioritize patching for all **Fortinet FortiSandbox**, **Cisco SD-WAN Manager**, and **Palo Alto PAN-OS** devices due to active, in-the-wild exploitation. 2. **Audit Fortinet Firewall Access:** Review logs and access controls for all Fortinet firewall administrative interfaces in light of the massive credential breach. Assume credential exposure and enforce MFA. 3. **Scan for Compromised Dependencies:** Immediately audit development environments for the malicious `easy-day-js` dependency and any compromised Mastra npm packages (versions published/re-published on 2026-06-17). 4. **Review Developer Toolchains:** Instruct development teams to review and remove any suspicious JetBrains plugins, especially those claiming AI functionality, and rotate any exposed API keys.

## 🔗 References

• [SC Media: 3 Recently Patched Fortinet FortiSandbox Vulnerabilities in Hacker Crosshairs](https://www.securityweek.com/?p=47207)
• [Cisco Security: Cisco Catalyst SD-WAN Controller Authentication Bypass Vulnerability](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-rpa-EHchtZk)
• [The Hacker News: Palo Alto Warns of Active Exploitation of PAN-OS GlobalProtect VPN Flaw](https://thehackernews.com/2026/06/palo-alto-warns-of-active-exploitation.html)
• [The Register Security: Massive password-stealing attack hits 75k Fortinet firewalls](https://www.theregister.com/a/5257877)
• [Microsoft Security Blog: From package to postinstall payload: Inside the Mastra npm supply chain compromi](https://www.microsoft.com/en-us/security/blog/?p=148197)