# Morning Executive Threat Briefing **Date:** 2026-06-20 | **Time:** 08:00 UTC

## Executive Summary The threat landscape remains at a critical level, dominated by active exploitation of vulnerabilities in core enterprise infrastructure and sophisticated supply chain attacks. Urgent patching is required for **Fortinet**, **NGINX**, and **Splunk**, with threat actors actively targeting these flaws. A significant **OAuth breach** at Klue has led to Salesforce data theft, while new malware campaigns demonstrate advanced evasion techniques, including ransomware abusing **Microsoft Teams** for C2 and EDR-killer tools being commoditized. Law enforcement disruption of the SocGholish botnet is a positive development, but the volume of critical, actively exploited issues demands immediate attention.

## ⚠️ Immediate Action Required

* **🏢 Fortinet FortiSandbox Critical RCE Flaws Actively Exploited** Multiple critical vulnerabilities in Fortinet FortiSandbox are under active attack, allowing unauthenticated remote code execution. * **CVE:** CVE-2026-39813, CVE-2026-39808 (CVSS: Up to 9.8) * **Status:** Active exploitation detected * **Vulnerable:** Versions prior to 5.0.6 and 4.4.9 * **Fixed:** FortiSandbox 5.0.6, 4.4.9 * **Workaround:** None mentioned in source * **Reference:** [SecurityWeek](https://www.securityweek.com/?p=47207)

* **🏢 NGINX Critical Heap Buffer Overflow Under Active Attack** A critical heap buffer overflow in NGINX's `ngx_http_rewrite_module` (CVE-2026-42945) is being exploited in the wild, leading to RCE or DoS. * **CVE:** CVE-2026-42945 (CVSS: 8.1) * **Status:** Active exploitation detected * **Vulnerable:** NGINX Open Source 1.0.0 through 1.25.0 * **Fixed:** Not specified in source — check vendor advisory * **Workaround:** None mentioned in source * **Reference:** [Help Net Security](https://www.helpnetsecurity.com/?p=371114)

* **🏢 Splunk Enterprise Critical Unauthenticated RCE** Critical vulnerabilities in Splunk Enterprise, including CVE-2026-20253, allow unauthenticated remote code execution and are being actively exploited. * **CVE:** CVE-2026-20253 (CVSS: Up to 9.8) * **Status:** Active exploitation detected * **Vulnerable:** Splunk Enterprise 10.0.0 through 10.2.3 and earlier * **Fixed:** Not specified in source — check vendor advisory * **Workaround:** None mentioned in source * **Reference:** [Help Net Security](https://www.helpnetsecurity.com/?p=375286)

* **Joomla JCE Plugin Critical PHP Code Execution** CISA has added CVE-2026-48907, a critical access control flaw in Joomla's JCE plugin, to its KEV catalog due to active exploitation, allowing unauthenticated attackers to execute arbitrary PHP code. * **CVE:** CVE-2026-48907 (CVSS: Not specified) * **Status:** Active exploitation detected * **Vulnerable:** JCE versions prior to 2.9.99.5 * **Fixed:** Version 2.9.99.5 * **Workaround:** None mentioned in source * **Reference:** [BSI Germany](https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-1997)

* **Apache ActiveMQ Classic RCE Vulnerability** A critical RCE vulnerability (CVE-2026-34197) in Apache ActiveMQ Classic, exploitable via the Jolokia API, is actively being exploited. * **CVE:** CVE-2026-34197 (CVSS: 8.8) * **Status:** Active exploitation detected * **Vulnerable:** ActiveMQ prior to 5.19.4 and 6.0.0–6.2.2 * **Fixed:** Patched versions available * **Workaround:** None mentioned in source * **Reference:** [SC Media](https://www.scworld.com/brief/over-6400-apache-activemq-servers-at-risk-of-ongoing-attacks)

## 🔍 Threat Activity * **🏢 FortiBleed Credential Leak:** Over 70,000 Fortinet devices have had administrative and SSL VPN credentials leaked ("FortiBleed"), enabling lateral movement. CISA urges immediate password resets and session termination for Fortinet appliances. * **Klue OAuth Breach Leads to Salesforce Data Theft:** A breach of Klue's OAuth service accounts allowed threat actors (claimed by Icarus) to steal Salesforce CRM data via automated scripts. Salesforce has disabled the Klue Battlecards integration. * **Ransomware Groups Adopt Advanced Evasion:** The **Gentlemen RaaS** group now uses the "GentleKiller" framework to disable over 400 security processes across 48 EDR products. Separately, **DragonForce ransomware** is using Microsoft Teams relay servers to hide its command-and-control traffic, increasing stealth. * **Supply Chain Attacks Target Developers:** The **Mastra npm scope** was compromised via a hijacked contributor account, republishing 144 packages with a malicious dependency (`easy-day-js`) that acts as a crypto stealer and RAT. Separately, 15 malicious **JetBrains Marketplace plugins** have been caught stealing AI API keys from developers. * **Microsoft Defender Zero-Day:** The "RoguePlanet" zero-day (CVE-2026-50656) in Microsoft Defender allows local privilege escalation to SYSTEM on fully patched Windows 10/11 systems. Microsoft is developing a patch.

## 📋 Patches & Updates * **🏢 Microsoft 365 Copilot Vulnerabilities:** Microsoft has released patches for multiple vulnerabilities in Copilot that could allow data theft, content manipulation, and privilege escalation. Review and apply the latest updates for Copilot across Android, iOS, desktop, and Microsoft Edge. * **Apple Beats Studio Buds:** Apple has released firmware update 1B211 to patch a high-severity Bluetooth vulnerability (CVE-2025-20701) that could allow nearby attackers to eavesdrop via the microphone. * **Gogs Critical RCE (Unpatched):** A critical argument injection vulnerability (CVE-2025-8110) in the open-source Git service Gogs allows authenticated RCE via malicious branch names. **No patch is currently available**; consider mitigation strategies like network isolation.

## Today's Priorities 1. **Patch Immediately:** Prioritize patching **Fortinet FortiSandbox**, **NGINX**, and **Splunk Enterprise** due to active exploitation. Verify Joomla JCE plugin versions and update to 2.9.99.5. 2. **Review Fortinet Credentials:** If using Fortinet devices, enforce credential resets, especially for administrative and SSL VPN accounts, and review logs for signs of lateral movement. 3. **Audit Development Environments:** Review projects for dependencies on the compromised `@mastra` npm packages and any suspicious JetBrains plugins. Revoke and rotate any exposed API keys. 4. **Monitor for OAuth Abuse:** Review and audit third-party OAuth integrations, particularly in CRM platforms like Salesforce, and monitor for unusual data access patterns.

## 🔗 References

• [CISA Warns Fortinet Customers as FortiBleed Hits 86,644 FortiGate Devices](https://thehackernews.com/2026/06/cisa-warns-fortinet-customers-as.html)
• [Salesforce Disables Klue App Integration After OAuth Token Abuse Exposes Customer Data](https://thehackernews.com/2026/06/salesforce-disables-klue-app.html)
• [Attackers are exploiting critical NGINX vulnerability (CVE-2026-42945)](https://www.helpnetsecurity.com/?p=371114)
• [Unauthenticated RCE in Splunk Enterprise under active attack (CVE-2026-20253)](https://www.helpnetsecurity.com/?p=375286)
• [144 Mastra npm Packages Compromised via Hijacked Contributor Account](https://thehackernews.com/2026/06/144-mastra-npm-packages-compromised-via.html)