# Morning Executive Threat Briefing **Date:** 2026-06-23 | **Time:** 08:00 UTC

## Executive Summary The threat environment is at a critical peak, with widespread exploitation of newly disclosed vulnerabilities and a surge in credential-based attacks. The **FortiBleed** credential leak has escalated, impacting over 70,000 devices globally, prompting urgent action from CISA and NCSC. Multiple critical, unauthenticated RCE flaws in **Splunk Enterprise**, **Langflow**, and **NGINX** are under active attack, requiring immediate patching. Additionally, a sophisticated **WhatsApp VBS malware campaign** is targeting Windows users with RMM tools, and the **GentleKiller EDR-killer framework** is now available to ransomware affiliates, significantly lowering the barrier to disabling enterprise security.

## ⚠️ Immediate Action Required * **Splunk Enterprise Unauthenticated RCE Actively Exploited** A critical vulnerability (CVE-2026-20253) in Splunk Enterprise allows unauthenticated attackers to execute arbitrary code. Exploitation has been detected in the wild shortly after disclosure. * **CVE:** CVE-2026-20253 (CVSS: Not specified) * **Status:** Active exploitation detected * **Vulnerable:** Splunk Enterprise versions 10.0.0 through 10.2.3 and earlier * **Fixed:** Apply patches per Splunk advisory * **Workaround:** None mentioned in source * **Reference:** [Help Net Security](https://www.helpnetsecurity.com/?p=375286)

* **Apache ActiveMQ Critical RCE Vulnerability Exploited** A critical flaw (CVE-2026-34197, CVSS 8.8) in Apache ActiveMQ Classic allows authenticated attackers to execute arbitrary commands via the Jolokia API. Over 6,400 servers are at risk from ongoing attacks. * **CVE:** CVE-2026-34197 (CVSS: 8.8) * **Status:** Active exploitation detected * **Vulnerable:** ActiveMQ Classic prior to 5.19.4 and 6.0.0–6.2.2 * **Fixed:** Versions 5.19.4, 6.2.3 * **Workaround:** None mentioned in source * **Reference:** [SC Media](https://www.scworld.com/brief/over-6400-apache-activemq-servers-at-risk-of-ongoing-attacks)

* **NGINX Critical Heap Buffer Overflow Under Active Attack** A critical heap buffer overflow in NGINX's `ngx_http_rewrite_module` (CVE-2026-42945, CVSS 8.1) allows unauthenticated remote code execution or denial of service. Proof-of-concept code is published and active exploitation is confirmed. * **CVE:** CVE-2026-42945 (CVSS: 8.1) * **Status:** Active exploitation detected * **Vulnerable:** NGINX Open Source 1.0.0 through 1.25.0 * **Fixed:** Upgrade to latest patched version * **Workaround:** None mentioned in source * **Reference:** [SecurityWeek](https://www.securityweek.com/?p=47246)

* **Multiple Critical Samba Vulnerabilities Patched** Multiple critical vulnerabilities in Samba, including remote code execution flaws in printing and SAMR protocols, affect numerous versions and distributions. Patches are available via Red Hat and other vendors. * **CVE:** CVE-2026-4480, CVE-2026-4408, CVE-2026-3012, CVE-2026-2340, CVE-2026-1933 (CVSS: Not specified) * **Status:** Disclosed * **Vulnerable:** Samba 4.23.x prior to 4.23.8, 4.24.x prior to 4.24.3, and older versions * **Fixed:** Samba 4.23.8, 4.24.3, and later * **Workaround:** None mentioned in source * **Reference:** [Red Hat Errata](https://access.redhat.com/errata/RHSA-2026:22963)

## 🔍 Threat Activity * **FortiBleed Credential Leak Escalation:** Yesterday's report on the FortiBleed leak has escalated. Credentials for over 70,000 Fortinet devices, including administrative and SSL VPN logins, have been leaked and are being actively used in brute-force attacks. CISA and NCSC advise immediate termination of active sessions and credential resets for all affected devices. * **WhatsApp VBS Malware Campaign:** A high-severity campaign is delivering malicious VBS files via WhatsApp messages impersonating business documents. The malware uses living-off-the-land techniques to establish persistence and deploy RMM tools like ManageEngine, granting attackers remote access. * **GentleKiller EDR-Killer Framework:** The Gentlemen ransomware-as-a-service group has integrated the "GentleKiller" framework, which can disable over 400 security processes across 48 endpoint security products. This tool lowers the technical barrier for affiliates to bypass EDR protections prior to ransomware deployment. * **OXLOADER Malvertising Campaign:** A new Windows loader, OXLOADER, is distributing the CASTLESTEALER infostealer via malicious Google Ads impersonating legitimate software like Node.js. The malware uses obfuscation, DLL side-loading, and legitimate cloud services (e.g., Storj) for payload hosting to evade detection.

## 📋 Patches & Updates * **Microsoft Defender 'RoguePlanet' Zero-Day:** Microsoft is developing a patch for CVE-2026-50656, a local privilege escalation flaw in Microsoft Defender dubbed 'RoguePlanet.' This zero-day allows elevation to SYSTEM on fully patched Windows 10/11 systems. No workaround is currently available. * **Google Chrome Zero-Day Patched:** Google has released an emergency update (Chrome 145) to patch a critical zero-day vulnerability (CVE-2026-2441) in the V8 JavaScript engine that was being exploited in the wild. Immediate browser updates are required. * **Multiple Critical Redis Vulnerabilities:** Multiple critical RCE and DoS vulnerabilities in Redis (CVE-2026-25243, CVE-2026-23479, CVE-2026-23631) affecting versions 2.8.0 through 8.6.2 have been patched in Redis 8.6.3 and later. * **Apple Beats Studio Buds Firmware Update:** Apple has released firmware update 1B211 for Beats Studio Buds to patch CVE-2025-20701, a Bluetooth vulnerability that could allow a nearby attacker to eavesdrop via the microphone.

## Today's Priorities 1. **Emergency Patching:** Immediately patch **Splunk Enterprise**, **Apache ActiveMQ**, and **NGINX** servers due to confirmed active exploitation of critical RCE vulnerabilities. 2. **Fortinet Credential Reset:** If your organization uses Fortinet devices, enforce an immediate credential reset for all administrative and VPN accounts and review logs for anomalous access attempts linked to the FortiBleed leak. 3. **User Awareness:** Issue an immediate internal warning about the **WhatsApp VBS malware campaign**, instructing staff not to open unexpected document attachments sent via messaging apps. 4. **EDR Validation:** Review EDR/AV console logs for unexpected process terminations or driver load failures that could indicate testing or use of EDR-killer tools like **GentleKiller**.

## 🔗 References

• [Help Net Security: Unauthenticated RCE in Splunk Enterprise under active attack (CVE-2026-20253)](https://www.helpnetsecurity.com/?p=375286)
• [The Hacker News: CISA Warns Fortinet Customers as FortiBleed Hits 86,644 FortiGate Devices](https://thehackernews.com/2026/06/cisa-warns-fortinet-customers-as.html)
• [SecurityWeek: F5 Patches Critical, High-Severity NGINX Vulnerabilities](https://www.securityweek.com/?p=47246)
• [The Hacker News: WhatsApp VBScript Campaign Uses Fake Documents to Install ManageEngine RMM Tool](https://thehackernews.com/2026/06/whatsapp-vbscript-campaign-uses-fake.html)
• [The Hacker News: The Gentlemen RaaS Uses GentleKiller EDR Framework Targeting 400 Security Proces](https://thehackernews.com/2026/06/the-gentlemen-raas-uses-gentlekiller.html)