- Morgunfyrirlestur fyrir öryggisstjóra**
- Dagsetning:** 2026-06-29 | **Tími:** 08:00 UTC | **Fjölmörg:** Fyrirtækjafyrirleitara og CISO ## Þjónustu samantekt Þjónustuþátturinn er skilgreindur með **breiddar nýtingu á almennt vigtum veikleikum í grunnkerfum fyrirtækja**, með veikleikum í Cisco SD-WAN og Linux kérnunni sem eru í virkri nýtingu. Stjórnarsamfélög frá Rússlandi (Turla) og Kína (CL-STA-1062) framkvæma spjálfræðiáætlunir á stjórnarráð og vigtum kerfisþáttum. Þar að auki hefur sýndist sýndaröðaröð átök sem hefur áhrif á TanStack npm pakka með gildri upprunni, sem kemur í hættu á útviklunarkerfum. Það er mikilvægt að uppfæra Cisco og Linux kerfi, samt að skoða þriðja aðila SaaS tengingar (sérstaklega Salesforce/Klue). ## ⚠️ Þörf á áætluðu aðgerð
- *🏢 Cisco SD-WAN Manager auðkenningarframhjáhlaup er í virkri nýtingu** Einn vigtur veikleiki (CVE-2026-20127) í Cisco Catalyst SD-WAN Manager leyfir óauðkenndum hætta að ná kerfisstjóra aðgangi. Þessi veikleiki (CVSS 10.0) er í virkri nýtingu í heimi.
- *CVE:** CVE-2026-20127 (CVSS: 10.0)
- *Staða:** Í virkri nýtingu
- *Veikar útgáfur:** Fjölmörg útgáfur áður en 20.9.8.2
- *Lagfært í:** Útgáfa 20.9.8.2 og seinna
- *Tímabundin lausn:** Ekkert nefnt í heimildum
- *Heimild:** [The Hacker News](https://thehackernews.com/2026/06/cisco-catalyst-sd-wan-zero-day-cve-2026.html)
- *🏢 Linux kérna 'Dirty Frag' réttindaaukning** Einn vigtur Linux kérna veikleiki (CVE-2026-46300, 'Dirty Frag') leyfir réttindaaukning í rót á aðskildum útgáfum (kérna útgáfur 4.11 til 6.7). Það er tilgengileg aðgengi til að nýta veikleikann.
- *CVE:** CVE-2026-46300 (CVSS: Ekki tilgreint)
- *Staða:** PoC tiltækt
- *Veikar útgáfur:** Linux kérna útgáfur 4.11 til 6.7
- *Lagfært í:** Ekki tilgreint í heimildum — skoðið tilkynningu framleiðanda
- *Tímabundin lausn:** Ekkert nefnt í heimildum
- *Heimild:** [The Hacker News](https://thehackernews.com/2026/06/new-dirtyclone-linux-kernel-flaw-lets.html)
- *🏢 Cisco Unified Communications Manager SSRF nýtt** Einn vigtur veikleiki (CVE-2026-20230) í Cisco Unified CM er nýtt til að skrifa skrár og auka réttindi til róts. Það er tilkynnt um virkri nýtingu.
- *CVE:** CVE-2026-20230 (CVSS: 8.6)
- *Staða:** Í virkri nýtingu
- *Veikar útgáfur:** Útgáfa 14 áður en 14SU6; Útgáfa 15 áður en 15SU5
- *Lagfært í:** Útgáfur 14SU6 og 15SU5
- *Tímabundin lausn:** Ekkert nefnt í heimildum
- *Heimild:** [BleepingComputer](https://www.bleepingcomputer.com/news/security/cisa-sets-urgent-deadline-to-fix-cisco-flaw-exploited-in-attacks/)
- *Oracle PeopleSoft núll-daga veikleiki nýtt fyrir gagnaleiki** Þjónustuþátturinn ShinyHunters nýtr vigtanúll-daga veikleika (CVE-2026-35273) í Oracle PeopleSoft til óauðkenndar fjarkeyrslu kóða og gagnaleika.
- *CVE:** CVE-2026-35273 (CVSS: 9.8)
- *Staða:** Í virkri nýtingu
- *Veikar útgáfur:** PeopleTools 8.61 og 8.62
- *Lagfært í:** Mættir útgefnar; fullar uppfærslur áætlaðar
- *Tímabundin lausn:** Notaðu Oracle útgefnar mættir
- *Heimild:** [Rapid7 Research](https://www.rapid7.com/blog/post/etr-active-exploitation-of-oracle-peoplesoft-zero-day-cve-2026-35273) ## 🔍 Þjónustu aðgerð
- *Stjórnarsamfélög spjálfræðiáætlunir hækkar.** Rússlandstengdur **Turla APT** er notandi **STOCKSTAY** .NET baka í rússneska og evrópska stjórnarráð og háskóla með WebSocket C2. Þar að auki er Kínustengdur þjónustuþáttur **CL-STA-1062** að hætta á suðausturáískum stjórnarráð og vigtum kerfum með **TinyRCT** baka, sem inniheldur sjálfþjáningarmöguleika.
- *Sýndaröðaröð átök á TanStack npm pakka.** Hætta nýtt GitHub Actions til að rannsaka OIDC lykla og birta óþýða útgáfur af **42 TanStack npm pakka** með gildri SLSA upprunni. Malvæðið rannsakar auðkenni og býr til aðgerð, sem áhrif á nágrannar verkefni eins og Mistral AI og UiPath.
- *Klue OAuth gagnaleiki leiðir til Salesforce gagnaleika.** Þjónustuþáttar, eins og Icarus flokkurinn, nýttu gagnaleiki á **Klue** til að rannsaka OAuth lykla og síðan ná aðgangi og útvega Salesforce CRM gagni frá fjölmörgum öryggisfyrirtækjum (Huntress, BeyondTrust, LastPass). Skoðið allar þriðja aðila OAuth tengingar.
- *Gíslatökuþjónustu notar nýja Mistic baka.** Gíslatöku fyrirleitara **KongTuke** notar **Mistic** baka, sem er settur inn með samfélagsmál og DLL side-loading, til að ná aðgangi í fyrirtækjakerfum í forsætis-, útdráttar- og IT sektur. ## 📋 Uppfærslur og uppfærslur
- *🏢 Fjölmörg vigtar Redis veikleikar uppfærð.** Uppfærslur aðgreina fjölmörg vigtar veikleikar (þar með CVE-2026-23479 og CVE-2026-25243) sem leyfir fjarkeyrslu kóða í Redis útgáfum 2.8.0 til 8.6.2. Uppfæra í **Redis 8.6.3** eða notaðu viðkomandi framleiðanda uppfærslur (t.d. Red Hat).
- *Google Chrome núll-daga uppfærð.** Það er nýtt núll-daga veikleiki **CVE-2026-2441** í **Chrome útgáfu 145**. Tryggðu að sjálfgefinn uppfærsla á vafra sé virk og útfært.
- *Check Point VPN núll-daga nýtt af gíslatökuþjónustu.** Qilin gíslatökuþjónustu nýtt **CVE-2026-50751** (CVSS 9.3), auðkenningarframhjáhlaup í Check Point Remote Access VPN með gamla IKEv1. Uppfærslur eru tiltækar; gamla stillingar eru á háum hættum.
- *Fjölmörg Samba veikleikar aðgreind.** Vigtar öryggisuppfærslur eru útgefnar fyrir Samba, sem aðgreina fjarkeyrslu kóða og þjónustuneitun. Þau áhrif á Samba 4.23.x, 4.24.x og eldri útgáfur. ## Daglegar áætlanir 1. **Uppfæra á meðferð:** Fyrirspá uppfærslur fyrir **Cisco SD-WAN Manager** (CVE-2026-20127) og **Cisco Unified Communications Manager** (CVE-2026-20230), þar sem báðar eru í virkri nýtingu. 2. **Skoða Linux kérna úthlutun:** Skoða allar Linux kerfi fyrir kérna útgáfur 4.11 til 6.7 til að fá fyrirbæringar um uppfærslur tengdar 'Dirty Frag' (CVE-2026-46300) réttindaaukning. 3. **Skoða þriðja aðila SaaS tengingar:** Sérstaklega skoða og staðfesta notkun OAuth lykla fyrir Salesforce og önnur vigtar SaaS kerfi, eftir Klue gagnaleiki. 4. **Skanna útviklunarkerfi:** Skoða áður en áhrif á **TanStack** npm pakka (t.d. `@tanstack/*`) og skoða öryggisáætlanir í CI/CD tengingum, sérstaklega stillingar á GitHub Actions og OIDC lykla. ## 🔗 Heimildir - [The Hacker News: Cisco Catalyst SD-WAN Zero-Day CVE-2026-20245 Exploited to Gain Root Access](https://thehackernews.com/2026/06/cisco-catalyst-sd-wan-zero-day-cve-2026.html) - [The Hacker News: New DirtyClone Linux Kernel Flaw Lets Local Users Gain Root via Cloned Packets](https://thehackernews.com/2026/06/new-dirtyclone-linux-kernel-flaw-lets.html) - [CyberScoop: ‘Mini Shai-Hulud’ malware compromises hundreds of open-source packages in sprawl](https://cyberscoop.com/?p=88980) - [The Hacker News: Salesforce Disables Klue App Integration After OAuth Token Abuse Exposes Custome](https://thehackernews.com/2026/06/salesforce-disables-klue-app.html) - [Rapid7 Research: Active Exploitation of Oracle PeopleSoft Zero-Day (CVE-2026-35273)](https://www.rapid7.com/blog/post/etr-active-exploitation-of-oracle-peoplesoft-zero-day-cve-2026-35273)
**Morning Executive Threat Briefing** **Date:** 2026-06-29 | **Time:** 08:00 UTC | **Audience:** Enterprise Security Administrators & CISOs
## Executive Summary The threat landscape is defined by **widespread exploitation of critical vulnerabilities in core enterprise infrastructure**, with Cisco SD-WAN and Linux kernel flaws under active attack. State-sponsored actors from Russia (Turla) and China (CL-STA-1062) are conducting espionage campaigns against government and critical infrastructure targets. Additionally, a sophisticated supply chain attack has compromised TanStack npm packages with valid provenance, posing a severe risk to development environments. Immediate patching of Cisco and Linux systems, along with a review of third-party SaaS integrations (particularly Salesforce/Klue), is paramount.
## ⚠️ Immediate Action Required * **🏢 Cisco SD-WAN Manager Authentication Bypass Actively Exploited** A critical flaw (CVE-2026-20127) in Cisco Catalyst SD-WAN Manager allows unauthenticated attackers to gain administrative access. This vulnerability (CVSS 10.0) is being actively exploited in the wild. * **CVE:** CVE-2026-20127 (CVSS: 10.0) * **Status:** Active exploitation detected * **Vulnerable:** Multiple releases prior to 20.9.8.2 * **Fixed:** Version 20.9.8.2 and later * **Workaround:** None mentioned in source * **Reference:** [The Hacker News](https://thehackernews.com/2026/06/cisco-catalyst-sd-wan-zero-day-cve-2026.html)
* **🏢 Linux Kernel 'Dirty Frag' Privilege Escalation** A critical Linux kernel vulnerability (CVE-2026-46300, 'Dirty Frag') enables local privilege escalation to root across major distributions (kernel versions 4.11 to 6.7). Public exploit code is available. * **CVE:** CVE-2026-46300 (CVSS: Not specified) * **Status:** Proof of Concept available * **Vulnerable:** Linux kernel versions 4.11 to 6.7 * **Fixed:** Not specified in source — check vendor advisory * **Workaround:** None mentioned in source * **Reference:** [The Hacker News](https://thehackernews.com/2026/06/new-dirtyclone-linux-kernel-flaw-lets.html)
* **🏢 Cisco Unified Communications Manager SSRF Exploited** A critical Server-Side Request Forgery (SSRF) vulnerability (CVE-2026-20230) in Cisco Unified CM is being exploited to write files and escalate privileges to root. Active exploitation has been reported. * **CVE:** CVE-2026-20230 (CVSS: 8.6) * **Status:** Active exploitation detected * **Vulnerable:** Version 14 prior to 14SU6; Version 15 prior to 15SU5 * **Fixed:** Versions 14SU6 and 15SU5 * **Workaround:** None mentioned in source * **Reference:** [BleepingComputer](https://www.bleepingcomputer.com/news/security/cisa-sets-urgent-deadline-to-fix-cisco-flaw-exploited-in-attacks/)
* **Oracle PeopleSoft Zero-Day Exploited for Data Theft** The ShinyHunters group is actively exploiting a critical zero-day (CVE-2026-35273) in Oracle PeopleSoft for unauthenticated remote code execution and data theft. * **CVE:** CVE-2026-35273 (CVSS: 9.8) * **Status:** Active exploitation detected * **Vulnerable:** PeopleTools 8.61 and 8.62 * **Fixed:** Mitigations released; full patches pending * **Workaround:** Apply Oracle-released mitigations * **Reference:** [Rapid7 Research](https://www.rapid7.com/blog/post/etr-active-exploitation-of-oracle-peoplesoft-zero-day-cve-2026-35273)
## 🔍 Threat Activity * **State-Sponsored Espionage Campaigns Intensify.** The Russia-linked **Turla APT** is deploying the **STOCKSTAY** .NET backdoor against Ukrainian and European government/military targets using WebSocket C2. Separately, China-linked actor **CL-STA-1062** is targeting Southeast Asian governments and critical infrastructure with the **TinyRCT** backdoor, which includes a self-destruct mechanism. * **Supply Chain Attack Compromises TanStack npm Packages.** Attackers exploited GitHub Actions to steal OIDC tokens and publish malicious versions of **42 TanStack npm packages** with valid SLSA provenance. The malware steals credentials and establishes persistence, affecting downstream projects like Mistral AI and UiPath. * **Klue OAuth Breach Leads to Salesforce Data Theft.** Threat actors, including the Icarus group, exploited a breach at **Klue** to steal OAuth tokens and subsequently access and exfiltrate Salesforce CRM data from multiple cybersecurity firms (Huntress, BeyondTrust, LastPass). Review all third-party OAuth integrations. * **Ransomware Broker Uses New Mistic Backdoor.** The ransomware initial access broker **KongTuke** is using the **Mistic** backdoor, deployed via social engineering and DLL side-loading, to gain a foothold in corporate networks across insurance, education, and IT sectors.
## 📋 Patches & Updates * **🏢 Multiple Critical Redis Vulnerabilities Patched.** Updates address several critical flaws (including CVE-2026-23479 & CVE-2026-25243) allowing remote code execution in Redis versions 2.8.0 through 8.6.2. Patch to **Redis 8.6.3** or apply relevant vendor patches (e.g., Red Hat). * **Google Chrome Zero-Day Patched.** Actively exploited zero-day **CVE-2026-2441** has been patched in **Chrome version 145**. Ensure browser auto-updates are enabled and deployed. * **Check Point VPN Zero-Day Exploited by Ransomware.** The Qilin ransomware group is exploiting **CVE-2026-50751** (CVSS 9.3), an authentication bypass in Check Point Remote Access VPNs using deprecated IKEv1. Patches are available; legacy configurations are at high risk. * **Multiple Samba Vulnerabilities Addressed.** Critical security updates have been released for Samba, addressing remote code execution and denial-of-service flaws. Affected versions include Samba 4.23.x, 4.24.x, and prior releases.
## Today's Priorities 1. **Patch Immediately:** Prioritize patching for **Cisco SD-WAN Manager** (CVE-2026-20127) and **Cisco Unified Communications Manager** (CVE-2026-20230), as both are under active attack. 2. **Assess Linux Kernel Exposure:** Review all Linux systems for kernel versions 4.11 to 6.7 in preparation for vendor patches related to the 'Dirty Frag' (CVE-2026-46300) privilege escalation vulnerability. 3. **Audit Third-Party SaaS Integrations:** Specifically review and validate OAuth token usage for Salesforce and other critical SaaS platforms, following the Klue breach. 4. **Scan Development Environments:** Check for compromised **TanStack** npm packages (e.g., `@tanstack/*`) and review CI/CD pipeline security, particularly GitHub Actions permissions and OIDC token trust.
## 🔗 References
- [The Hacker News: Cisco Catalyst SD-WAN Zero-Day CVE-2026-20245 Exploited to Gain Root Access](https://thehackernews.com/2026/06/cisco-catalyst-sd-wan-zero-day-cve-2026.html)
- [The Hacker News: New DirtyClone Linux Kernel Flaw Lets Local Users Gain Root via Cloned Packets](https://thehackernews.com/2026/06/new-dirtyclone-linux-kernel-flaw-lets.html)
- [CyberScoop: ‘Mini Shai-Hulud’ malware compromises hundreds of open-source packages in sprawl](https://cyberscoop.com/?p=88980)
- [The Hacker News: Salesforce Disables Klue App Integration After OAuth Token Abuse Exposes Custome](https://thehackernews.com/2026/06/salesforce-disables-klue-app.html)
- [Rapid7 Research: Active Exploitation of Oracle PeopleSoft Zero-Day (CVE-2026-35273)](https://www.rapid7.com/blog/post/etr-active-exploitation-of-oracle-peoplesoft-zero-day-cve-2026-35273)