# Morning Executive Threat Digest **Date:** 2026-07-13 | **Time:** 08:00 UTC | **Classification:** Internal Use

## Executive Summary The threat landscape remains intensely focused on the active exploitation of critical vulnerabilities in widely deployed enterprise software. Urgent patching is required for **Juniper**, **Splunk**, **BeyondTrust**, **Ivanti Sentry**, and **Adobe ColdFusion**, all of which have flaws being actively leveraged by attackers. The **FortiBleed** credential leak campaign continues to pose a severe risk to internet-facing Fortinet infrastructure, while new destructive malware (**GigaWiper**) and AI-assisted attack tools are emerging.

## ⚠️ Immediate Action Required * **Juniper Junos OS Evolved Critical RCE** A critical remote code execution vulnerability (CVE-2026-21902) in Juniper Junos OS Evolved on PTX Series devices allows unauthenticated attackers to execute root-level code. Multiple other vulnerabilities were patched in the same advisory. * **CVE:** CVE-2026-21902 (CVSS: 9.8) * **Status:** Disclosed * **Vulnerable:** All versions prior to 25.4R1-S1-EVO and 25.4R2-EVO * **Fixed:** 25.4R1-S1-EVO, 25.4R2-EVO * **Workaround:** None mentioned in source * **Reference:** [WatchTowr Labs: Junos OS Evolved CVE-2026-21902 RCE](https://labs.watchtowr.com/sometimes-you-can-just-feel-the-security-in-the-design-junos-os-evolved-cve-2026-21902-rce/)

* **BeyondTrust Remote Support & PRA Critical RCE** A critical pre-authentication remote code execution vulnerability (CVE-2026-1731) in BeyondTrust Remote Support and Privileged Remote Access products is under active exploitation for ransomware deployment, data exfiltration, and backdoor installation. * **CVE:** CVE-2026-1731 (CVSS: Not specified) * **Status:** Active exploitation detected * **Vulnerable:** Not specified in source — check vendor advisory * **Fixed:** Not specified in source — check vendor advisory * **Workaround:** None mentioned in source * **Reference:** [BleepingComputer: BeyondTrust RCE flaw now exploited in ransomware attacks](https://www.bleepingcomputer.com/news/security/cisa-beyondtrust-rce-flaw-now-exploited-in-ransomware-attacks/)

* **Ivanti Sentry Critical RCE and Auth Bypass** Critical vulnerabilities in Ivanti Sentry allow unauthenticated remote code execution (CVE-2026-10520, CVSS 10.0) and admin account creation (CVE-2026-10523, CVSS 9.9). Exploitation attempts have been observed in honeypots. * **CVE:** CVE-2026-10520 (CVSS: 10.0), CVE-2026-10523 (CVSS: 9.9) * **Status:** Active exploitation detected * **Vulnerable:** Versions pre-10.5.2, 10.6.0-10.6.1, 10.7.0 * **Fixed:** Versions 10.5.2, 10.6.2, 10.7.1 * **Workaround:** None mentioned in source * **Reference:** [FortiGuard Outbreak Alerts: Ivanti Sentry OS Command Injection Vulnerability](https://fortiguard.fortinet.com/outbreak-alert/ivanti-sentry-os-command-injection)

* **Splunk Enterprise Critical RCE Actively Exploited** Multiple critical vulnerabilities in Splunk Enterprise and Cloud Platform allow unauthenticated remote code execution and data manipulation. CVE-2026-20253 is confirmed to be actively exploited in the wild. * **CVE:** CVE-2026-20253 (CVSS: Not specified) * **Status:** Active exploitation detected * **Vulnerable:** Splunk Enterprise 10.0.0 through 10.2.3 and others * **Fixed:** Not specified in source — check vendor advisory * **Workaround:** None mentioned in source * **Reference:** [Help Net Security: Unauthenticated RCE in Splunk Enterprise under active attack](https://www.helpnetsecurity.com/?p=375286)

* **Adobe ColdFusion Critical RCE Exploited** Multiple high-severity vulnerabilities in Adobe ColdFusion, including CVE-2026-48282, are being actively exploited, allowing remote code execution, privilege escalation, and data disclosure. * **CVE:** CVE-2026-48282 (CVSS: Not specified) * **Status:** Active exploitation detected * **Vulnerable:** ColdFusion 2023 and 2025 prior to specific updates * **Fixed:** Not specified in source — check vendor advisory * **Workaround:** None mentioned in source * **Reference:** [SecurityWeek: Critical Adobe ColdFusion Vulnerability Exploited in Attacks](https://www.securityweek.com/?p=47653)

## 🔍 Threat Activity * **FortiBleed Campaign Exposes 70K+ Fortinet Devices:** The large-scale credential leak campaign, dubbed FortiBleed, has exposed administrative and SSL VPN credentials for over 70,000 internet-facing Fortinet devices. Threat actors are using brute-force and credential-stuffing techniques to harvest credentials and pivot into internal networks. * **GigaWiper Destructive Backdoor Deployed:** A sophisticated Go-based backdoor, GigaWiper, is being deployed in Windows environments. It combines disk-wiping, fake ransomware, and spyware capabilities to sabotage systems post-compromise, using C2 commands to execute destructive actions. * **AI-Generated Malware Targets Active Directory:** Threat actors are using AI-generated PowerShell scripts for Active Directory enumeration following RDP compromises. The malware automates domain controller discovery and is executed from common staging directories. * **Ransomware Negotiators Charged:** US authorities have charged and sentenced multiple ransomware negotiators linked to BlackCat attacks, highlighting insider threats where confidential negotiation data was leaked to maximize ransom demands.

## 📋 Patches & Updates * **Microsoft Defender Zero-Day Patched:** Microsoft has patched the 'RoguePlanet' zero-day vulnerability (CVE-2026-50656, CVSS 7.8) in Microsoft Defender, which allowed local privilege escalation to SYSTEM on Windows 10 and 11 via a race condition. * **Ubiquiti UniFi Critical Flaws Patched:** Multiple critical vulnerabilities in Ubiquiti UniFi products (Network Application, OS Server, Express) allowing remote code execution and privilege escalation have been patched. Affected systems should be updated immediately. * **Progress ShareFile Storage Zone Controller:** Progress Software has instructed customers to shut down on-premises Storage Zone Controllers due to a credible external security threat. The specific vulnerability remains undisclosed. 🏢 * **Zimbra XSS Vulnerabilities:** Multiple critical XSS vulnerabilities in Zimbra Collaboration Suite (CVE-2025-66376, CVE-2025-48700) are being actively exploited via malicious emails. Patches are available in newer versions.

## Today's Priorities 1. **Patch Actively Exploited Software:** Immediately apply patches for **BeyondTrust**, **Ivanti Sentry**, **Splunk**, and **Adobe ColdFusion**. Verify patch levels against the provided fixed versions. 2. **Assess Fortinet Exposure:** Review all internet-facing Fortinet devices for signs of compromise and ensure credentials are rotated, especially for administrative and SSL VPN access. 3. **Review Juniper PTX Devices:** Identify any Juniper PTX Series devices running Junos OS Evolved and prioritize updating to the patched versions (25.4R1-S1-EVO or 25.4R2-EVO). 4. **Isolate ShareFile Storage Zone Controllers:** Follow Progress Software's urgent instruction to shut down on-premises Storage Zone Controllers until further guidance is provided.

## 🔗 References

• [WatchTowr Labs: Junos OS Evolved CVE-2026-21902 RCE](https://labs.watchtowr.com/sometimes-you-can-just-feel-the-security-in-the-design-junos-os-evolved-cve-2026-21902-rce/)
• [BleepingComputer: BeyondTrust RCE flaw now exploited in ransomware attacks](https://www.bleepingcomputer.com/news/security/cisa-beyondtrust-rce-flaw-now-exploited-in-ransomware-attacks/)
• [FortiGuard Outbreak Alerts: Ivanti Sentry OS Command Injection Vulnerability](https://fortiguard.fortinet.com/outbreak-alert/ivanti-sentry-os-command-injection)
• [Help Net Security: Unauthenticated RCE in Splunk Enterprise under active attack](https://www.helpnetsecurity.com/?p=375286)
• [Qualys Research: FortiBleed: Credential Reuse, Legacy Hashes, and the Risk of Internet-Exposed Fo](https://blog.qualys.com/?p=40864)