The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued an urgent warning regarding CVE-2026-20133, an information disclosure vulnerability in Cisco Catalyst SD-WAN Manager. Currently flagged as Actively Exploited in the wild, this flaw allows unauthenticated remote attackers to access sensitive operating system files via exposed APIs, prompting a strict four-day federal patching mandate.
Triage: High Urgency (CISA mandates federal patching within 4 days).
Attack Vector: Unauthenticated remote attackers exploit insufficient file system access restrictions by sending crafted requests to the SD-WAN Manager API, allowing them to read sensitive files from the underlying operating system.
Ease of Exploit: Low complexity; requires no user interaction or prior authentication.
Action Plan
Immediate Action: Upgrade immediately to a fixed software release provided by Cisco.
Workaround: No viable workarounds exist beyond applying the official patch.
Detection: Monitor for unusual API access patterns targeting file system resources, unexpected API requests retrieving OS files, and anomalous outbound data transfers.
Relevant professional terms
SD-WAN (Software-Defined Wide Area Network)
A virtualized service that connects and extends enterprise networks over large geographical distances, using software to manage traffic routing and security policies centrally.
Information Disclosure
A vulnerability that allows an attacker to access sensitive data-such as configuration files, credentials, or system information-that should not be publicly accessible.
Google has resolved a critical prompt injection vulnerability in its Antigravity agentic IDE that allowed attackers to bypass security controls and achieve remote code execution. The flaw, which circumvented the platform’s Secure Mode, has been patched as of February 28, 2026, though no official CVE-ID has been assigned yet.
Vulnerability Details
Affected Product: Google Antigravity IDE (versions prior to Feb 28, 2026)
Exploitation Status: Proof of Concept (PoC) Available
Risk & Impact
Triage: Critical urgency for development teams utilizing Google Antigravity.
Attack Vector: Attackers use prompt injection via malicious workspace files to manipulate the native find_by_name tool, injecting command-line flags into the underlying fd utility to execute arbitrary code before sandbox restrictions apply.
Ease of Exploit: Moderate; requires the AI agent to ingest maliciously crafted external content or workspace files.
Action Plan
Immediate Action: Upgrade Google Antigravity to the latest patched version (released after February 28, 2026).
Workaround: Restrict the AI agent’s access to untrusted repositories and avoid opening unverified external files within the IDE.
Detection: Monitor endpoint logs for anomalous child processes spawned by the fd utility or the Antigravity language server.
Relevant professional terms
Prompt Injection
A cyberattack technique where malicious instructions are embedded into user input to manipulate an AI model into executing unintended or unauthorized actions.
Sandbox Escape
A security vulnerability where a program or process breaks out of its isolated environment (sandbox) to interact with or compromise the underlying host operating system.
A high-severity code injection vulnerability, identified as CVE-2026-34197, in Apache ActiveMQ Classic is currently being actively exploited in the wild, leaving over 6,400 exposed servers vulnerable to remote attacks. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added the flaw to its Known Exploited Vulnerabilities catalog, mandating immediate remediation.
Vulnerability Details
Affected Product: Apache ActiveMQ Classic versions prior to 6.2.3 and 5.19.4
Identifier: CVE-2026-34197
CVSS Score: High (Severity)
Exploitation Status: Actively Exploited
Risk & Impact
Triage: Critical Priority (CISA BOD 22-01 deadline mandates patching by April 30)
Attack Vector: Authenticated attackers can invoke a management operation via the Jolokia API to fetch a remote configuration file, leading to arbitrary OS command execution.
Ease of Exploit: Trivial. While authentication is required, default credentials (“admin:admin”) are common. On versions 6.0.0 through 6.1.1, it can be chained with an older flaw (CVE-2024-32114) for unauthenticated remote code execution.
Action Plan
Immediate Action: Upgrade to Apache ActiveMQ Classic Version 6.2.3 or 5.19.4 immediately.
Workaround: Change default credentials, restrict network access to the Jolokia API, or discontinue use if patching is impossible.
Detection: Monitor ActiveMQ broker logs for suspicious connections utilizing the internal transport protocol VM and the brokerConfig=xbean:http:// query parameter.
Relevant professional terms
Jolokia API
An agent-based approach to Java Management Extensions (JMX) that requires no special client libraries, often used for remote management and monitoring of Java applications.
Remote Code Execution (RCE)
A severe cybersecurity vulnerability that allows an attacker to execute arbitrary commands or code on a target machine or in a target process from a remote location.
The Cybersecurity and Infrastructure Security Agency (CISA) has added eight vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, including actively exploited flaws in Cisco Catalyst SD-WAN Manager, Kentico Xperience, and Zimbra Collaboration Suite. Organizations are urged to immediately patch these vulnerabilities, tracked under CVE-2026-20122, CVE-2025-2749, and CVE-2025-48700 among others, as their status is confirmed as actively exploited in the wild.
Vulnerability Details
Affected Product: Cisco Catalyst SD-WAN Manager (versions prior to 20.12.6.1), Kentico Xperience (versions 13.0.178 and prior), and Zimbra Collaboration Suite (versions 8.8.15, 9.0, 10.0, 10.1)
Triage: High urgency; federal agencies must comply with CISA’s May 2026 patching deadlines.
Attack Vector: Network-based attacks leveraging path traversal, cross-site scripting (XSS), and improper API handling to execute code, steal credentials, or overwrite files.
Ease of Exploit: Low to Medium complexity; some flaws require low-privileged authenticated access, while others require no user interaction.
Action Plan
Immediate Action: Apply vendor patches immediately, such as upgrading Cisco SD-WAN to Version 20.12.6.1 or later, and applying Kentico and Zimbra hotfixes.
Workaround: Restrict access to management interfaces, disable unnecessary HTTP/FTP services, and enforce strict network segmentation.
Detection: Monitor for unauthorized API calls, unexpected file uploads in web directories, and anomalous JavaScript execution in user sessions.
Relevant professional terms
Known Exploited Vulnerabilities (KEV)
A CISA-maintained catalog of security flaws confirmed to be under active exploitation, used to prioritize urgent patching across federal agencies and industry.
Path Traversal
A vulnerability that allows attackers to access files and directories outside the intended scope by manipulating file paths, often leading to unauthorized read or write access on the server.
SGLang Vulnerability Enables Remote Server Takeover
Critical
Executive Summary
A critical Server-Side Template Injection (SSTI) vulnerability in the SGLang inference framework, tracked as CVE-2026-5760, allows attackers to achieve Remote Code Execution (RCE) via malicious GGUF model files. The flaw is currently exploitable via a public Proof-of-Concept (PoC), posing a severe supply chain risk to AI infrastructure.
Vulnerability Details
Affected Product: SGLang (specifically affecting the /v1/rerank endpoint; PoC targets version 0.5.9)
Identifier: CVE-2026-5760
CVSS Score: 9.8 (Critical)
Exploitation Status: Proof-of-Concept (PoC) Available
Risk & Impact
Triage: Critical urgency for organizations deploying SGLang inference servers with untrusted models.
Attack Vector: An attacker creates a malicious GGUF model with a weaponized tokenizer.chat_template. When loaded and processed by the /v1/rerank endpoint, the unsandboxed Jinja2 template engine executes embedded Python commands.
Ease of Exploit: Low complexity; requires tricking a victim or automated pipeline into loading a poisoned model from a public repository like Hugging Face.
Action Plan
Immediate Action: Apply the latest vendor patches to ensure the framework uses ImmutableSandboxedEnvironment instead of the insecure jinja2.Environment() for rendering chat templates.
Workaround: Strictly restrict the deployment of AI models to trusted, internally verified sources and avoid loading unvetted GGUF files from public repositories.
Detection: Inspect GGUF model metadata for anomalous tokenizer.chat_template fields containing Python code or Jinja2 expressions, and monitor inference server logs for unexpected subprocess executions.
Relevant professional terms
Server-Side Template Injection (SSTI)
A vulnerability where an attacker injects malicious code into a server-side template engine, causing it to execute arbitrary commands when rendering the template.
GGUF
A binary file format used to store large language model weights and metadata, commonly distributed through public model repositories like Hugging Face.
North Korean state-sponsored hackers, likely the Lazarus Group, exploited KelpDAO's cross-chain bridge infrastructure to steal approximately $290 million in cryptocurrency. The attack forced the protocol to halt operations and triggered widespread freezes across connected decentralized finance platforms.
Attack Overview
Attack Path: Attackers compromised RPC nodes within the Decentralized Verifier Network and launched DDoS attacks on healthy nodes, forcing the system to accept falsified cross-chain messages.
Attacker:Lazarus Group (TraderTraitor)
Impact Assessment
Data Stolen:116,500 rsETH tokens (valued at ~$290 million).
Operational Impact: KelpDAO paused all rsETH contracts across Ethereum networks, while partner protocols like Aave froze related deposits and borrowing.
Strategic Takeaway
Relying on a single-point verification setup in cross-chain infrastructure creates a critical vulnerability susceptible to node poisoning and failover exploitation.
Relevant professional terms
DeFi
Decentralized Finance; financial technology utilizing blockchain networks to offer services without traditional centralized intermediaries.
RPC Node
A server that enables external applications to communicate with and query data from a blockchain network.
The DOJ secured guilty pleas from three incident responders who weaponized their insider access to assist the ALPHV/BlackCat ransomware gang. The corrupt negotiators fed confidential data to attackers, maximizing extortion payouts against U.S. organizations.
The Scheme
TTP 1: Insider Intelligence: Abused negotiator roles to secretly provide attackers with victims' cyber insurance limits and internal strategies.
TTP 2: Ransomware Deployment: Acted as active affiliates, deploying ALPHV/BlackCat payloads against U.S. targets to steal data and encrypt systems.
TTP 3: Money Laundering: Split illicit proceeds and laundered millions through cryptocurrency and luxury asset purchases.
The Players
Threat Actor:ALPHV/BlackCat Cartel
Facilitators Arrested:Angelo Martino, Ryan Goldberg, Kevin Martin
Strategic Takeaway
Insider threats from trusted incident response partners represent a critical blind spot in ransomware negotiations. Organizations must enforce strict vetting, compartmentalization, and auditing of third-party responders handling sensitive breach data.
Relevant professional terms
Ransomware-as-a-Service (RaaS)
A cybercrime business model where ransomware operators lease their malware and infrastructure to affiliates in exchange for a share of the ransom payments.
Insider Threat
A security risk originating from within the targeted organization or its trusted partners, where individuals with legitimate access misuse their privileges for malicious purposes.
