Ivanti has disclosed two critical zero-day vulnerabilities, CVE-2026-1281 and CVE-2026-1340, in its Endpoint Manager Mobile (EPMM) solution. Both vulnerabilities permit unauthenticated remote code execution and have a confirmed status of being actively exploited in limited attacks.
Vulnerability Details
Affected Product: Ivanti Endpoint Manager Mobile (EPMM) versions 12.6.1.0 and prior, and 12.5.1.0 and prior.
Identifier: CVE-2026-1281, CVE-2026-1340
CVSS Score: 9.8 (Critical) for both vulnerabilities.
Exploitation Status: Actively Exploited. CISA has added CVE-2026-1281 to its Known Exploited Vulnerabilities (KEV) catalog.
Risk & Impact
Triage: Immediate action is required. These vulnerabilities should be treated as an emergency and patched outside of normal cycles.
Attack Vector: An unauthenticated, remote attacker can send specially crafted requests to the EPMM appliance, targeting features like the In-House Application Distribution or Android File Transfer, to achieve remote code execution. No user interaction is required.
Ease of Exploit: The exploit does not require authentication, making it easier for attackers to compromise internet-facing systems. A public proof-of-concept is available.
Action Plan
Immediate Action: Apply the supplied RPM-based patches immediately. A permanent fix will be included in the future Version 12.8.0.0. Note that the temporary RPM patch does not survive a version upgrade and must be reinstalled.
Workaround: If compromise is suspected, Ivanti recommends building a new EPMM appliance or restoring from a known-good backup rather than attempting to clean the system.
Detection: Hunt for indicators of compromise by reviewing Apache HTTPD access logs for suspicious entries. Threat actors may deploy web shells or reverse shells to maintain persistence.
Relevant professional terms
Zero-Day Vulnerability
A security flaw in software, hardware, or firmware that is known to the vendor but does not have a patch in place to fix it. These vulnerabilities are particularly dangerous because they can be actively exploited by attackers before a defense is available.
Remote Code Execution (RCE)
An attack vector that allows a malicious actor to execute commands of their choice on a remote machine over a network, such as the internet. Successful RCE attacks can lead to a complete compromise of the system's confidentiality, integrity, and availability.
A server-side authorization vulnerability in Instagram's mobile web interface allowed unauthenticated attackers to access photos and captions from some private accounts. The issue was reported by a researcher, silently patched by Meta, and closed without a formal acknowledgment or CVE assignment.
Vulnerability Details
Affected Product: Instagram (Mobile Web Interface)
Exploitation Status: Proof-of-concept exists; no evidence of active exploitation.
Risk & Impact
Triage: Informational; the vendor has already applied a server-side patch.
Attack Vector: An attacker could send a specially crafted, unauthenticated GET request with specific mobile headers to a private user's profile. For affected accounts, the server would improperly return CDN links to private media within a JSON object in the HTML response.
Ease of Exploit: Simple. The vulnerability required manipulating HTTP headers, which is a straightforward technique for attackers.
Action Plan
Immediate Action: No user action is required. Meta silently patched the vulnerability on the server-side around October 2025.
Workaround: Not applicable as the vulnerability has been remediated by the vendor.
Relevant professional terms
Unauthenticated Attacker
An individual who can exploit a vulnerability without needing to log in or provide any valid credentials to the target system.
Server-Side Authorization
A security process where the server, rather than the user's device, verifies if a user has the correct permissions to access specific data or resources. A failure in this process led to the vulnerability.
An unidentified threat actor compromised an eScan Antivirus update server, distributing multi-stage malware to customers in a supply chain attack. The malicious update installed a persistent backdoor and was designed to block further remediation from the vendor.
Attack Overview
Attack Path: Attackers gained unauthorized access to a regional MicroWorld Technologies update server and pushed a trojanized file named "Reload.exe" to eScan customers.
Attacker: The threat actor has not been formally attributed.
Impact Assessment
Operational Impact: The malware established persistence via scheduled tasks and modified the HOSTS file to block future eScan updates, preventing automatic cleanup.
This incident underscores how compromising trusted software update infrastructure remains a highly effective vector for bypassing traditional security controls.
Relevant professional terms
Supply Chain Attack
A cyberattack targeting a trusted third-party vendor or software that has access to an organization's systems, using them as an entry point.
Indicator of Compromise (IOC)
A piece of forensic data, such as a file hash or IP address, that indicates a potential security breach has occurred on a system or network.
The ShinyHunters threat actor group is conducting a large-scale campaign using voice phishing (vishing) and custom phishing sites to steal Single Sign-On (SSO) and multi-factor authentication (MFA) credentials. This allows them to breach corporate SaaS platforms to steal data for extortion.
Key TTPs
Initial Access: Voice phishing (vishing) calls combined with real-time, custom phishing pages that impersonate legitimate SSO portals for Okta, Microsoft, and Google.
Execution: Use of malicious OAuth applications to gain API-level access, allowing for bulk data exfiltration from CRM and SaaS platforms.
Defense Evasion: Attackers guide victims to approve MFA prompts during live calls, effectively bypassing this security layer through social engineering.
Campaign Analysis
This campaign marks a significant shift towards abusing identity systems through sophisticated, human-interactive social engineering. By manipulating employees into authorizing access, the attackers bypass technical controls to target sensitive data stored in cloud applications, leading to extortion.
Targeting & Infrastructure
Target Profile: Over 100 high-value organizations across technology, finance, healthcare, retail, and manufacturing sectors.
Infrastructure: Custom phishing kits and domains that closely mimic legitimate company SSO portals and services.
Relevant Terms
Single Sign-On (SSO): An authentication scheme that allows a user to log in with a single ID to any of several related, yet independent, software systems.
Vishing: A type of cyber attack that uses voice calls (the "v" is for voice) to trick people into revealing sensitive personal or financial information.
An Iranian-aligned threat actor, codenamed RedKitten, is targeting human rights NGOs and activists with malware to disrupt efforts documenting recent human rights abuses. The campaign uses lures disguised as files about deceased protestors to deploy a backdoor implant called SloppyMIO.
Key TTPs
Initial Access: Malicious macro-laced Excel documents delivered in a password-protected 7-Zip archive.
Execution: A C#-based implant is dropped using a technique called AppDomainManager injection.
Command and Control: The malware uses Telegram for C2 and retrieves configurations and payloads from GitHub and Google Drive.
Campaign Analysis
This campaign is notable for its suspected use of Large Language Models (LLMs) to generate the malware's code, enabling rapid development. The operation coincides with a period of intense civil unrest in Iran, exploiting the emotional distress of individuals seeking information on missing persons.
Targeting & Infrastructure
Target Profile: Non-governmental organizations and individuals, likely those involved in documenting human rights abuses related to protests in Iran.
Infrastructure: Leverages public services like GitHub and Google Drive for payload and configuration hosting, with Telegram used for C2 communications.
Relevant Terms
Threat Actor: A person or group responsible for a malicious cyber incident that impacts an organization or individual.
C2 (Command and Control): The server infrastructure that attackers use to send commands to and receive data from malware-infected computers.
Autonomous AI Assistants Create Major Security Blindspot
Executive Summary
The open-source AI assistant OpenClaw (formerly ClawdBot/MoltBot) is seeing viral adoption in corporate environments, with a reported 14-fold growth in one week. Its design, which grants privileged, autonomous control over a user's machine, introduces a significant new attack surface that bypasses traditional security controls.
Key Findings
By design, OpenClaw can execute shell commands, manage files, and control browsers, often with administrator-level privileges.
Hundreds of instances have been found exposed online due to misconfigurations, allowing unauthenticated remote command execution.
The tool stores credentials and API keys in plaintext files, making them targets for common information-stealing malware.
Threat actors are using typosquatted domains and cloned code repositories to trick users into installing malicious versions.
The Bottom Line
The rapid, unmanaged adoption of powerful AI agents like OpenClaw creates a critical "shadow AI" problem for security leaders. These tools function as persistent, privileged insiders that can be hijacked through simple misconfigurations or social engineering. This trend challenges existing security models, requiring new governance policies and technical controls specifically for autonomous systems that can act on behalf of users.
Relevant Terms
Privileged Access: Special authority or permissions above that of a standard user, allowing access to sensitive systems, data, and administrative functions.
Supply-Chain Attack: A cyberattack that targets a trusted third-party vendor or software that supplies code or services, using that access to compromise the final target.
China has cultivated a state-directed "Walled Garden" cyber threat ecosystem, creating a parallel offensive stack that operates independently from the global cybersecurity community and fuels a commercial hacker-for-hire industry.
Key Findings
A key turning point was the 2021 Regulations on the Management of Security Vulnerabilities (RMSV), which nationalized vulnerability research and restricted information sharing.
Chinese threat actors leverage indigenous reconnaissance tools like FOFA, Zoomai, and 360 Quake, giving them an advantage over Western tools like Shodan.
The ecosystem blends state-sponsored espionage with a commercial "hacker-for-hire" industry, blurring the lines between cybercrime and state directives.
The Bottom Line
This self-reliant model creates a resilient and opaque threat environment, enabling state-aligned actors to develop and weaponize vulnerabilities before they are disclosed globally. This information asymmetry presents a significant challenge for Western security teams, as their traditional reconnaissance and intelligence-gathering methods are becoming less effective against this insulated offensive infrastructure.
Relevant Terms
Threat Actor: An individual or group responsible for a malicious cyber incident, ranging from state-sponsored teams to independent hackers.
Offensive Stack: The complete set of tools, infrastructure, and techniques that a threat actor uses to conduct cyberattacks.
