Daily Cybersecurity News - March 20, 2026
CISA Mandates Urgent Cisco Patch
CriticalExecutive Summary
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has ordered federal agencies to immediately patch CVE-2026-20131, a critical remote code execution vulnerability in Cisco's Secure Firewall Management Center (FMC).
This flaw is being Actively Exploited in the wild by ransomware groups as a zero-day since late January 2026.
Vulnerability Details
- Affected Product: Cisco Secure Firewall Management Center (FMC) Software, on-premises deployments only. See vendor advisory for specific versions.
- Identifier: CVE-2026-20131
- CVSS Score: 10.0 (Critical)
- Exploitation Status: Actively Exploited
Risk & Impact
- Triage: Immediate patching required; CISA deadline for federal agencies is March 22, 2026.
- Attack Vector: An unauthenticated, remote attacker can send a crafted serialized Java object to the web-based management interface to execute arbitrary code with root privileges.
- Ease of Exploit: Low complexity. The attack does not require authentication or user interaction.
Action Plan
- Immediate Action: Upgrade to a fixed software release. Organizations should consult the Cisco Security Advisory for detailed patch information.
- Workaround: No workarounds are available. Cisco advises that ensuring the FMC management interface is not exposed to the public internet reduces the attack surface.
- Detection: Monitor for unusual Java serialization traffic to the FMC management interface, unexpected processes spawned by the web service with root privileges, and anomalous outbound network connections from the FMC device.
Relevant professional terms
- CISA (Cybersecurity and Infrastructure Security Agency)
- A component of the U.S. Department of Homeland Security responsible for cybersecurity and infrastructure protection across all levels of government. CISA issues "binding operational directives" that require federal agencies to take action against specific cybersecurity risks.
- Vulnerability
- A weakness or flaw in an information system, its security procedures, internal controls, or implementation that a threat source could exploit. These weaknesses can stem from coding errors, configuration mistakes, or outdated software.
Source: BleepingComputer
PolyShell Flaw Enables Remote Takeover
Executive Summary
A critical vulnerability named PolyShell affects all stable Magento Open Source and Adobe Commerce version 2 installations, permitting unauthenticated remote code execution (RCE) and account takeovers.
While no official patch for production versions has been released, a fix is present in pre-release version 2.4.9-alpha3.
Vulnerability Details
- Affected Product: All Magento Open Source and Adobe Commerce versions up to 2.4.9-alpha2 are vulnerable to unrestricted file upload. Specific server configurations may lead to RCE on versions prior to 2.3.5.
- Exploitation Status: There are no signs of active exploitation, but the exploit method is reportedly in circulation, and automated attacks are expected to begin soon.
Risk & Impact
- Triage: Urgent; this unauthenticated vulnerability allows for complete server compromise.
- Attack Vector: An attacker can upload a polyglot file (a script disguised as an image) via the Magento REST API's file upload feature for cart item custom options. Depending on the server configuration, this can lead to remote code execution or stored Cross-Site Scripting (XSS).
- Ease of Exploit: The exploit is straightforward, targeting the REST API endpoint for file uploads, which writes files to a publicly accessible directory.
Action Plan
- Immediate Action: Since no official patch for production versions is available, the primary action is to implement mitigating workarounds. A fix is available in the pre-release version 2.4.9-alpha3+.
- Workaround: Restrict all access to the `pub[/]media[/]custom_options[/]` directory. Verify web server configurations (Nginx/Apache) to ensure that `.php` execution is blocked in media directories.
- Detection: Scan servers for any suspicious files, shells, or backdoors located in the `pub[/]media[/]custom_options[/]quote[/]` directory.
Relevant professional terms
- Remote Code Execution (RCE)
- A class of software vulnerability that allows a malicious actor to execute arbitrary commands or code on a remote target machine or in a remote process.
- Polyglot File
- A file that is a valid form of multiple different file types. In this context, it refers to a file that can be interpreted as both a harmless image and an executable script.
Source: BleepingComputer
Oracle Patches Critical RCE Flaw
CriticalExecutive Summary
Oracle has released an out-of-band security alert for CVE-2026-21992, a critical remote code execution vulnerability being actively exploited in the wild.
The flaw affects Oracle Identity Manager and Oracle Web Services Manager, and successful attacks can result in a complete takeover of the compromised product.
Vulnerability Details
- Affected Product: Oracle Identity Manager and Oracle Web Services Manager, versions 12.2.1.4.0 and 14.1.2.1.0.
- Identifier: CVE-2026-21992
- CVSS Score: 9.8 (Critical).
- Exploitation Status: Actively Exploited.
Risk & Impact
- Triage: Immediate patching is strongly recommended due to active exploitation and critical severity.
- Attack Vector: The vulnerability is easily exploitable by an unauthenticated attacker with network access via HTTP. Successful attacks can lead to a complete takeover of the affected component.
- Ease of Exploit: Low. The vulnerability is remotely exploitable without authentication.
Action Plan
- Immediate Action: Apply the out-of-band security patches provided by Oracle immediately.
- Workaround: Isolate affected services from the public internet if patching cannot be immediately applied.
- Detection: Monitor for unusual network traffic, such as unauthenticated HTTP requests targeting the REST WebServices or Web Services Security components.
Relevant professional terms
- Out-of-band (OOB) Alert
- A security patch or notification released outside of the regular, scheduled update cycle. This is typically done to address a critical vulnerability that is being actively exploited.
- Remote Code Execution (RCE)
- A type of vulnerability that allows an attacker to execute arbitrary commands or code on a target system over a network, without needing physical access.
Source: Tenable
Trivy Scanner Rocked by Supply Chain Attack
Executive Summary
Threat actors known as TeamPCP compromised Aqua Security's popular Trivy vulnerability scanner by injecting credential-stealing malware into its GitHub Actions.
This supply chain attack targeted sensitive data within CI/CD environments, impacting any organization using the compromised versions.
Attack Overview
- Attack Path: Attackers gained access to Trivy's credentials and then force-pushed 75 existing version tags in the `aquasecurity[/]trivy-action` repository to point to malicious code. This allowed the malware to execute before the legitimate Trivy scan.
- Attacker: TeamPCP (also tracked as DeadCatx3 and ShellForce).
Impact Assessment
- Data Stolen: The malware was designed to exfiltrate sensitive credentials from CI/CD environments, including SSH keys and tokens for AWS, GCP, Azure, and Kubernetes.
Detection & Hunting
- Detection Guidance: Audit GitHub Actions logs for any `trivy-action` runs after 19:00 UTC on March 19, 2026. Pin actions to the full commit SHA `57a97c7e7821a5776cebc9bb87c984fa69cba8f1` to ensure an immutable version.
Strategic Takeaway
This incident highlights the critical risk of software supply chain attacks, where trusted developer tools are weaponized to distribute malware and compromise secure environments.
Relevant professional terms
- Supply Chain Attack
- A cyberattack that targets a trusted third-party vendor or software to infiltrate the systems of its customers.
- CI/CD Pipeline
- Continuous Integration/Continuous Deployment is a software development practice that automates the building, testing, and deployment of applications, often containing sensitive credentials.
Source: Wiz.io Blog
Breathalyzer Hack Strands US Drivers
Executive Summary
A cyberattack targeting Intoxalock, a major U.S. provider of ignition interlock devices, has caused a nationwide service outage.
This has left drivers who are legally required to use the devices stranded and unable to start their vehicles.
Attack Overview
- Attack Path: The company states that hackers are overwhelming its servers, preventing them from functioning correctly. The disruption prevents the backend systems from processing the required, regular device calibrations.
Impact Assessment
- Data Stolen: The company reports that while the service is disrupted, user data remains secure.
- Operational Impact: The system outage, which began around March 14th, has rendered vehicles inoperable for users whose devices are due for calibration, effectively locking them out. This has impacted drivers in at least 46 states.
Strategic Takeaway
This incident highlights the significant real-world consequences of service disruptions for IoT devices that are integrated with critical, legally-mandated functions like vehicle operation.
Relevant professional terms
- Ignition Interlock Device
- A breathalyzer installed in a vehicle that requires a driver to provide a breath sample before the engine can be started. It is typically mandated for individuals convicted of driving under the influence.
- Service Disruption
- An event that interrupts the normal operation of a system or service, in this case, preventing the backend servers from communicating with and calibrating the in-car devices.
Source: TechCrunch
Attackers Weaponize Drivers To Blind Security Tools
Executive Summary
Threat actors are deploying dozens of "EDR Killer" tools that exploit legitimate, signed drivers to gain kernel-level access and disable security software.
This "Bring Your Own Vulnerable Driver" (BYOVD) technique is a common precursor to ransomware deployment.
Key TTPs
- Initial Access: Requires existing administrative privileges, often gained via compromised credentials (e.g., VPN) or other exploits.
- Execution: The attacker drops the legitimate but vulnerable driver onto the system and then loads it to gain kernel-level privileges.
- Defense Evasion: The primary technique is BYOVD, which abuses the trusted driver to terminate EDR processes and services, effectively blinding endpoint security.
Campaign Analysis
The widespread use of 54 distinct tools exploiting 35 different drivers highlights a significant trend in defense evasion. This commoditized approach allows ransomware affiliates to reliably disable security controls before executing their primary payload.
Relevant Terms
- EDR (Endpoint Detection and Response): A cybersecurity solution that continuously monitors endpoint devices (like laptops and servers) to detect and respond to threats like malware and cyberattacks.
- BYOVD (Bring Your Own Vulnerable Driver): An attack technique where an adversary with administrative access places a legitimate, signed, but flawed driver on a system to exploit it and gain kernel-level privileges.
Source: The Hacker News
Iran-Linked Group Disrupts Medical Giant
Executive Summary
The U.S. Justice Department has accused Iran's Ministry of Intelligence and Security (MOIS) of operating the "Handala" hacktivist persona, which conducted a destructive cyberattack against medical technology firm Stryker. In response, the FBI seized several of the group's clear-net websites.
The Scheme
- TTP 1: Operated under the guise of a pro-Palestinian "hacktivist" persona to obscure state sponsorship.
- TTP 2: Gained initial access likely using compromised credentials obtained from infostealer malware.
- TTP 3: Used Microsoft Intune to issue remote "wipe" commands to tens of thousands of devices, causing a destructive impact without deploying traditional malware.
The Players
- Threat Actor: Iran's Ministry of Intelligence and Security (MOIS)
The Consequence
- Outcome: The U.S. government seized four of the group's domains, including their data leak and propaganda sites.
Strategic Takeaway
This incident highlights the growing trend of nation-states using "faketivist" personas to conduct destructive attacks with plausible deniability, targeting critical sectors like healthcare.
Relevant Terms
- Hacktivist Persona: A fake online identity created by a state-sponsored group to mimic independent, politically motivated hackers, allowing the state to deny involvement in cyberattacks.
- Wiper Attack: A type of cyberattack that is intended to permanently erase data from a target's systems, with the primary goal of disruption rather than financial gain.
Source: TechCrunch