CTI status
As of:
Last pipeline run:
Source reliability
Information credibility
NATO Admiralty (AJP-2.1) grades confidence, independent of the risk score. Cross-source corroboration isn't tracked for non-CVE news, so single-source items are capped at a lower credibility number; a low number does not imply low quality.
Qilin actors are deliberately exploiting an authentication bypass vulnerability as an entry point into production environments,an indicator of ransomware campaigns targeting the industrial sector.
The alert describes active in-the-wild exploitation (webshell installation, persistent infection) rather than patch availability alone,critical for security of internet-facing WordPress instances.
CVE-2026-50522 is already under active exploitation and is the third SharePoint vulnerability in July 2026 to come under attack immediately after disclosure; prior variants were weaponized as zero-days before patching.
A local privilege escalation flaw in Windows WMI allows local attackers to escalate from low-privilege to SYSTEM-level access; affects Windows Server 2022/2019 and all AD-joined clients in hybrid DACH infrastructure.
A local privilege escalation vulnerability in Windows WMI requires already-compromised low-privilege accounts for exploitation, but poses significant risk in multi-user production environments.
The vulnerability is actively exploited to steal machine keys, indicating targeted, ongoing attacks in the wild.
Russian intelligence-linked APTs are actively exploiting misconfigured routers as entry points into European critical-infrastructure organisations; this is an active, ongoing campaign pattern with direct relevance to EU/DACH regions.
MFA bypass in ADSelfService Plus allows attackers to compromise AD-integrated authentication and gain unauthorized access to enterprise-wide resources.
SANDWORM exploits AI coding assistants and LLM toolchains as novel supply-chain attack vectors by fingerprinting runtime behavior of developer workstations and CI automation,a qualitatively new threat class for organizations conducting internal software development.
North Korean IT worker networks directly finance Russia's war effort through sanctions evasion; this demonstrates an operationalized alliance between North Korea and Russia that elevates DACH organizations as potential targets for retaliation or espionage.
The vulnerability enables remote code execution via specially crafted HTML pages without prior authentication, requiring immediate patch prioritization for all Chrome installations in production environments.
Pwn2Own-demonstrated vulnerability in Microsoft Edge enables code execution via malicious web pages or files; exploitation requires user interaction.
The Qilin ransomware group is actively exploiting a critical authentication bypass flaw in Palo Alto PAN-OS GlobalProtect to infiltrate networks, indicating an ongoing campaign against enterprise environments.
BSI warns of multiple critical-severity vulnerabilities in GNU libc; these are widespread on Linux systems and require timely patching.
The vulnerability enables remote code execution within the Chrome sandbox via crafted HTML pages, but is a standard patch update with no evidence of active exploitation in the wild.
The vulnerability allows local attackers to exploit heap corruption via malicious files; it requires local access and is therefore primarily relevant in scenarios involving untrusted file handling or USB access.
Kratos platform automated approximately 15,000 phishing campaigns per month; BKA dismantling reveals operational vulnerability of centralized phishing-as-a-service infrastructure in German jurisdiction.
BSI warning for multiple unspecified vulnerabilities in Chrome and Edge , patch details are missing; follow-up advisories with CVE numbers and CVSS scores are to be expected.
HollowGraph abuses Microsoft's legitimate Calendar service as a bidirectional command-and-control channel, bypassing traditional email and network-based detection and blurring the line between legitimate cloud operations and malware communication.
The BSI/BürgerCERT advisory discloses multiple vulnerabilities in widely-used browsers without technical details, likely coordinating with vendors ahead of public disclosure.
The BSI warning covers multiple unspecified vulnerabilities in Firefox/Thunderbird without CVE details or active exploitation confirmation; unclear whether public exploits exist or if this is an aggregated patch summary.
wp2shell vulnerabilities in WordPress Core enable unauthenticated remote code execution; exploitation activity began within hours of patch release, and compromised sites are used as delivery mechanisms for credential theft, malware, and fraud.
Unknown threat actors are actively exploiting multiple SonicWall SMA1000 zero-days to deploy custom malware on VPN appliances , a direct attack vector against remote access infrastructure.
An unofficial patch for a Windows zero-day with admin privilege escalation is circulating publicly while an official Microsoft fix remains pending.
OilRig APT exploits Outlook calendar events as a steganographic C2 channel and leverages DNS AAAA records for configuration recovery,a novel abuse pattern of Microsoft-hosted services.
Vendor-signed UEFI drivers from multiple manufacturers enable pre-boot code execution via BYOVD attacks, requiring DBX updates for revocation.
A leading remote access provider was ordered by German financial regulator to pay damages , a signal for increased liability of security failures in critical B2B tools.
The alert describes a known operational issue with WSUS synchronization without new security or exploit implications, but only administrative measures to resolve delays.
BSI warning on generic Linux kernel DoS vulnerabilities without specific CVE references or exploit status , requires contextualisation and link to specific patches.