CTI status
As of:
Last pipeline run:
Source reliability
Information credibility
NATO Admiralty (AJP-2.1) grades confidence, independent of the risk score. Cross-source corroboration isn't tracked for non-CVE news, so single-source items are capped at a lower credibility number; a low number does not imply low quality.
CISA confirms active exploitation: the SharePoint RCE CVE-2026-65660 is being attacked in the wild, and the RouterOS flaw CVE-2026-67279 is chained with CVE-2026-86060 into the 'MikroTrick' exploit chain that yields full unauthenticated access.
The case shows that the Cyclops Blink infrastructure disrupted by the FBI in 2022 is not dead: a Russian military APT combines multiple Cisco flaws to plant an upgraded botnet variant on exposed edge devices.
The vulnerability requires local access; exploitation assumes an already compromised system or malicious local user.
The vulnerability requires local access and allows privilege escalation; exploitation requires already compromised access.
Unlike third-party vulnerable drivers, BTR.sys is a built-in Windows component and is therefore not covered by the Microsoft Vulnerable Driver Blocklist, making it a living-off-the-land driver for attackers with administrative rights.
The update does not list specific CVE IDs but summarizes multiple vulnerabilities in both browsers.
The report summarizes multiple unspecified Linux kernel vulnerabilities that can lead to DoS and memory leaks, without concrete CVE or patch details.