Comparing 27 May 2026 with the previous day 26 May 2026.
Unit 42 documents active, likely state-sponsored exploitation (CL-STA-1132) of a PAN-OS zero-day enabling unauthenticated remote code execution, targeting critical network perimeter infrastructure.
CL-STA-1132, a likely state-sponsored threat cluster, actively exploits CVE-2026-0300 and deploys open-source tunneling tools and Active Directory enumeration following initial compromise.
A remote code execution vulnerability in BeeStation Manager requires attention if the product is deployed, but does not affect standard Synology DSM devices typically used in manufacturing environments.
An authentication bypass in Synology DSM SSO module allows unauthorised access to NAS systems with knowledge of LDAP Distinguished Names, without requiring a password.
The vulnerability allows local users to install unsigned APP packages on PLCnext controllers without integrity verification, leading to root-level code execution,a critical risk for connected industrial automation systems.
The vulnerability allows any user in the same Entra ID domain to authenticate locally as another user on Unix systems because the DAG flow validates domain aliases but fails to verify the complete UPN username component.
The vulnerability enables passive network attackers to intercept sensitive healthcare data (patient identifiers, SMC-B operations, document content) in the Telematik infrastructure without active exploitation.
MuddyWater (Iranian state-sponsored APT) weaponizes Chaos ransomware as cover for targeted operations against Western infrastructure, masking state-sponsored intent as criminal RaaS activity.
Germany's Cabinet has granted the BKA new powers for active cyber defense, including the right to infiltrate and disrupt or destroy foreign IT systems , a measure that carries significant risks to uninvolved third parties, as attackers routinely use compromised systems as springboards.
State-sponsored actors differ fundamentally from financially motivated attackers: they do not use breaking-and-entering methods but instead compromise credentials and remain invisible for months using legitimate user tools.
The German bill explicitly regulates hackbacks and active cyber defense for the first time, defining new legal boundaries and options for cyber countermeasures for German and European companies.
The vulnerability requires local access and affects only sensitive parameter queries; no CVSS score or exploitability details are provided.
OceanLotus leverages legitimate Python package repositories (PyPI) as a malware distribution channel to compromise developers and organizations with Python dependencies,a sophisticated supply-chain approach with potential DACH implications.
A local validation flaw in Synology ActiveProtect Agent allows locally authenticated users to write arbitrary files with restricted content during installation, potentially compromising backup operation integrity.
The vulnerability allows local attackers to write arbitrary files with restricted content during installation,an installation-time attack that requires privileged access and therefore poses moderate risk to isolated backup systems.
The vulnerability allows local users to write arbitrary files with restricted content during installation,a critical risk in production environments where installation runs with elevated privileges.
The vulnerability allows already-authenticated administrators to obtain sensitive information via undocumented vectors , an insider-risk scenario in surveillance-critical systems.
The vulnerability allows authenticated administrators to access sensitive export keys in cleartext, posing a significant data risk for surveillance systems.
Five critical vulnerabilities in UniFi OS Server enable unauthorized system access by network-adjacent attackers; CVE-2026-34908 with CVSS score 10.0 represents maximum risk.
Kali365 bypasses MFA by stealing access and refresh tokens rather than passwords, enabling persistent access to Outlook, Teams, and OneDrive without repeated login attempts.
Microsoft Patch Tuesday for May 2026 includes 137 vulnerabilities with 31 critical, including RCEs in Windows Services, Office, Azure and SharePoint , no active exploitation observed.
The vulnerability requires existing elevated admin privileges and restricts write access to unspecified vectors, reducing practical exploitation risk for external attackers.
Unit 42 documents advanced AD CS misuse techniques for privilege escalation through misconfigured certificate templates and PKINIT-based authentication bypass observed in nation-state attack campaigns.
The BSI warns of a critical remote code execution vulnerability in 7-Zip when processing NTFS archives, which requires user interaction but poses significant security implications.
BSI advisory covering multiple vulnerabilities in Microsoft Developer Tools without specific CVE numbers or exploitation status , typically aggregated patch information from ongoing security updates.
BSI warning on multiple OpenSSL vulnerabilities without specific CVE references , requires clarification via direct BSI source or CISA cross-reference for concrete patching priorities.
SymJack demonstrates that AI coding agents can be tricked via malicious symlinks and repositories into installing attacker-controlled MCP servers, enabling compromise of CI/CD pipelines and secret exfiltration.
The BSI alert documents an active threat to Synology NAS systems commonly deployed in the DACH region, without a CVE identifier available, suggesting ongoing analysis or embargo-protected disclosure.
BSI warns of multiple unspecified Chrome vulnerabilities without naming specific CVE IDs or affected versions; the exact risk remains unclear until full disclosure.
The vulnerability allows an attacker with access to a non-CA certificate to forge arbitrary leaf certificates and thereby impersonate servers or clients in mTLS environments, representing a fundamental breach of the PKI chain of trust.
Akira intrusion demonstrates typical pattern: initial authentication via SSLVPN, lateral movement exclusively via RDP over two days, Kerberoasting and defense evasion through Event Log deletion,all activity was visible in standard logs but required proactive correlation between firewall and endpoint logs.
Attackers combine search engine poisoning with AI chatbot manipulation to distribute counterfeit utility downloads that inject GPU-mining malware via DLL sideloading,an escalation of supply-chain social engineering tactics.
A critical vulnerability in 7-Zip allows code injection through archives and requires prompt patching across all affected company systems.
Microsoft announces an automatic network isolation feature in Defender that will proactively limit damage upon attack detection,a preventive defensive capability rather than a patch.
BSI warning regarding multiple unspecified Linux kernel vulnerabilities without concrete CVE identifiers complicates risk prioritization for organizations with Ubuntu deployments.
The vulnerability causes an ABBA deadlock in filesystem operations and can cause system hang, but only under specific conditions (blocksize < pagesize).
No changes in this category.
No changes in this category.
Copy Fail enables local privilege escalation by manipulating the in-memory cache of privileged binaries without modifying on-disk files, bypassing integrity checks.
The vulnerability requires only minimal Site Member permissions and can be exploited by internal or compromised accounts without elevated administrator rights , a risk for manufacturing environments with many SharePoint users.
The vulnerability enables arbitrary code execution through maliciously crafted TIF files in Autodesk 3ds Max, which poses a risk to organizations with design workflows.
The vulnerability enables code execution through maliciously crafted WRL files in a 3D CAD application commonly integrated into design workflows, creating supply-chain integrity risks for SolidWorks/AutoCAD-based processes.
A memory corruption vulnerability in Autodesk 3ds Max enables arbitrary code execution through malicious WRL files , relevant for manufacturing environments where 3D design software processes CAD files from potentially untrusted sources.
Insufficient length validation in IKE packets with NAT-T can cause VPN service crashes; relevant for manufacturing companies that rely on stable VPN access for remote maintenance and secure remote operations.
Dutch authorities dismantle parts of Russian cyber infrastructure used for attacks and disinformation against the West,an indicator of ongoing Russian operations targeting DACH and the EU.
A vulnerability in Fortinet's Identity Awareness blade allows unauthenticated users to read internal files on the Security Gateway when browser-based authentication is enabled.
Iranian APT Nimbus Manticore continues operations with updated tools targeting critical sectors such as aviation and software,evidence of sustained state-sponsored cyber-warfare with potential implications for European supply chains.
MuddyWater actively exploits legitimate software binaries (Fortemedia, SentinelOne) for DLL side-loading attacks targeting industrial manufacturers, airports, and financial services across nine countries,a direct threat to European manufacturing enterprises.
Investigators disrupted a Russian cyber attack and disinformation infrastructure in the EU , signal of continued state-sponsored operations against Western Europe.
Nimbus Manticore uses targeted phishing and SEO poisoning campaigns to distribute custom malware variants against European aviation and software organizations as a direct response to geopolitical escalation.
The dismantling of bulletproof hosting services in the Netherlands signals intensified European action against Russian threat-actor cyber infrastructure and may impact the availability of hosting resources for APT campaigns targeting DACH enterprises.
German infrastructure is again heavily affected by cyber extortion in 2025 , ransomware groups have reactivated their focus on the DACH region, matching peaks from 2022,2023.
Unauthenticated remote code execution without authentication on Canon multifunction printers via BJNP protocol with CVSS 8.8 , immediate threat to enterprise printer fleets.
Unauthenticated remote code execution in Canon MFP devices used for document scanning and network printing creates a direct entry point for lateral network movement without requiring user credentials.
Newly discovered vulnerability in Canon imageCLASS MF654Cdw with high CVSS rating (8.8), exploitable by network-adjacent attackers without authentication.
Unauthenticated remote code execution possible on Canon multi-function printer; patch required.
This Pwn2Own exploit demonstrates a critical vulnerability in Canon printers exploitable without authentication by network-adjacent attackers, enabling direct access to a widespread peripheral device on the corporate network.
Although 3ds Max is not used, the vulnerability demonstrates a pattern across the Autodesk product family that could also affect AutoCAD and other design tools.
Use-after-free in Windows NDIS driver enables local privilege escalation with CVSS 7.8 on systems where code execution is already possible.
Local privilege escalation in FortiClient requires prior low-privilege code execution and affects a core security infrastructure product.
A CVSS-8.8 RCE vulnerability in FortiWeb requires authentication and should be prioritized once a fix is available.
BSI has warned of a critical code execution vulnerability in SharePoint Server 2016/2019 that can be exploited by authenticated remote attackers and requires immediate patching.
A BSI warning regarding privilege escalation in Entra ID and Azure Resource Manager signals one or more critical vulnerabilities in core Microsoft cloud identity services that directly impact enterprise IT environments with hybrid AD/Entra integration.
AI assistants with access to enterprise-wide data repositories are attractive targets for state-sponsored actors who could use RCE to gain access to sensitive information or systems.
Local privilege escalation in Windows win32kfull requires prior code execution on the target system; patch prioritization necessary for all Windows servers and endpoints.
Race condition in afd.sys enables local privilege escalation with CVSS 7.8; affects Windows Server 2022 and 2019 systems critical for Active Directory and domain authentication.
Local privilege escalation in Windows kernel component win32full requires prior low-privileged code execution as a precondition for exploitation.
Local privilege escalation in Windows win32full with CVSS 7.8 requires prior low-privileged code execution; relevant for manufacturing environments with client and server endpoints.
Local privilege escalation in win32kfull requires prior code execution with low privilege; patching is necessary to prevent lateral movement after local compromise.
A state-validation vulnerability enables attackers to bypass two-factor authentication, representing a critical risk for all AD/Entra-ID-based systems.
A state-management vulnerability enables bypass of two-factor authentication,potentially a target for nation-state actors to gain initial access.
BSI warning of critical IKE vulnerability in Windows VPN infrastructure requires immediate attention for VPN gateways and remote access systems.
The compromise of multiple versions of a popular PHP package indicates a targeted supply-chain attack in which infostealer malware is distributed via dependency management.
Attackers with valid credentials can coerce users to accept MFA push notifications through repeated bombardment, bypassing the second factor without needing to compromise it.
BSI warning of a privilege-escalation vulnerability in TeamViewer affects a critical remote-access tool in the company's manufacturing IT infrastructure.
The vulnerability allows non-privileged authenticated users to execute remote code without administrator rights, making SharePoint an exponentially riskier target for insider threats and APTs.
Previously undocumented Pheno plugin abuses Windows Phone Link to intercept OTPs and SMS directly from the PC without deploying malware to the smartphone,a novel MFA-bypass technique.
Microsoft is expanding Defender for Endpoint with automated isolation of compromised endpoints to contain lateral movement attacks,a defensive capability improvement without a new vulnerability or active attack.