Inferlume

The threat matrix is dominated by highly capable adversaries rapidly weaponizing vulnerabilities in network boundary systems, software-defined network controllers, and enterprise endpoints before organizations can operationalize vendor advisories.

• CVE-2026-10520 — Ivanti Sentry OS Command Injection:

  • Attack progression: Unauthenticated attackers send malicious, malformed HTTP requests to the exposed management interfaces of Ivanti Sentry gateways. This triggers an OS command injection flaw, granting the attacker instant root-level remote code execution on the underlying appliance. Public proof-of-concept code has sparked massive exploitation attempts to deploy persistent backdoors.

  • Exploitability: The CVSS v3.1 vector AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H yields a maximum 10.0 score, reflecting zero-complexity, remote exploitation without authentication or user interaction. Shadowserver telemetry confirms active attacks targeting all exposed admin portals.

  • Blast radius: Attackers gain control of the mobile access gateway plane, allowing them to intercept remote user traffic, steal corporate credentials, or move laterally into enterprise internal network segments.

• CVE-2026-20245 — Cisco Catalyst SD-WAN Manager Command Injection:

  • Attack progression: An adversary leverages high-privileged netadmin credentials (harvested via credential stuffing or by exploiting prerequisite zero-days like CVE-2026-20182) to log into the SD-WAN Manager CLI. The attacker uploads a file containing malicious shell metacharacters. Because the CLI fails to sanitize input, it executes these characters as root on the controller.

  • Exploitability: Backed by a CVSS 7.8 rating and active CISA KEV status, this represents the seventh major SD-WAN zero-day exploited in 2026.

  • Blast radius: The attack results in an automated configuration push to all downstream edge routers. This means a single controller breach introduces network-wide persistence and traffic manipulation capabilities that survive simple controller remediation.

• CVE-2026-45657 — Windows Kernel TCP/IP Use-After-Free:

  • Attack progression: A remote, unauthenticated attacker transmits specially crafted network packets to a target host over the network. This exploits a Use-After-Free condition in the kernel's TCP/IP processing engine, leading to full code execution at the SYSTEM level.

  • Exploitability: Rated CVSS 9.8. Zero Day Initiative classifies the flaw as wormable and self-propagating across local network segments.

  • Blast radius: While Microsoft designated this "Exploitation Less Likely" due to technical complexity, intense post-patch reverse-engineering by the security research community is highly likely to yield functional exploit code within days, threatening all unpatched enterprise Windows infrastructure.

• CVE-2026-11645 — Google Chrome V8 Out-of-Bounds Memory Flaw:

  • Attack progression: Attackers lure users to compromised or malicious websites hosting tailored HTML and JavaScript payloads. The browser engine processes the code, triggering an out-of-bounds read/write primitive within the V8 component that leads to heap corruption and code execution inside the browser sandbox.

  • Exploitability: Rated CVSS 8.8. It is the fifth Chrome zero-day exploited in the wild this year.

  • Blast radius: While execution is initially constrained to the browser sandbox, these primitives are routinely chained with secondary renderer or OS-level kernel flaws to achieve full endpoint takeover, session hijacking, and SaaS data theft.

• CVE-2026-35273 — Oracle PeopleSoft PeopleTools Unauthenticated RCE:

  • Attack progression: Attackers scan for open /PSEMHUB/ and /PSIGW/HttpListeningConnector pathways on internet-facing PeopleSoft environments and send malformed web requests to execute code on the application server.

  • Exploitability: Rated CVSS 9.8. Mandiant and consulting sources confirm this zero-day has been actively leveraged in global extortion operations.

  • Blast radius: The threat actor group ShinyHunters claims to have used this exploit to compromise and extract database records from over 100 enterprise and higher-education entities, placing highly sensitive HR, financial, and student data at risk.

• Tchap Government Messenger Data Breach:

  • Attack progression: An opportunistic threat actor operating under the handle Misère compromised a legitimate user account tied to the French Education ministry. The actor used this authorized session to systematically scrape unencrypted, public communication rooms over a three-year window.

  • Exploitability: The event stemmed from identity and credential weaknesses rather than a software vulnerability exploit.

  • Blast radius: The breach exposed roughly 13.5 GB of data, containing 643,000 messages and file attachments belonging to 73,467 public servants across multiple government ministries, creating considerable counterintelligence risks.

• Kyushu Electric Power Physical Media Loss:

  • Attack progression: Storage teams performed routine server backups onto an unencrypted external drive on April 27 due to storage limits and locked it in a server room cabinet. On May 26, staff found the cabinet unlocked and the physical backup drive missing.

  • Exploitability: A total of 57 personnel held authorized access to the server facility; law enforcement is investigating the incident as a physical theft.

  • Blast radius: The missing media contains personal data, billing records, and usage tracking for up to 10.9 million utility customers across Japan, driving significant regulatory scrutiny.

• Meta AI / Instagram Automated Account Takeover Exploit:

  • Attack progression: Threat actors utilized targeted VPN services to mask their geographic location and simulate proximity to a target user. They initiated account recovery flows and used social engineering prompts to manipulate Meta's AI support bot into binding a new, attacker-controlled email address to the target account.

  • Exploitability: The logic flaw allowed password resets via verification codes routed to the new email address, entirely bypassing the victim's true email inbox. The attack consistently failed on accounts with enforced multi-factor authentication.

  • Blast radius: High-profile targets—including corporate accounts like Sephora, senior U.S. Space Force staff, and the former Obama White House account—were hijacked and defaced with pro-Iran propaganda materials.