Inferlume

The tactical landscape covered in this reporting period highlights a systemic focus by threat actors on corporate management planes, perimeter boundaries, and data orchestrators. By bypassing initial authentication barriers or abusing trusted inside credentials, adversaries can establish persistent footholds, neutralize disaster recovery models, and execute automated mass exploitation.

+------------------------------------------------------------------------+
|                   CVE-2026-50751: PERIMETER BYPASS                     |
|                                                                        |
|  [Attacker Host] ──( UDP/500 Malformed Phase 1 )──> [Check Point RA]  |
|                                                            │           |
|  [Internal Network] <──( Auth Logic Satisfied )────────────┘           |
|         │                                                              |
|         └──> Deploys Rclone ──> Stages Data ──> Qilin Ransomware

• Check Point VPN CVE-2026-50751 – Perimeter Authentication Bypass

  • Threat Overview: This vulnerability represents an authentication logic flaw within Check Point Security Gateways configured to support the legacy Internet Key Exchange IKEv1 protocol. Attackers can completely bypass identity barriers to gain full network access without supplying user passwords.

  • Attack Progression: An attacker issues a manipulated Phase 1 key exchange string to standard IPsec ports UDP 500 or UDP 4500 on an exposed gateway. Due to an validation flaw (CWE-287), the gateway's state machine treats the connection as fully authenticated based on certificate verification routines while omitting credential binding verification.

  • Exploitability and Targeting: Exploitability is high and requires no user interaction. Telemetry shows active weaponization since May 7, 2026. Ransomware syndicates use Virtual Private Server nodes geolocated to mirror their targets' locations to evade geographic anomaly alerting.

  • Blast Radius & Business Impact: Successful penetration grants an immediate foothold inside trusted zones. Threat actors exploit this state to move laterally, utilize Rclone to exfiltrate critical datasets via HTTPS, and deploy ransomware payloads.

• Microsoft Exchange Server CVE-2026-42897 – Stored OWA Client Execution

  • Threat Overview: An active spoofing and stored cross-site scripting flaw within the mail rendering pipeline of on-premises Microsoft Exchange Server instances allows attackers to force target browsers to process unauthorized code.

  • Attack Progression: Adversaries deliver a highly customized, structurally malformed email message to an internal corporate inbox. When the recipient opens or previews the item inside Outlook Web Access, the application fails to properly sanitize embedded HTML elements, causing arbitrary JavaScript code to execute inside the victim's active browser context.

  • Exploitability and Targeting: This vulnerability is under active wild exploitation and presents an extremely high risk for enterprises hosting local Exchange clusters where the Emergency Mitigation Service is turned off or blocked.

  • Blast Radius & Business Impact: Exploitation allows immediate session hijacking, unauthorized duplication of active web session cookies, harvesting of authorization headers, and stealthy extraction of downstream cloud API access tokens.

• Windows Kernel TCP/IP CVE-2026-45657 – Wormable Remote Code Execution

  • Threat Overview: A critical flaw within the core Windows network stack's packet handling module enables unauthenticated remote code execution at SYSTEM privileges, threatening any network-exposed Windows asset.

  • Attack Progression: Attackers send malformed TCP or IP network packets directly to standard services ports such as SMB port 445 or RPC port 135. The kernel-level processing pipeline mishandles the packet structures, causing memory corruption that allows execution of arbitrary payloads within kernel space.

  • Exploitability and Targeting: Although Microsoft labels this bug as Exploitation Less Likely, it is a high-priority target for exploit developers. Because it requires zero authentication and zero human interaction over raw network layers, it creates a wormable environment.

  • Blast Radius & Business Impact: Immediate network-wide compromise. A single vulnerable boundary system can be leveraged to automate rapid lateral infection across internal server zones, domain controllers, and cloud-linked infrastructure.

• Veeam Backup & Replication CVE-2026-44963 – Backup Tier Remote Takeover

  • Threat Overview: This flaw allows any authenticated domain user, regardless of their lack of administrative rights within the backup infrastructure, to execute arbitrary remote commands on the central backup server.

  • Attack Progression: A compromised low-privilege insider or an outside adversary wielding harvested domain user credentials sends a crafted input string to the Veeam backup service port. The application processes the data through insecure code paths, executing the attacker's commands with high-level privileges.

  • Exploitability and Targeting: Highly critical due to the ubiquity of Veeam systems in corporate recovery zones. Security researchers anticipate rapid adoption of this vulnerability by ransomware affiliates seeking to disable backups prior to encryption.

  • Blast Radius & Business Impact: Complete loss of business resilience. Threat actors can systematically purge historical data backups, manipulate retention variables, and pivot directly into attached cloud storage environments or underlying virtualization layers.

• Everest Forms Pro CVE-2026-3300 – Unauthenticated WordPress Application Shell

  • Threat Overview: A critical unauthenticated evaluation injection flaw in the Complex Calculation feature of the Everest Forms Pro WordPress plugin allows remote attackers to run arbitrary PHP code.

  • Attack Progression: Attackers locate an internet-facing WordPress site hosting a public form utilizing calculation parameters. By submitting malformed form inputs that are not sanitized, the input text is concatenated into an active PHP eval function.

  • Exploitability and Targeting: Mass automated scanning is active. Botnets leverage public search filters to identify exposed plugin structures and execute automated remote code deployment.

  • Blast Radius & Business Impact: Web server takeover. Adversaries drop persistent webshells into plugin directories, compromise underlying databases containing customer information, or use the web server as an external relay node for wider attacks.

• Langflow AI Pipeline CVE-2026-5027 & CVE-2026-33017 – AI Orchestration Exploitation

  • Threat Overview: Dual high-severity flaws in the low-code AI application builder Langflow allow unauthenticated attackers to write unauthorized files or execute arbitrary python strings on target systems.

  • Attack Progression: Attackers exploit default configurations that enable unauthenticated access to public data flows. For CVE-2026-5027, the attacker passes unsanitized path traversal parameters to the file upload endpoint to write files outside permitted directories. For CVE-2026-33017, the attacker targets public workflow build paths to pass unvetted python code blocks straight into an unsandboxed execution function.

  • Exploitability and Targeting: High exploitability on public-facing AI builds. Internet scanning has confirmed thousands of vulnerable installations directly exposed to public manipulation.

  • Blast Radius & Business Impact: Compromise of corporate artificial intelligence resources. Attackers can access sensitive data lake connectors, intercept model training streams, manipulate output algorithms, and extract embedded API credentials.

• Cisco Catalyst SD-WAN Manager CVE-2026-20245 – Root Command Injection Hub

  • Threat Overview: A command injection vulnerability within the command-line subsystem of Cisco Catalyst SD-WAN Manager allows an authenticated netadmin user to execute arbitrary shell commands as root.

  • Attack Progression: Attackers target this interface using harvested credentials or by chaining it with distinct access vulnerabilities. By using file upload utilities in the command line interface, an adversary bypasses parsing validation rules to inject shell metacharacters into system operations.

  • Exploitability and Targeting: Limited target engagements have been confirmed in the wild, often running in tandem with active campaigns targeting adjacent edge equipment.

  • Blast Radius & Business Impact: Wide-area network control plane compromise. Attackers can modify configuration scripts for thousands of branch routers, intercept cross-site data flows, alter operational routing policies, or cause network-wide service outages.

• Fortinet FortiSandbox CVE-2026-25089 – Unauthenticated Operational Sandbox Takeover

  • Threat Overview: An unauthenticated operating system command injection vulnerability within the web management panel of FortiSandbox appliances grants full root level execution to unauthenticated remote attackers.

  • Attack Progression: Attackers send malformed HTTP requests to the web control interface. Due to inadequate input sanitization (CWE-78), shell characters embedded in the web request are processed as system calls by the underlying operating system.

  • Exploitability and Targeting: High-priority threat vector. Management interfaces exposed directly to the internet or broadly accessible across corporate internal VLANs are highly vulnerable.

  • Blast Radius & Business Impact: Security telemetry manipulation. Attackers can disable threat analysis engines, alter malware detection results, extract sensitive samples, or use the trusted network placement of the sandbox appliance to pivot into internal monitoring networks.

• BerriAI LiteLLM CVE-2026-42271 – AI Proxy Command Injection

  • Threat Overview: An input validation issue within the pre-connection test endpoints of LiteLLM proxies allows users holding valid API keys to pass arbitrary command arguments into the host operating system.

  • Attack Progression: An attacker possessing standard proxy access keys submits a malformed parameter block to validation testing endpoints. The application processes these arguments through system subprocess routines without filtering, executing code with proxy application permissions.

  • Exploitability and Targeting: Listed in the CISA KEV catalog with high exploitation metrics, highlighting active use in targeting shared AI infrastructure.

  • Blast Radius & Business Impact: Gateway infrastructure compromise, resulting in potential exposure of master API tokens, theft of model credentials, and lateral movement across container fabrics.