Daily Threat Briefing
← All briefings

Oracle WebLogic Server · Android Framework · Linux Kernel

DAILY THREAT INTELLIGENCE BRIEFING Date: 2026-06-03 Prepared for: SOC Analysts, Incident Responders, Vulnerability Management, Security Leadership Classification: TLP:CLEAR

EXECUTIVE SUMMARY

Three actively exploited vulnerabilities dominate today’s briefing: Oracle WebLogic Server (CVE-2024-21182), Android Framework (CVE-2025-48595), and Linux Kernel (CVE-2022-0492) have all been added to the CISA Known Exploited Vulnerabilities catalog within the past 72 hours, with mandatory remediation deadlines imminent. The German BSI has issued a critical advisory for Google Android covering 124 vulnerabilities, one of which is confirmed under active exploitation. A significant supply chain attack campaign dubbed Miasma has compromised Red Hat npm packages, deploying a self-propagating credential-stealing worm. The Gamaredon threat group continues active operations exploiting a WinRAR path traversal flaw to deliver GammaWorm and GammaSteel against Ukrainian targets. A China-aligned espionage campaign, Operation Dragon Weave, has been observed targeting EU member state Czech Republic. Dutch authorities have dismantled a botnet linked to 17 million infected devices. Vulnerability management teams should treat the KEV deadlines as immediate action items.

CRITICAL VULNERABILITIES

CVE-2024-21182

  • Affected products: Oracle WebLogic Server (versions affected per July 2024 CPU)
  • Severity: HIGH (CVSS 7.5)
  • Exploitation status: Actively exploited; added to CISA KEV on 2026-06-01
  • Remediation: Apply Oracle Critical Patch Update from July 2024 immediately. Block T3 and IIOP protocol access from untrusted networks at the perimeter. Remediation deadline for US federal agencies: 2026-06-04. Enterprise operators should treat this with equivalent urgency.

CVE-2025-48595

  • Affected products: Android Framework (all devices receiving June 2026 Android Security Bulletin)
  • Severity: HIGH (CVSS 8.4)
  • Exploitation status: Actively exploited in the wild; added to CISA KEV on 2026-06-02; confirmed by Google June 2026 Android Security Bulletin
  • Remediation: Apply June 2026 Android security patches immediately. Prioritize managed Android devices in enterprise MDM environments. Remediation deadline: 2026-06-05.

CVE-2022-0492

  • Affected products: Linux Kernel (cgroups v1 release_agent feature; affects multiple distributions and container environments)
  • Severity: HIGH (privilege escalation)
  • Exploitation status: Actively exploited; added to CISA KEV on 2026-06-02
  • Remediation: Apply vendor-specific kernel patches. Disable or restrict cgroups v1 release_agent where not required. Verify container isolation configurations. Check with distribution vendors (Red Hat, Ubuntu, SUSE, Debian) for patching status. Remediation deadline: 2026-06-05.

CVE-2026-47117

  • Affected products: OpenMed before version 1.5.2 (healthcare AI platform)
  • Severity: CRITICAL (CVSS 9.8)
  • Exploitation status: No active exploitation confirmed at time of writing; proof-of-concept details publicly available
  • Remediation: Upgrade to OpenMed 1.5.2 immediately. The vulnerability allows unauthenticated remote code execution via malicious Hugging Face model loading with trust_remote_code=True. Healthcare organizations using this platform should treat this as urgent.

CVE-2026-5076 (consolidated with CVE-2026-5073 and CVE-2026-5074)

  • Affected products: ARMember Premium WordPress plugin, all versions up to and including 7.3.1
  • Severity: CRITICAL (CVSS 9.8)
  • Exploitation status: No confirmed active exploitation; exploit chain publicly documented
  • Remediation: Update ARMember Premium to version 7.3.2 or later. The combination of SQL injection (CVE-2026-5073, CVE-2026-5074) and insecure password reset key storage (CVE-2026-5076) enables full unauthenticated account takeover including administrator accounts.

CVE-2026-1784

  • Affected products: Red Hat OpenShift Container Platform (Route resource via HAProxy)
  • Severity: HIGH (CVSS 8.8)
  • Exploitation status: No active exploitation confirmed
  • Remediation: Apply Red Hat security advisory. Restrict Route resource creation to trusted users. Review spec.path values in existing Route definitions for unexpected characters.

Drager Medical Device Vulnerabilities (CVE-2019-25719, CVE-2022-4992, CVE-2019-25722, CVE-2021-4478, CVE-2021-4480, CVE-2021-4481, CVE-2024-14036)

  • Affected products: Drager Infinity Acute Care System, Infinity M540, SC Monitoring devices (SC 6002XL through SC 9000 XL), CC-Vision Basic before 7.5.3, CC-Vision E-Cal before 7.2.5.0, Drager Protector Software before 6.4.2, Drager Core 1.0.5, M540 Converter Service 1.0.9
  • Severity: HIGH (CVSS 7.5 to 8.8)
  • Exploitation status: No active exploitation confirmed; vulnerabilities include network spoofing, DoS, hard-coded credentials, local privilege escalation, and buffer overflow
  • Remediation: Consult Drager security advisories at static.draeger.com/security. Isolate affected medical devices from general hospital networks. Apply firmware and software updates per vendor guidance. Particularly relevant for German and European healthcare operators.

EUROPEAN ADVISORIES

BSI CERT-Bund issued a high volume of advisories on 2026-06-02. Key items for enterprise defenders:

  • Google Android (WID-SEC-2026-1772) - Rated CRITICAL. Covers 124 vulnerabilities including CVE-2025-48595 under active exploitation. Immediate patching required for all managed Android devices.

  • Apple macOS (WID-SEC-2025-2475) - Rated CRITICAL (updated). Multiple vulnerabilities enabling privilege escalation, code execution, and information disclosure.

  • Microsoft SharePoint Server (WID-SEC-2026-1764) - Rated HIGH. Authenticated remote code execution vulnerability. Organizations running on-premises SharePoint should prioritize patching.

  • Ivanti Neurons for ITSM (WID-SEC-2026-1767) - Rated HIGH. Authenticated privilege escalation. Ivanti products continue to be a high-value target; apply patches promptly.

  • OpenSSL (WID-SEC-2026-0234, updated) - Rated HIGH. Multiple vulnerabilities including potential code execution and DoS. Review OpenSSL versions across all infrastructure components.

  • Roundcube Webmail (WID-SEC-2026-1671, updated) - Rated HIGH. Multiple vulnerabilities including SQL injection, code execution, and XSS. Roundcube is widely deployed in European organizations; update immediately.

  • Mozilla Firefox and Thunderbird (WID-SEC-2026-1606, updated) - Rated HIGH. Multiple vulnerabilities including sandbox escape and code execution. Apply latest browser updates across all endpoints.

  • IBM WebSphere Application Server (WID-SEC-2026-1762) - Rated HIGH. Security bypass and code execution. Relevant for enterprise Java application environments.

  • NGINX Open Source and NGINX Plus (WID-SEC-2026-1661, WID-SEC-2026-1527, updated) - Rated HIGH. DoS and potential code execution. Review NGINX deployments in web-facing infrastructure.

  • Drager medical device advisories (multiple CVEs) - Newly published. See Critical Vulnerabilities section above. Directly relevant to German healthcare sector.

CERT-EU published its monthly Cyber Brief 26-06 (May 2026) on 2026-06-02, providing an executive-level overview of May threat developments. The brief is TLP:CLEAR and available at cert.europa.eu.

ACTIVE THREATS AND CAMPAIGNS

Gamaredon - WinRAR Exploitation Campaign

  • The Russian state-linked Gamaredon group is actively exploiting CVE-2025-8088, a path traversal vulnerability in WinRAR, to deliver a multi-stage infection chain.
  • Initial payload: GammaPhish (HTML Application), followed by GammaWorm (propagation) and GammaSteel (data theft).
  • Primary targets: Ukrainian government and organizations. European organizations with ties to Ukraine or operating in adjacent sectors should remain vigilant.
  • Recommended detection: Monitor for anomalous WinRAR extraction behavior, HTA file execution from archive paths, and outbound connections to newly registered domains.

Operation Dragon Weave - China-Aligned Espionage

  • A China-aligned threat group has been observed conducting spear-phishing campaigns against government, research, academic, technology, and financial services targets in the Czech Republic and Taiwan.
  • Delivery method: ZIP attachments containing malicious files deploying an AdaptixC2 agent.
  • Directly relevant to EU member state organizations. Czech Republic targeting indicates continued interest in European government and research institutions.
  • Recommended detection: Block ZIP attachments from external senders where not operationally required. Monitor for AdaptixC2 C2 communication patterns.

Miasma Supply Chain Attack - Red Hat npm Packages

  • A supply chain campaign has compromised packages under the @redhat-cloud-services npm namespace.
  • Malicious packages execute at install time, harvest credentials and secrets from developer machines, target CI/CD pipelines, and deploy a self-propagating worm with encrypted exfiltration.
  • Organizations using Red Hat cloud services tooling in development pipelines should audit npm dependencies immediately.
  • Recommended actions: Audit package.json and lock files for @redhat-cloud-services packages. Review CI/CD pipeline logs for anomalous outbound connections. Rotate any credentials present on affected developer machines.

SideCopy - Xeno RAT Campaign

  • Pakistan-aligned SideCopy group has been observed deploying Xeno RAT via spear-phishing ZIP archives containing malicious LNK files against Afghanistan’s Ministry of Finance.
  • Limited direct relevance to European organizations but indicative of continued RAT-based spear-phishing tradecraft targeting government entities.

Dashlane Brute-Force Incident

  • Password manager Dashlane disclosed on 2026-05-31 that an external threat actor conducted a brute-force attack targeting 2FA mechanisms, resulting in encrypted vault downloads for fewer than 20 personal subscription users.
  • Enterprise impact is assessed as low based on available information. Organizations using Dashlane for enterprise password management should verify their account security posture and confirm 2FA is enforced.

WP Maps Pro - Active Exploitation

  • Threat actors are actively exploiting a critical vulnerability in the WP Maps Pro WordPress plugin to create unauthorized administrator accounts.
  • Organizations running WordPress with this plugin installed should update immediately and audit administrator account lists for unauthorized entries.

SECURITY NEWS AND CONTEXT

Dutch Botnet Takedown

  • Dutch authorities (Politie and NCSC) have dismantled a botnet comprising at least 17 million infected devices, with over 200 command-and-control servers located in the Netherlands. The operation represents a significant European law enforcement success. Organizations should review threat intelligence feeds for associated IOCs and check whether any internal assets were part of the botnet infrastructure.

AI-Accelerated Exploitation Timelines

  • Industry reporting confirms that the window between vulnerability disclosure and active exploitation is now measured in hours rather than days, driven by AI-assisted exploit development. Vulnerability management programs relying on traditional patch cycles are increasingly inadequate. Organizations should prioritize risk-based patching with a focus on internet-exposed assets and CISA KEV entries.

CERT-EU Cyber Brief 26-06

  • CERT-EU’s May 2026 monthly brief is available at TLP:CLEAR. Security leadership should review for strategic context on threat trends affecting EU institutions and member states.

RECOMMENDED ACTIONS

Immediate (within 24 hours):

  • Patch Oracle WebLogic Server for CVE-2024-21182. Block T3/IIOP from untrusted networks. KEV deadline: 2026-06-04.
  • Apply June 2026 Android Security Bulletin to all managed devices. CVE-2025-48595 is actively exploited. KEV deadline: 2026-06-05.
  • Apply Linux kernel patches for CVE-2022-0492 across all Linux hosts and container environments. Verify cgroups v1 configurations. KEV deadline: 2026-06-05.
  • Audit npm dependencies for @redhat-cloud-services packages. Rotate credentials on any affected developer or CI/CD systems.
  • Update WP Maps Pro on all WordPress installations. Audit admin accounts for unauthorized entries.

Short-term (within 72 hours):

  • Update ARMember Premium WordPress plugin to 7.3.2 or later to address the SQL injection and account takeover chain.
  • Patch OpenMed to version 1.5.2 in healthcare environments.
  • Apply BSI-flagged patches for Roundcube Webmail, Mozilla Firefox/Thunderbird, Microsoft SharePoint, Ivanti Neurons for ITSM, and IBM WebSphere.
  • Review Drager medical device deployments and apply vendor mitigations. Isolate affected devices from general hospital networks.
  • Implement or verify detection rules for WinRAR-based HTA execution chains associated with Gamaredon activity.

Ongoing:

  • Increase monitoring for spear-phishing with ZIP attachments targeting government, research, and financial sectors in light of Operation Dragon Weave.
  • Review CI/CD pipeline integrity and enforce package integrity verification (checksums, signed packages) to mitigate supply chain risk.
  • Accelerate patch cadence for internet-exposed assets given confirmed AI-driven reduction in exploitation timelines.
  • Verify Dashlane enterprise accounts have strong 2FA enforced and review for any anomalous access events around 2026-05-31.
  • Consult CERT-EU Cyber Brief 26-06 for strategic threat context relevant to EU-sector leadership briefings.

End of Report - 2026-06-03 Sources: CISA KEV, NVD, BSI CERT-Bund, CERT-EU, The Hacker News, VulnCheck