Daily Threat Briefing
← All briefings

Check Point Security Gateway · SAP NetWeaver Application Server ABAP and ABAP Platform · SAP NetWeaver Application Server Java

DAILY THREAT INTELLIGENCE BRIEFING Date: 2026-06-09 Prepared for: SOC Analysts | Incident Responders | Vulnerability Management | Security Leadership

EXECUTIVE SUMMARY

The most critical new developments today are the CISA KEV addition of two actively exploited vulnerabilities: CVE-2026-50751 in Check Point Security Gateway (IKEv1 authentication bypass, CISA remediation deadline 2026-06-11) and CVE-2026-42271 in BerriAI LiteLLM (command injection). SAP’s June 2026 Patch Day has delivered multiple critical vulnerabilities in SAP NetWeaver, including an unauthenticated memory corruption flaw (CVE-2026-27671, CVSS 9.8) and a near-perfect XML signature bypass (CVE-2026-44748, CVSS 9.9). A public working exploit for a Linux kernel nf_tables use-after-free (CVE-2026-23111) enabling local root escalation and container escape was released by Exodus Intelligence on June 8. The STACKIT IaaS API privilege escalation vulnerability (CVE-2026-39910) is directly relevant to European cloud customers using the German STACKIT platform.

CRITICAL VULNERABILITIES

CVE-2026-50751 (NEW - ACTIVELY EXPLOITED)

  • Affected products: Check Point Security Gateway (Remote Access VPN and Mobile Access with IKEv1 enabled)
  • Severity: Critical (CVSS 9.3 per vendor; CWE-287 Improper Authentication)
  • Exploitation status: Actively exploited in the wild; added to CISA KEV 2026-06-08
  • Technical detail: A logic flaw in IKEv1 certificate validation allows an unauthenticated remote attacker to bypass password authentication and establish a VPN session without valid credentials. Only deployments using the deprecated IKEv1 key exchange protocol are affected.
  • Remediation: Apply the Check Point hotfix immediately (see sk185033). CISA deadline for federal agencies is 2026-06-11. If the hotfix cannot be applied immediately, disable IKEv1 and migrate to IKEv2. Audit VPN session logs for unexpected authentication events.

CVE-2026-27671 (NEW)

  • Affected products: SAP NetWeaver Application Server ABAP and ABAP Platform (SAP Kernel)
  • Severity: Critical (CVSS 9.8; CWE-121 Stack-Based Buffer Overflow)
  • Exploitation status: No confirmed exploitation; published 2026-06-09 on SAP Patch Day
  • Technical detail: Improper RFC protocol validation in the SAP Kernel allows an unauthenticated remote attacker to send a crafted RFC request that triggers memory corruption via logical errors in memory management, with full impact on confidentiality, integrity, and availability.
  • Remediation: Apply SAP Security Note 3717897 immediately. Prioritize internet-facing or DMZ-exposed SAP systems. Restrict RFC access to trusted networks as a compensating control.

CVE-2026-44748 (NEW)

  • Affected products: SAP NetWeaver Application Server ABAP and ABAP Platform
  • Severity: Critical (CVSS 9.9; CWE-347 Improper Verification of Cryptographic Signature)
  • Exploitation status: No confirmed exploitation; published 2026-06-09 on SAP Patch Day
  • Technical detail: An authenticated attacker with normal user privileges can obtain a valid signed message and submit modified signed XML documents to the verifier, causing acceptance of tampered identity information. This enables unauthorized access to sensitive user data and potential system disruption. The scope change and low privilege requirement make this particularly dangerous in multi-tenant SAP environments.
  • Remediation: Apply SAP Security Note 3746332. Review SAP user privilege assignments and audit XML-based authentication flows.

CVE-2026-40128 (NEW)

  • Affected products: SAP NetWeaver Application Server Java (Web Container)
  • Severity: Critical (CVSS 9.0; CWE-35 Path Traversal)
  • Exploitation status: No confirmed exploitation; published 2026-06-09 on SAP Patch Day
  • Technical detail: An unauthenticated attacker can craft a malicious HTTP logon request that manipulates file inclusion parameters, enabling path traversal and processing of included files. This can result in viewing or modifying sensitive information or rendering system components unavailable.
  • Remediation: Apply SAP Security Note 3727078. Restrict external access to SAP Java Web Container logon endpoints where possible.

CVE-2026-42271 (NEW - ACTIVELY EXPLOITED)

  • Affected products: BerriAI LiteLLM (open-source LLM proxy; versions prior to v1.83.7-stable)
  • Severity: High (CWE-78/CWE-77 Command Injection; CISA KEV listed)
  • Exploitation status: Actively exploited; added to CISA KEV 2026-06-08; CISA deadline 2026-06-22
  • Technical detail: Any authenticated user, including holders of low-privilege internal-user API keys, can execute arbitrary OS commands on the host running LiteLLM. This is particularly dangerous in shared or multi-tenant AI gateway deployments.
  • Remediation: Upgrade to LiteLLM v1.83.7-stable or later. If upgrade is not immediately possible, restrict API key issuance to trusted users only and isolate the LiteLLM host. Review audit logs for unexpected command execution.

CVE-2026-23111 (STATUS CHANGE - PUBLIC EXPLOIT RELEASED)

  • Affected products: Linux Kernel (nf_tables packet-filtering subsystem)
  • Severity: High (local privilege escalation to root; container escape)
  • Exploitation status: Upstream patch available since 2026-02-05; full working exploit published by Exodus Intelligence on 2026-06-08. No confirmed in-the-wild exploitation at time of writing, but public exploit significantly raises risk.
  • Update: Exodus Intelligence released a detailed technical walkthrough and working exploit on June 8. Any unprivileged local user or container process can escalate to root. This is now a high-priority patching item for all Linux-based systems, particularly container hosts and shared compute environments.
  • Remediation: Apply the upstream kernel patch (available since February 2026). Verify distribution-specific kernel updates are applied. Prioritize container hosts, Kubernetes nodes, and multi-tenant Linux systems. BSI has updated multiple Linux Kernel advisories (WID-SEC-2026-1279, WID-SEC-2026-0861) in this period.

CVE-2026-39910 (NEW - EUROPEAN RELEVANCE)

  • Affected products: STACKIT IaaS API (German cloud provider STACKIT; exclusively hosted service, tagged as remediated)
  • Severity: Critical (CVSS 9.8; CWE-862 Missing Authorization)
  • Exploitation status: No confirmed exploitation; vendor has applied a fix per status.stackit.cloud
  • Technical detail: An authenticated low-privileged attacker could attach arbitrary high-privileged service accounts to virtual machines they control via an unvalidated PUT endpoint, then query the Instance Metadata Service to retrieve OAuth2 tokens. This allowed full organization-level compromise by bypassing tenant boundaries. Particularly relevant for German and European organizations using STACKIT cloud infrastructure.
  • Remediation: STACKIT has remediated the issue server-side. Customers should audit service account assignments and OAuth2 token usage logs for anomalous activity. Review VM configurations for unexpected service account attachments.

CVE-2026-11577 (NEW)

  • Affected products: Keycloak (all versions with Fine-Grained Admin Permissions enabled)
  • Severity: High (CVSS 7.2; CWE-863 Incorrect Authorization)
  • Exploitation status: No confirmed exploitation
  • Technical detail: A limited administrator can exploit improper access control in the POST /admin/realms/{realm}/partialImport endpoint to bypass Fine-Grained Admin Permissions and escalate to full realm administrator by importing users with realm-admin role mappings. Relevant to any organization using Keycloak as an identity provider with delegated administration.
  • Remediation: Apply available patches from Red Hat (see CVE-2026-11577 advisory). Restrict access to the partialImport endpoint. Audit realm administrator role assignments for unexpected escalations.

CVE-2026-3238 (NEW)

  • Affected products: Samba (WINS server component when running as Active Directory Domain Controller)
  • Severity: High (CVSS 7.5; CWE-476 NULL Pointer Dereference)
  • Exploitation status: No confirmed exploitation
  • Technical detail: Unauthenticated remote attacker can crash the WINS service via specially crafted UDP packets due to missing packet validation in WINS protocol handlers. Impact is limited to availability; no code execution.
  • Remediation: Apply Samba security update (see samba.org/samba/security/CVE-2026-3238.html). If WINS is not required, disable the service. Most modern AD environments do not require WINS.

ONGOING

  • CVE-2026-49494 (Comodo Internet Security): Public PoC available; block IPv6 at perimeter, monitor for patched driver release.
  • CVE-2026-20245 (Cisco Catalyst SD-WAN Manager): Actively exploited; restrict management plane access, no patch available.
  • CVE-2026-28318 (SolarWinds Serv-U): Actively exploited DoS; CISA deadline 2026-06-19, apply 15.5.4 Hotfix 1.
  • CVE-2026-3300 (Everest Forms Pro WordPress): Actively exploited RCE; update immediately.
  • CVE-2026-20230 (Cisco Unified CM): Public exploit available; patch immediately.
  • CVE-2026-45247 (Mirasvit Full Page Cache Warmer): Actively exploited; patch immediately.
  • CVE-2023-54352 / CVE-2024-58348 / CVE-2024-58349 (WordPress themes/plugins): Public exploits available; remove affected components immediately.

EUROPEAN ADVISORIES

BSI CERT-Bund - New Advisories (2026-06-08)

WID-SEC-2026-1814 (NEW): The BSI has published a new advisory for Netty, the widely used Java asynchronous networking framework. Multiple vulnerabilities allow a remote unauthenticated attacker to bypass security controls, manipulate data, disclose confidential information, or cause denial of service. Organizations using Netty in backend services, messaging infrastructure, or as a dependency in application servers should apply available patches promptly.

WID-SEC-2026-1813 (NEW): New advisory covering multiple stored cross-site scripting vulnerabilities in VMware Cloud Foundation, VMware Aria Operations, and VMware vSphere. An authenticated remote attacker could execute administrative actions via XSS. Organizations running VMware infrastructure should apply vendor patches and review administrative access controls.

WID-SEC-2026-1812 (NEW): New advisory for Kemp LoadMaster covering multiple vulnerabilities enabling security bypass, data manipulation, or arbitrary code execution. Kemp LoadMaster is used as an application delivery controller in enterprise environments. Apply vendor patches immediately.

WID-SEC-2026-1811 (NEW): New advisory for rclone. A remote unauthenticated attacker can exploit a vulnerability to execute arbitrary code with user privileges, disclose confidential information, or manipulate data depending on the rclone version in use. Organizations using rclone for cloud storage synchronization or backup should update to the latest version.

BSI CERT-Bund - Updated Advisories

Multiple existing advisories were updated on 2026-06-08, including Linux Kernel (WID-SEC-2026-1279, WID-SEC-2026-0861), Microsoft Developer Tools (WID-SEC-2026-1488), ImageMagick, IBM WebSphere Application Server, MariaDB, 7-Zip, NGINX, Mozilla Firefox/Thunderbird, Apache Tomcat, FreeRDP, PHP, GnuTLS, PostgreSQL, and others. These updates reflect new patch availability or scope changes; consult the BSI WID portal for current remediation status.

CERT-EU: No new advisories published in the last 24 hours.

ACTIVE THREATS AND CAMPAIGNS

VerdantBamboo / BRICKSTORM - BSD Variant on Linux Appliances (NEW) Volexity has attributed a new campaign to VerdantBamboo, a China-nexus espionage cluster overlapping with Clay Typhoon (Microsoft). The group is deploying a BSD variant of the BRICKSTORM backdoor alongside two newly identified malware families: PLENET (also tracked as GRIMBOLT) and AGENTPSD, targeting Linux network appliances and systems. This represents a platform expansion from previously observed Windows and VMware ESXi targeting. European organizations operating Linux-based network appliances, VPN concentrators, or edge devices should review for indicators of compromise. No specific IOCs were published in the available reporting; consult Volexity’s full disclosure for technical details.

UNC3753 - Vishing and Physical Intrusion Campaign (NEW) Google Mandiant and Google Threat Intelligence Group have published details of a financially motivated data theft and extortion campaign by UNC3753 (also known by other tracking names) active from January to May 2026. The group targeted dozens of organizations in professional, legal, and financial services in the United States using voice phishing (vishing) and physical intrusion techniques to gain initial access. While the primary targeting has been US-based, the tactics are directly applicable to European organizations in the same sectors. Security teams should brief reception and physical security staff on social engineering pretexting, and ensure that help desk authentication procedures cannot be bypassed via phone-based social engineering.

NSO Group / WhatsApp Spear-Phishing (NEW) Meta detected and blocked spear-phishing attempts linked to NSO Group targeting WhatsApp users via malicious links designed to redirect victims to external websites. Meta has filed a federal court contempt order against NSO Group for violating a permanent injunction. While this primarily affects high-value individual targets (journalists, activists, government officials), organizations with personnel in sensitive roles should be aware that commercial spyware operators continue to develop new delivery mechanisms despite legal constraints.

Miasma Worm - GitHub Supply Chain (ONGOING): 73 Microsoft GitHub repositories remain disabled; no new scope expansion. Continue auditing CI/CD pipelines.

OP-512 IIS Web Shell Campaign (ONGOING): China-linked cluster continues targeting IIS servers; no new developments.

IronWorm / npm Supply Chain (ONGOING): Rust-based infostealer via malicious npm packages; audit dependencies and monitor outbound connections from developer workstations.

PCPJack Cloud SMTP Relay Hijacking (ONGOING): Compromised cloud servers used as covert SMTP relay nodes; audit outbound SMTP from cloud infrastructure.

SECURITY NEWS AND CONTEXT

Linux Kernel CVE-2026-23111 Public Exploit: Exodus Intelligence published a full working exploit for the nf_tables use-after-free on June 8. The flaw was patched upstream in February 2026 but many distributions may still be running vulnerable kernels. Container escape capability makes this particularly urgent for Kubernetes and shared hosting environments.

VS Code Extension Auto-Update Delay: Microsoft has introduced a two-hour delay before VS Code extensions are automatically updated, providing a window for detection of malicious extension updates before they reach developer workstations. This is a direct response to supply chain attack patterns observed in recent months and complements the ongoing Miasma worm situation.

AI-Generated Phishing Volume: Industry reporting confirms that AI tooling is enabling attackers to generate high volumes of convincing phishing lures, significantly increasing Tier 1 SOC alert load. Organizations should evaluate AI-assisted triage tooling and review phishing detection rule tuning to manage analyst workload.

Weekly Recap Context: Last week’s threat landscape included poisoned packages, a GitHub worm, and email compromise campaigns that persisted undetected for months. The pattern of attackers dwelling in email infrastructure for extended periods underscores the importance of email audit log retention and periodic mailbox rule audits.

RECOMMENDED ACTIONS

  1. CHECK POINT VPN (CVE-2026-50751): Apply the Check Point hotfix (sk185033) immediately. CISA deadline is 2026-06-11. If patching is not possible before the deadline, disable IKEv1 and migrate to IKEv2. Audit VPN session logs for unauthenticated or anomalous connections.

  2. SAP JUNE PATCH DAY (CVE-2026-27671, CVE-2026-44748, CVE-2026-40128): Apply SAP Security Notes 3