Daily Threat Briefing
← All briefings

Cisco Catalyst SD-WAN Manager · PAN-OS GlobalProtect portal and gateway components · elixir-grpc grpc

DAILY THREAT INTELLIGENCE BRIEFING Date: 2026-06-16 Prepared for: SOC Analysts | Incident Responders | Vulnerability Management | Security Leadership

EXECUTIVE SUMMARY

Three high-priority items dominate today’s briefing: Cisco Catalyst SD-WAN Manager CVE-2026-20262 has been added to the CISA KEV with a confirmed zero-day exploitation history and a June 29 remediation deadline; Palo Alto PAN-OS GlobalProtect CVE-2026-0257 is under active exploitation by an unknown threat actor; and a China-linked espionage group has been confirmed operating inside North American medical, academic, and military research networks for over a year, using REDCap server backdoors and Google Workspace rule manipulation for stealthy exfiltration.

CRITICAL VULNERABILITIES

CVE-2026-20262 (Cisco Catalyst SD-WAN Manager)

  • Affected products: Cisco Catalyst SD-WAN Manager (formerly vManage)
  • Severity: CVSS not yet published; CISA KEV confirmed
  • EPSS: Not yet scored
  • Technical detail: A directory or path traversal vulnerability allows an authenticated remote attacker to create or overwrite arbitrary files on the filesystem of an affected system. Exploitation has been confirmed in zero-day attacks, with Cisco reporting the flaw was used to escalate privileges to root. SD-WAN Manager is a centralized orchestration platform; filesystem write access at this level can enable persistent backdoors, configuration tampering, or full infrastructure takeover across managed SD-WAN fabric.
  • Exploitation status: Confirmed exploited in the wild (zero-day). Added to CISA KEV 2026-06-15. CISA remediation deadline: 2026-06-29.
  • Remediation: Apply Cisco security updates immediately. Review SD-WAN Manager access logs for unauthorized file creation or modification events. Restrict management plane access to trusted administrative networks only.

CVE-2026-0257 (Palo Alto PAN-OS GlobalProtect)

  • Affected products: PAN-OS GlobalProtect portal and gateway components
  • Severity: CVSS 7.8
  • EPSS: Not yet scored
  • Technical detail: An authentication bypass flaw in the GlobalProtect portal and gateway allows an unauthenticated remote attacker to gain unauthorized access. Palo Alto has confirmed active exploitation by an unknown threat actor. GlobalProtect is widely deployed as a VPN solution in enterprise environments, making this a high-value target for initial access. The authentication bypass nature of the flaw means no credentials are required, lowering the bar for exploitation significantly.
  • Exploitation status: Actively exploited in the wild. Palo Alto confirmed exploitation as of 2026-06-15.
  • Remediation: Apply PAN-OS patches immediately. Enable Threat Prevention signatures if available. Review GlobalProtect access logs for anomalous authentication patterns and unexpected source IPs. Consider temporarily restricting portal exposure if patching cannot be completed immediately.

CVE-2026-48853 (elixir-grpc gRPC — Elixir)

  • Affected products: elixir-grpc grpc versions 0.4.0 through 0.x (before 1.0.0)
  • Severity: CVSS 9.2
  • EPSS: 0.00 (newly published)
  • Technical detail: The Erlpack codec calls :erlang.binary_to_term/1 on raw gRPC message bodies without the :safe option, no size bound, and no type guard. Any unauthenticated peer sending a request with Content-Type application/grpc+erlpack can exhaust the BEAM atom table (crashing the VM) or encode a fun term that executes attacker-controlled code inside the server process. Two companion CVEs affect the same library: CVE-2026-53430 (CVSS 8.7) enables a gzip decompression bomb DoS via unbounded :zlib.gunzip/1 calls, and CVE-2026-48854 (CVSS 8.7) allows memory exhaustion via slow-trickle unary request bodies with no size cap or timeout.
  • Exploitation status: No confirmed exploitation; newly published. High severity warrants immediate attention in any Elixir-based microservice or API gateway environment.
  • Remediation: Upgrade elixir-grpc to version 1.0.0. Audit all gRPC service deployments using the Elixir library. Apply network-level controls to restrict gRPC endpoint exposure to trusted clients pending upgrade.

CVE-2026-47825 (VMware Spring Cloud Gateway)

  • Affected products: Spring Cloud Gateway 3.1.x (before 3.1.13), 4.1.x (before 4.1.13), 4.2.x (before 4.2.9), 4.3.x (before 4.3.5), 5.0.x (before 5.0.2)
  • Severity: CVSS 8.6
  • EPSS: 0.00 (newly published)
  • Technical detail: Spring Cloud Gateway forwards X-Forwarded-For and Forwarded headers from untrusted proxies in certain configuration scenarios, affecting both WebMVC and WebFlux deployments. This can allow an attacker to spoof client IP addresses, bypass IP-based access controls, or manipulate request routing logic. The flaw affects a broad range of actively maintained versions across a widely deployed enterprise API gateway product.
  • Exploitation status: No confirmed exploitation. Newly published.
  • Remediation: Upgrade to the fixed versions per affected branch (3.1.13, 4.1.13, 4.2.9, 4.3.5, or 5.0.2). Review gateway configurations for reliance on forwarded header trust. Apply trusted proxy allowlists where header forwarding is required.

CVE-2026-54420 (LiteSpeed cPanel Plugin)

  • STATUS CHANGE: CISA KEV deadline is 2026-06-18 — three days remaining. Patch to cPanel plugin 2.4.8 and WHM Plugin 5.3.2.0 without delay. Full entry in yesterday’s report.

ONGOING

  • CVE-2026-12187 / CVE-2026-12186 (GL.iNet GL-MT3000): Public exploits available; upgrade firmware to 4.7 or disable remote management.
  • CVE-2026-12197 (Ruijie EG105G-P): Public exploit available; restrict diagnostic API via firewall.
  • CVE-2026-20253 (Splunk Enterprise): Update to 10.2.4 or 10.0.7; restrict management interfaces.
  • CVE-2026-42271 (BerriAI LiteLLM): KEV deadline 2026-06-22; upgrade to v1.83.7-stable.
  • CVE-2026-5027 (Langflow): Actively exploited; isolate from internet.
  • CVE-2026-50751 (Check Point Security Gateway): Actively exploited; apply hotfix sk185033.
  • CVE-2026-11645 (Google Chrome V8): Actively exploited; update to 149.0.7827.103 or later.

EUROPEAN ADVISORIES

BSI published a high volume of advisories on 2026-06-15 covering updates and new findings across multiple product families. New advisories include:

WID-SEC-2026-1924 (Aqua Security Trivy): A new high-severity advisory covers a file manipulation vulnerability exploitable by an unauthenticated remote attacker. Organizations using Trivy in CI/CD pipelines or container security workflows should apply the available update promptly.

WID-SEC-2026-1918 (Snipe-IT): A new high-severity advisory covers multiple vulnerabilities allowing authenticated remote attackers to gain administrative privileges, bypass security controls, and manipulate data. Snipe-IT is widely used for IT asset management; apply the latest update and review user privilege assignments.

WID-SEC-2026-1915 (Grafana): A new high-severity advisory covers a privilege escalation vulnerability exploitable by authenticated remote attackers. Grafana is broadly deployed in European enterprise monitoring environments. Update to the patched release and audit user role assignments.

WID-SEC-2026-1910 (Devolutions Remote Desktop Manager): A new high-severity advisory covers multiple vulnerabilities enabling authenticated remote code execution and sensitive information disclosure. Remote Desktop Manager is common in managed service provider and enterprise IT environments; apply the vendor update immediately.

WID-SEC-2026-1913 (OpenClaw): A new high-severity advisory covers multiple vulnerabilities allowing authenticated attackers to bypass security controls, manipulate data, and execute arbitrary code. An update advisory for the same product (WID-SEC-2026-1738) was also published.

BSI also published update advisories for Linux Kernel (multiple), PostgreSQL, Samba, MariaDB, Oracle MySQL, OpenSSL, Apache HTTP Server, Splunk Enterprise, Netty, IBM WebSphere Application Server, strongSwan, Zoom, AMD/EPYC processors, Google Chrome/Edge, Microsoft Developer Tools, HTTP/2 implementations, and vm2 (kritisch). Apply vendor patches per prior guidance. Critical items are detailed in the Critical Vulnerabilities section where applicable.

ACTIVE THREATS AND CAMPAIGNS

China-Linked REDCap Espionage Campaign (NEW): A China-linked espionage group maintained persistent access inside North American medical, academic, and military research networks for more than a year. Initial access was achieved via a backdoor deployed on internet-exposed REDCap research data management servers, which harvested login credentials. The distinctive exfiltration technique involved manipulating victims’ own Google Workspace email forwarding rules to silently copy sensitive research and defense-related messages to attacker-controlled addresses. The malware used has been identified as InfiniteRed. Organizations running REDCap should audit server integrity, review Google Workspace forwarding rules for unauthorized entries, and rotate credentials. This campaign is relevant to European research institutions and universities using REDCap.

North Korean Contagious Interview Developer Lure Campaign (NEW): Proofpoint has identified two active phishing campaigns attributed to the North Korean cluster Contagious Interview (also tracked as Famous Chollima, HexagonalRodent, Void Dokkaebi). The campaigns use developer recruitment and code review themes to deliver malware via developer tooling. Organizations with software development teams should brief staff on this lure pattern and monitor for suspicious package installations or IDE plugin activity.

ShinyHunters Oracle PeopleSoft Exploitation (NEW): The ShinyHunters extortion group is actively exploiting the critical Oracle PeopleSoft vulnerability disclosed last weekend. The group has also claimed a data breach against the Council of Europe, which is now under investigation, and previously stole data from 137,000 school staff accounts via a Salesforce attack on Infinite Campus. ShinyHunters represents an active and opportunistic threat to European institutions.

WordPress CDN Supply Chain Attack (NEW): Attackers compromised the Awesome Motive CDN, tampering with JavaScript files served to sites running PushEngage, OptinMonster, and TrustPulse plugins. When a logged-in administrator loaded the tampered file, the code created a hidden admin account and installed a backdoor plugin. WordPress site operators using these plugins should audit admin accounts, review installed plugins, and verify CDN file integrity.

Arch Linux AUR Supply Chain Attack — ONGOING: Audit AUR builds and CI/CD pipelines for Rust infostealer and eBPF rootkit indicators.

SECURITY NEWS AND CONTEXT

Microsoft 365 Copilot SearchLeak: Varonis Threat Labs disclosed a three-bug chain dubbed SearchLeak that could allow a one-click exfiltration of emails, calendar data, and indexed files from Microsoft 365 Copilot Enterprise Search via a crafted microsoft.com URL. Microsoft has been notified; verify patch status and review Copilot access controls.

phpBB critical authentication bypass: A critical flaw in phpBB allows login as any registered user including administrators; a patch is available. Organizations running phpBB should update immediately — this was first reported yesterday and remains unpatched in many deployments.

SimpleHelp OIDC account creation flaw: A newly disclosed vulnerability in SimpleHelp remote management software allows unauthenticated attackers to create privileged technician accounts on servers using OpenID Connect authentication. Operators should apply the vendor fix and audit technician account lists.

RECOMMENDED ACTIONS

  1. Patch Cisco Catalyst SD-WAN Manager CVE-2026-20262 immediately — confirmed zero-day exploitation, CISA KEV deadline 2026-06-29.
  2. Apply PAN-OS patches for CVE-2026-0257 without delay — active exploitation of GlobalProtect authentication bypass confirmed.
  3. Upgrade elixir-grpc to version 1.0.0 to address CVE-2026-48853, CVE-2026-53430, and CVE-2026-48854 in Elixir gRPC deployments.
  4. Update Spring Cloud Gateway to the fixed version for your branch (CVE-2026-47825) and restrict forwarded header trust.
  5. Patch LiteSpeed cPanel plugin to 2.4.8 and WHM Plugin to 5.3.2.0 before the CISA KEV deadline of 2026-06-18.
  6. Audit REDCap server integrity and Google Workspace email forwarding rules for unauthorized entries; rotate credentials on affected research systems.
  7. Inspect WordPress admin accounts and installed plugins on sites running PushEngage, OptinMonster, or TrustPulse for signs of CDN supply chain compromise.
  8. Apply SimpleHelp update and audit technician accounts for unauthorized entries created via OIDC.
  9. Update Grafana, Snipe-IT, Devolutions Remote Desktop Manager, and Aqua Security Trivy per new BSI advisories.
  10. Continue remediation of previously reported items: GL.iNet CVE-2026-12187/12186, Ruijie CVE-2026-12197, Splunk CVE-2026-20253, LiteLLM CVE-2026-42271, Langflow CVE-2026-5027, Check Point CVE-2026-50751, Chrome CVE-2026-11645.