Staff

Outbreak Alert: Iran-linked Cyber Attacks

Forum|Forum|4 months ago
April 2, 2026
0 replies
425 views

FortiRecon Digital Risk Protection (DRP), a SaaS-based service, includes External Attack Surface Management, Brand Protection, and Adversary Centric Intelligence. Adversary Centric Intelligence (ACI): leverages FortiGuard Threat Analysis to provide comprehensive coverage of dark web, open-source, and technical threat intelligence, including threat actor insights to enable organizations to respond proactively assess risks, respond faster to incidents, better understand their attackers, and guard assets. The Vulnerability Intelligence Module under Adversary Centric Intelligence (ACI) provides a realistic view of the impact of the vulnerability based upon chatter and discussion of the same across various external sources such as Darkweb, social media, News / Blogs etc.
CVE ID	CVE-2026-20131
CVE Title	Cisco Secure Firewall Management Center (FMC) Software and Cisco Security Cloud Control (SCC) Firewall Management Deserialization of Untrusted Data Vulnerability
NVD Severity	CRITICAL
FortiRecon Severity	CRITICAL
FortiRecon Score	95/100
Epss Score	0.00595
Exploited	Yes
Exploited by Ransomware Group(s)	Yes (Interlock Ransomware Operator)
Exploited by APT Group(s)	No
Included in CISA KEV List	Yes
Available working exploit(s)	0
Available POC exploit(s)	3
Darknet Mention(s)	1 (underc0de)
Telegram Mention(s)	1 (Hacker's TOYS)
FortiRecon Intelligence Reporting(s)	11 (OSINT), 3 (FortiGuard Research), 1 (Technical Intelligence)
Vendor Advisory:	https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-20131 https://aws.amazon.com/blogs/security/amazon-threat-intelligence-teams-identify-interlock-ransomware-campaign-targeting-enterprise-firewalls/ https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fmc-rce-NKhnULJh

CVE ID	CVE-2026-20127
CVE Title	Cisco Catalyst SD-WAN Controller and Manager Authentication Bypass Vulnerability
NVD Severity	CRITICAL
FortiRecon Severity	CRITICAL
FortiRecon Score	95/100
Epss Score	0.01038
Exploited	Yes
Exploited by Ransomware Group(s)	No
Exploited by APT Group(s)	No
Included in CISA KEV List	Yes
Available working exploit(s)	0
Available POC exploit(s)	7
Darknet Mention(s)	2 (duty_free, underc0de)
Telegram Mention(s)	2 (Proxy Bar)
FortiRecon Intelligence Reporting(s)	14 (OSINT), 4 (FortiGuard Research)
Vendor Advisory:	https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-rpa-EHchtZk https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-20127

CVE ID	CVE-2026-1731
CVE Title	BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA) OS Command Injection Vulnerability
NVD Severity	CRITICAL
FortiRecon Severity	CRITICAL
FortiRecon Score	95/100
Epss Score	0.74328
Exploited	Yes
Exploited by Ransomware Group(s)	No
Exploited by APT Group(s)	Yes (Silk Typhoon, MuddyWater)
Included in CISA KEV List	Yes
Available working exploit(s)	0
Available POC exploit(s)	7
Darknet Mention(s)	0
Telegram Mention(s)	1 (Proxy Bar)
FortiRecon Intelligence Reporting(s)	2 (Technical Intelligence), 11 (OSINT), 1 (Darknet), 1 (HUMINT), 10 (FortiGuard Research)
Vendor Advisory:	https://www.greynoise.io/blog/reconnaissance-beyondtrust-rce-cve-2026-1731 https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-1731 https://github.com/win3zz/CVE-2026-1731 https://beyondtrustcorp.service-now.com/csm?id=csm_kb_article&sysparm_article=KB0023293 https://www.beyondtrust.com/trust-center/security-advisories/bt26-02

CVE ID	CVE-2026-1340
CVE Title	A code injection in Ivanti Endpoint Manager Mobile allowing attackers...
NVD Severity	CRITICAL
FortiRecon Severity	CRITICAL
FortiRecon Score	95/100
Epss Score	0.64618
Exploited	Yes
Exploited by Ransomware Group(s)	No
Exploited by APT Group(s)	No
Included in CISA KEV List	No
Available working exploit(s)	0
Available POC exploit(s)	2
Darknet Mention(s)	7 (xss, breachforums)
Telegram Mention(s)	0
FortiRecon Intelligence Reporting(s)	1 (Darknet), 7 (OSINT), 3 (Technical Intelligence), 5 (FortiGuard Research)
Vendor Advisory:	https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Endpoint-Manager-Mobile-EPMM-CVE-2026-1281-CVE-2026-1340

CVE ID	CVE-2026-1281
CVE Title	Ivanti Endpoint Manager Mobile (EPMM) Code Injection Vulnerability
NVD Severity	CRITICAL
FortiRecon Severity	CRITICAL
FortiRecon Score	95/100
Epss Score	0.73362
Exploited	Yes
Exploited by Ransomware Group(s)	No
Exploited by APT Group(s)	Yes (MuddyWater)
Included in CISA KEV List	Yes
Available working exploit(s)	0
Available POC exploit(s)	2
Darknet Mention(s)	7 (xss, breachforums)
Telegram Mention(s)	1 (Proxy Bar)
FortiRecon Intelligence Reporting(s)	10 (OSINT), 1 (Darknet), 5 (Technical Intelligence), 9 (FortiGuard Research)
Vendor Advisory:	https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-1281 https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Endpoint-Manager-Mobile-EPMM-CVE-2026-1281-CVE-2026-1340

CVE ID	CVE-2025-61882
CVE Title	Oracle E-Business Suite Unspecified Vulnerability
NVD Severity	CRITICAL
FortiRecon Severity	CRITICAL
FortiRecon Score	91/100
Epss Score	0.88801
Exploited	Yes
Exploited by Ransomware Group(s)	Yes (Cl0p Ransomware Operators, FIN11, CL0P Ransomware Group, Clop Ransomware Group)
Exploited by APT Group(s)	Yes (QuietCrabs, Qilin)
Included in CISA KEV List	Yes
Available working exploit(s)	0
Available POC exploit(s)	14
Darknet Mention(s)	35 (crdclub, xss, rehub, exploit, underc0de)
Telegram Mention(s)	3 (Proxy Bar, SLSH 6.0 part 3 - lapsus$hiny$scatteredwizard)
FortiRecon Intelligence Reporting(s)	9 (Darknet), 23 (OSINT), 7 (Technical Intelligence), 18 (FortiGuard Research)
Vendor Advisory:	https://www.crowdstrike.com/en-us/blog/crowdstrike-identifies-campaign-targeting-oracle-e-business-suite-zero-day-CVE-2025-61882/ https://blogs.oracle.com/security/post/apply-july-2025-cpu https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-61882 https://www.oracle.com/security-alerts/alert-cve-2025-61882.html

CVE ID	CVE-2025-61757
CVE Title	Oracle Fusion Middleware Missing Authentication for Critical Function Vulnerability
NVD Severity	CRITICAL
FortiRecon Severity	CRITICAL
FortiRecon Score	90/100
Epss Score	0.87758
Exploited	Yes
Exploited by Ransomware Group(s)	Yes (CL0P Ransomware Group)
Exploited by APT Group(s)	No
Included in CISA KEV List	Yes
Available working exploit(s)	0
Available POC exploit(s)	2
Darknet Mention(s)	0
Telegram Mention(s)	0
FortiRecon Intelligence Reporting(s)	1 (Technical Intelligence), 9 (OSINT), 6 (FortiGuard Research)
Vendor Advisory:	https://www.oracle.com/security-alerts/cpuoct2025.html https://isc.sans.edu/diary/rss/32506 https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-61757

CVE ID	CVE-2025-59287
CVE Title	Microsoft Windows Server Update Service (WSUS) Deserialization of Untrusted Data Vulnerability
NVD Severity	CRITICAL
FortiRecon Severity	CRITICAL
FortiRecon Score	91/100
Epss Score	0.71617
Exploited	Yes
Exploited by Ransomware Group(s)	No
Exploited by APT Group(s)	Yes
Included in CISA KEV List	Yes
Available working exploit(s)	0
Available POC exploit(s)	27
Darknet Mention(s)	10 (rehub, ramp, duty_free, underc0de)
Telegram Mention(s)	5 (⁪, Proxy Bar, LΣҒΔ𝕽ΩLL :israel:)
FortiRecon Intelligence Reporting(s)	6 (Darknet), 3 (Technical Intelligence), 19 (OSINT), 12 (FortiGuard Research)
Vendor Advisory:	https://www.vicarius.io/vsociety/posts/cve-2025-59287-mitigation-script-rce-vulnerability-in-windows-server-update-service https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-59287 https://www.bleepingcomputer.com/news/security/cisa-orders-feds-to-patch-windows-server-wsus-flaw-exploited-in-attacks/ https://hawktrace.com/blog/CVE-2025-59287 https://www.vicarius.io/vsociety/posts/cve-2025-59287-detection-script-rce-vulnerability-in-windows-server-update-service https://gist.github.com/hawktrace/880b54fb9c07ddb028baaae401bd3951 https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-59287

CVE ID	CVE-2025-5777
CVE Title	Citrix NetScaler ADC and Gateway Out-of-Bounds Read Vulnerability
NVD Severity	HIGH
FortiRecon Severity	CRITICAL
FortiRecon Score	92/100
Epss Score	0.69815
Exploited	Yes
Exploited by Ransomware Group(s)	No
Exploited by APT Group(s)	Yes (MuddyWater)
Included in CISA KEV List	Yes
Available working exploit(s)	1
Available POC exploit(s)	0
Darknet Mention(s)	23 (exploit, ramp, xssf, damagelib)
Telegram Mention(s)	4 (Ralf Hacker Channel, Волосатый бублик, Proxy Bar)
FortiRecon Intelligence Reporting(s)	2 (Darknet), 21 (OSINT), 14 (FortiGuard Research), 1 (Technical Intelligence)
Vendor Advisory:	https://labs.watchtowr.com/how-much-more-must-we-bleed-citrix-netscaler-memory-disclosure-citrixbleed-2-cve-2025-5777/ https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-5777 https://horizon3.ai/attack-research/attack-blogs/cve-2025-5777-citrixbleed-2-write-up-maybe/ https://reliaquest.com/blog/threat-spotlight-citrix-bleed-2-vulnerability-in-netscaler-adc-gateway-devices/ https://www.theregister.com/2025/07/10/cisa_citrixbleed_kev/ https://www.bleepingcomputer.com/news/security/cisa-tags-citrix-bleed-2-as-exploited-gives-agencies-a-day-to-patch/ https://www.netscaler.com/blog/news/netscaler-critical-security-updates-for-cve-2025-6543-and-cve-2025-5777/ https://citrixbleed.com https://doublepulsar.com/citrixbleed-2-exploitation-started-mid-june-how-to-spot-it-f3106392aa71 https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX693420

CVE ID	CVE-2025-55182
CVE Title	Meta React Server Components Remote Code Execution Vulnerability
NVD Severity	CRITICAL
FortiRecon Severity	CRITICAL
FortiRecon Score	95/100
Epss Score	0.65077
Exploited	Yes
Exploited by Ransomware Group(s)	Yes (CL0P Ransomware Group)
Exploited by APT Group(s)	Yes (UNC5454, UNC5342, Qilin, MuddyWater)
Included in CISA KEV List	Yes
Available working exploit(s)	0
Available POC exploit(s)	450
Darknet Mention(s)	79 (crdclub, exploit, underc0de, duty_free, darkmarket, crimestate, damagelib, gerki, darkforums)
Telegram Mention(s)	18 (maulnism1337, 404 CREW CYBER TEAM Chat, Proxy Bar, I҉n҉v҉e҉s҉t҉i҉g҉a҉t҉i҉o҉n҉ A҉n҉o҉n҉Y҉m҉o҉u҉s҉, 313 Team, Linuxor ?, NNM057(16) eng vers, We Leak Database, Cyber Fattah team, Ralf Hacker Channel, 404 CREW CYBER TEAM, Chat Cyber Islamic resistance, Cyber Islamic resistance-Axis:palestinian_territories:)
FortiRecon Intelligence Reporting(s)	8 (Darknet), 29 (Technical Intelligence), 29 (OSINT), 20 (FortiGuard Research)
Vendor Advisory:	https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-55182 https://news.ycombinator.com/item?id=46136026 https://react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components https://aws.amazon.com/blogs/security/china-nexus-cyber-threat-groups-rapidly-exploit-react2shell-vulnerability-cve-2025-55182/ http://www.openwall.com/lists/oss-security/2025/12/03/4 https://www.facebook.com/security/advisories/cve-2025-55182

CVE ID	CVE-2025-52691
CVE Title	SmarterTools SmarterMail Unrestricted Upload of File with Dangerous Type Vulnerability
NVD Severity	CRITICAL
FortiRecon Severity	CRITICAL
FortiRecon Score	95/100
Epss Score	0.8729
Exploited	Yes
Exploited by Ransomware Group(s)	Yes
Exploited by APT Group(s)	Yes (MuddyWater)
Included in CISA KEV List	Yes
Available working exploit(s)	0
Available POC exploit(s)	10
Darknet Mention(s)	2 (crdclub, underc0de)
Telegram Mention(s)	3 (Rakyat Digital Crew, wickzzoy, TikusXploit)
FortiRecon Intelligence Reporting(s)	4 (FortiGuard Research), 7 (OSINT), 1 (Darknet), 1 (Technical Intelligence)
Vendor Advisory:	https://github.com/watchtowrlabs/watchTowr-vs-SmarterMail-CVE-2025-52691?ref=labs.watchtowr.com https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-52691 https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2025-124/

CVE ID	CVE-2025-24016
CVE Title	Wazuh Server Deserialization of Untrusted Data Vulnerability
NVD Severity	CRITICAL
FortiRecon Severity	CRITICAL
FortiRecon Score	91/100
Epss Score	0.93874
Exploited	Yes
Exploited by Ransomware Group(s)	Yes (FunkSec)
Exploited by APT Group(s)	No
Included in CISA KEV List	Yes
Available working exploit(s)	0
Available POC exploit(s)	8
Darknet Mention(s)	1 (xss)
Telegram Mention(s)	1 (Proxy Bar)
FortiRecon Intelligence Reporting(s)	5 (OSINT), 4 (Technical Intelligence), 5 (FortiGuard Research)
Vendor Advisory:	https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-24016 https://github.com/wazuh/wazuh/security/advisories/GHSA-hcrc-79hj-m3qh

CVE ID	CVE-2025-13223
CVE Title	Google Chromium V8 Type Confusion Vulnerability
NVD Severity	HIGH
FortiRecon Severity	HIGH
FortiRecon Score	70/100
Epss Score	0.02686
Exploited	Yes
Exploited by Ransomware Group(s)	No
Exploited by APT Group(s)	No
Included in CISA KEV List	Yes
Available working exploit(s)	0
Available POC exploit(s)	0
Darknet Mention(s)	1 (underc0de)
Telegram Mention(s)	0
FortiRecon Intelligence Reporting(s)	9 (OSINT), 1 (FortiGuard Research)
Vendor Advisory:	https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-13223 https://chromereleases.googleblog.com/2025/11/stable-channel-update-for-desktop_17.html https://issues.chromium.org/issues/460017370

CVE ID	CVE-2023-36899
CVE Title	ASP.NET Elevation of Privilege Vulnerability
NVD Severity	HIGH
FortiRecon Severity	MEDIUM
FortiRecon Score	65/100
Epss Score	0.70037
Exploited	No
Exploited by Ransomware Group(s)	No
Exploited by APT Group(s)	No
Included in CISA KEV List	No
Available working exploit(s)	0
Available POC exploit(s)	2
Darknet Mention(s)	0
Telegram Mention(s)	0
FortiRecon Intelligence Reporting(s)	1 (FortiGuard Research)
Vendor Advisory:	https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36899

CVE ID	CVE-2023-29552
CVE Title	Service Location Protocol (SLP) Denial-of-Service Vulnerability
NVD Severity	HIGH
FortiRecon Severity	CRITICAL
FortiRecon Score	90/100
Epss Score	0.92962
Exploited	Yes
Exploited by Ransomware Group(s)	No
Exploited by APT Group(s)	No
Included in CISA KEV List	Yes
Available working exploit(s)	0
Available POC exploit(s)	0
Darknet Mention(s)	0
Telegram Mention(s)	0
FortiRecon Intelligence Reporting(s)	2 (OSINT), 1 (FortiGuard Research)
Vendor Advisory:	https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-29552 https://blogs.vmware.com/security/2023/04/vmware-response-to-cve-2023-29552-reflective-denial-of-service-dos-amplification-vulnerability-in-slp.html https://security.netapp.com/advisory/ntap-20230426-0001/ https://www.cisa.gov/news-events/alerts/2023/04/25/abuse-service-location-protocol-may-lead-dos-attacks https://datatracker.ietf.org/doc/html/rfc2608 https://curesec.com/blog/article/CVE-2023-29552-Service-Location-Protocol-Denial-of-Service-Amplification-Attack-212.html https://www.bitsight.com/blog/new-high-severity-vulnerability-cve-2023-29552-discovered-service-location-protocol-slp https://github.com/curesec/slpload https://www.suse.com/support/kb/doc/?id=000021051

CVE ID	CVE-2021-45046
CVE Title	Apache Log4j2 Deserialization of Untrusted Data Vulnerability
NVD Severity	CRITICAL
FortiRecon Severity	CRITICAL
FortiRecon Score	92/100
Epss Score	0.9434
Exploited	Yes
Exploited by Ransomware Group(s)	Yes (Wazawaka, Avos ransomware group)
Exploited by APT Group(s)	Yes (TunnelVision, Magic Hound, COBALT MIRAGE, DEV-0270, TEMP.Zagros)
Included in CISA KEV List	Yes
Available working exploit(s)	2
Available POC exploit(s)	49
Darknet Mention(s)	2 (ramp)
Telegram Mention(s)	2 (Hacking tools y tal)
FortiRecon Intelligence Reporting(s)	13 (OSINT), 11 (FortiGuard Research), 18 (Technical Intelligence)
Vendor Advisory:	https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00646.html https://cert-portal.siemens.com/productcert/pdf/ssa-714170.pdf https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0032 https://cert-portal.siemens.com/productcert/pdf/ssa-479842.pdf https://cert-portal.siemens.com/productcert/pdf/ssa-397453.pdf https://www.kb.cert.org/vuls/id/930724 https://www.oracle.com/security-alerts/cpujan2022.html https://www.debian.org/security/2021/dsa-5022 https://cert-portal.siemens.com/productcert/pdf/ssa-661247.pdf https://www.cve.org/CVERecord?id=CVE-2021-44228 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EOKPQGV24RRBBI4TBZUDQMM4MEH7MXCY/ https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SIG7FZULMNK2XF6FZRU4VWYDQXNMUGAJ/ https://www.oracle.com/security-alerts/alert-cve-2021-44228.html https://security.gentoo.org/glsa/202310-16 http://www.openwall.com/lists/oss-security/2021/12/14/4 https://www.oracle.com/security-alerts/cpujul2022.html http://www.openwall.com/lists/oss-security/2021/12/15/3 https://www.oracle.com/security-alerts/cpuapr2022.html https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-log4j-qRuKNEbd https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-45046 http://www.openwall.com/lists/oss-security/2021/12/18/1 https://logging.apache.org/log4j/2.x/security.html

Thought Leadership Security Summit. Outpace New Threats with AI - enhanced defense. Tuesday, Septmeber 15, 8:30 AM - 2:30 PM PT. The Golf Club at Newcastle, WA.

Fortinet Flag the Hack. Wednesday, August 26, 9:00 AM - 5:00 PM ET, COSM, Atlanta, GA.

Virtual event | September 2026. SASE summit. The age of autonomous trust. Register here!

CVE ID	CVE-2021-44228
CVE Title	Apache Log4j2 Remote Code Execution Vulnerability
NVD Severity	CRITICAL
FortiRecon Severity	CRITICAL
FortiRecon Score	95/100
Epss Score	0.94358
Exploited	Yes
Exploited by Ransomware Group(s)	Yes (Mimo, AvosLocker Ransomware Operators, EMPEROR DRAGONFLY, Karakurt Ransomware Operators, Khonsari Ransomware, DEV-0270, TellYouThePass Ransomware Operators, Black Basta Ransomware Group, DragonForce Ransomware Operator, Wazawaka, Avos ransomware group)
Exploited by APT Group(s)	Yes (Andariel, APT38, TA453, COBALT MIRAGE, DEV-0270, TunnelVision, Deep Panda, Stonefly, GOP, Parastoo, Operation DarkSeoul, Teal Kurma, Magic Hound, Onyx Sleet, APT41, TEMP.Zagros, Budworm, Winnti Umbrella)
Included in CISA KEV List	Yes
Available working exploit(s)	17
Available POC exploit(s)	489
Darknet Mention(s)	19 (raidforums, xss, exploit, breachforums, ramp, imhatimi, duty_free, validmarket)
Telegram Mention(s)	10 (Hacking tools y tal, DC8044 F33d, Stega Intelligence, Systemadminbd Official (BCF), Exploit Developers, Ralf Hacker Channel)
FortiRecon Intelligence Reporting(s)	59 (Technical Intelligence), 35 (OSINT), 3 (Darknet), 3 (HUMINT), 48 (FortiGuard Research)