# Weekly Situation Report — 6/15/26 2026-06-18 · Threat Brief Canonical: https://www.osec.com/resources/threat-briefs/weekly-situation-report-6-15-26 --- ## Key takeaways - A newly discovered Cisco SD-WAN zero-day vulnerability is actively exploited against enterprise networks - Verdant Panda (UNC5221) deploys multiple backdoors for sustained persistence in targeted intrusions - Nightmare Eclipse researchers unveiled RoguePlanet and greatXML exploits targeting fully patched Windows systems - ServiceNow breach exposed customer data through an unauthenticated API endpoint - Attackers exploit Ivanti Sentry pre-authentication OS command injection vulnerability CVE-2026-10520 - ShinyHunters group leaked staging infrastructure details, exposing operational components - Credential spraying attacks targeting Palo Alto GlobalProtect VPN hosts are increasing ## 1. New Cisco SD-WAN Zero-Day Exploited in Attacks **Summary** Cisco warned of an actively exploited high-severity zero-day vulnerability (CVE-2026-20245) in Cisco Catalyst SD-WAN Manager allowing low-privilege attackers to escalate to root through insufficient input validation. The vulnerability affects multiple deployment types with no patch currently available. **Category:** Zero-day **Industry:** Multiple **Analyst comments** The vulnerability stems from a command injection flaw resulting from insufficient input sanitation for uploaded files. Malicious commands are likely embedded in uploaded files, executed when processed with the -cli flag. This vulnerability could potentially chain with CVE-2026-20182 (disclosed May 2026), which has a public proof-of-concept and known wild exploitation. **Actionable guidance** No patch currently exists. Organizations should: - Restrict device access through ACLs - Apply patches for previously disclosed vulnerabilities that could enable netadmin access - Review `/var/log/scripts.log` for exploitation indicators ``` Fixed Versions: 20.18.3.1 26.1.1.2 Affected versions: 20.9.9.1 and earlier 20.12.7.1 and earlier 20.15.4.4 and earlier 20.15.5.2 and earlier 20.18.3 26.1.1.1 and earlier ``` ## 2. Verdant Panda (UNC5221) Uses Multiple Backdoors for Longterm Intrusions **Summary** Researchers discovered Chinese threat actor VerdantBamboo (WARP PANDA, UNC5221) compromised victims using malware including BRICKSTORM, AGENTPSD, and PLENET. The actor employed custom persistence mechanisms and living-off-the-land techniques for sustained network access. **Category:** State-Sponsored Espionage **Industry:** Technology, Government and Public Administration, Aerospace, Finance **Analyst comments** VerdantBamboo maintained access for over 18 months after compromising a storage appliance using stolen credentials and local privilege escalation flaws. The group deployed BRICKSTORM and Python fallback shell AGENTPSD, later adding PLENET compiled in .NET Native AOT. They deliberately targeted devices unlikely to have endpoint detection and response software installed and bypassed Microsoft 365 Conditional Access policies through VPN proxying. **Actionable guidance** Organizations should: - Rotate credentials and audit firewall/VPN appliance configurations - Review unknown cron jobs and network callouts from EDR-unprotected devices - Keep appliances and internet-exposed edge devices updated - Hunt for suspicious activity on devices without EDR agents ## 3. NIGHTMARE Eclipse Unveils RoguePlanet & greatXML Exploits Targeting Fully Patched Windows **Summary** Security researcher Nightmare Eclipse released proof-of-concept exploits for RoguePlanet (Microsoft Defender zero-day) and GreatXML (BitLocker bypass), both affecting fully patched Windows systems. RoguePlanet grants SYSTEM privileges through race condition exploitation. **Category:** Zero-day **Industry:** Multiple **Analyst comments** RoguePlanet exploits a local privilege escalation vulnerability in Defender, successfully tested against fully patched Windows 10 and 11 systems. Windows 11 systems proved more susceptible with higher exploitation success rates. The researcher claims additional undisclosed memory corruption vulnerabilities in Defender and other Windows components. GreatXML provides BitLocker security control bypass capabilities. **Actionable guidance** Organizations should: - Monitor for VSS and Defender core process forensic artifacts - Alert on stopped or disabled security processes indicating potential exploitation - Apply current patches while recognizing future weaponized variants may bypass defenses - Hunt for indicators associated with privilege escalation attempts ## 4. ServiceNow Breach Exposed Customer Data **Summary** ServiceNow disclosed a security incident where an unauthenticated API endpoint flaw allowed attackers to query sensitive customer data. Initial malicious attribution was later reconsidered as likely security research or bug bounty activity. **Category:** Critical Vulnerabilities **Industry:** Technology, Multiple **Analyst comments** The vulnerability existed in the `/api/now/related_list_edit/create` endpoint configured with `requires_authentication=false`. Attackers accessed sensitive enterprise data including IT support tickets and employee records. ServiceNow applied security updates June 5, 2026, restricting endpoint access to authenticated users. Activity originated from a single IP address. ``` 51.159.98.241 - AS12876 Scaleway SAS France ``` **Actionable guidance** Affected organizations should: - Audit exposed tickets and records for sensitive data - Rotate credentials and tokens passing through support workflows - Verify API logging is enabled - Alert on increased request volume to vulnerable endpoint from unknown IPs ## 5. Ivanti Sentry Pre-Auth OS Command Injection CVE-2026-10520 Exploited in Attacks **Summary** Ivanti published an advisory for two critical Sentry vulnerabilities: pre-authenticated OS Command Injection (CVE-2026-10520) and Authentication Bypass (CVE-2026-10523). Both enable unauthenticated attackers to achieve root-level access and create arbitrary administrative accounts. **Category:** Critical Vulnerabilities **Industry:** Multiple **Analyst comments** CVE-2026-10520 stems from lack of authentication on the vulnerable endpoint and failure to validate user input via user-supplied messages. The vulnerability has public proof-of-concept code enabling full weaponization. Confirmed exploitation occurs with backdoor deployment on vulnerable instances shortly after PoC disclosure. **Actionable guidance** Organizations should: - Immediately segregate hosts from the public internet - Apply the most recent vendor patches - Hunt for signs of prior exploitation or backdoor deployment - Monitor for requests to affected endpoint and "execute system…" strings ``` Affected Versions: 10.5.1, 10.6.1, 10.7.0 and prior Fixed Versions: 10.5.2, 10.6.2 and 10.7.1 ``` ## 6. ShinyHunters Leaked Staging Infrastructure **Summary** ShinyHunters attacks Oracle PeopleSoft servers, claiming theft of data from over 100 organizations across 300 instances, primarily in education. The group published data from Nottingham University on their leak site and deploys ransom notes post-breach. **Category:** Threat Actor Activities **Industry:** Business Services, Education, Retail, Technology **Analyst comments** ShinyHunters leverages a "gadget chain" of vulnerabilities, with CVE-2026-35273 reportedly being used to breach universities. The group deploys ransom note scripts targeting PeopleSoft with common administrative credentials like 'psoft' and 'oracle'. CVE-2026-35273 affects the HTTP interface and lacks a public proof-of-concept but reportedly involves simple exploitation methods. **Actionable guidance** Organizations should: - Apply recently issued patches for CVE-2026-35273 (PeopleSoft 8.61/8.62 users at risk) - Hunt for files matching signatures of unknown RMM software (MeshCentral commonly observed) - Monitor for large volumes of failed login attempts from unknown addresses - Add stale network indicators to blocklists for threat hunting --- ## Get the Complete Report The full Intelligence Desk brief includes exhaustive IOC lists, YARA detection rules, detailed remediation playbooks, and OSec's original threat research. Delivered weekly to partners and clients. [REQUEST ACCESS](https://37bwo.share.hsforms.com/2TER1cVRyS5CLsZ9-17_4Iw)