Network-Security

Multiple Barracuda appliance products are affected by pre-authentication authorization bypass and command injection vulnerabilities that may allow unauthenticated remote attackers to execute arbitrary commands.

A critical, unpatched vulnerability in Linksys routers allows remote, unauthenticated attackers to escalate privileges to administrator, disclose sensitive information, manipulate files, or trigger a denial-of-service.

Suricata versions prior to 8.0.8 contain multiple high-severity vulnerabilities in protocol processing that can lead to memory exhaustion, CPU exhaustion, or service crashes.

OPNsense contains a vulnerability that allows a remote, authenticated attacker to execute arbitrary code with administrator privileges.

Cisco patched an actively exploited logic vulnerability (CVE-2026-76418) in the SSL VPN service of ASA and FTD software that allows unauthenticated attackers to trigger a device reload and denial-of-service condition.

An exposed dangerous function in the Alpine iLX-F511 Framework Service allows unauthenticated, network-adjacent attackers to achieve remote code execution as root.

A missing authentication vulnerability in Juniper Networks Session Smart Router allows unauthenticated network-based attackers to escalate privileges via crafted URL parameters on non-onboarded devices.

A stack-based buffer overflow in WatchGuard Fireware OS allows remote attackers to trigger a DoS or execute arbitrary code by tampering with FireCloud Gateway configuration payloads via man-in-the-middle attacks.

Tailscale versions prior to 1.104.4 contain multiple vulnerabilities in SSH socket forwarding and service handling that could allow authenticated users to escalate privileges to root on targeted nodes.

Fortinet has released security hardening updates for FortiAnalyzer, FortiAuthenticator, FortiMail, FortiManager, and FortiOS to address multiple vulnerabilities.

Multiple vulnerabilities in Cisco IOS XE, Secure Firewall Threat Defense (SFTD), and Snort allow attackers to execute arbitrary code, bypass security controls, or cause a denial-of-service condition.

An unauthenticated remote code execution vulnerability (CVE-2026-53921) in the OpenWrt DHCPv6 server component odhcpd allows attackers to execute code with root privileges via crafted DHCPv6 requests.

MikroTik RouterOS versions 7.24.5 and earlier contain a session token replay vulnerability in the WebFig interface that allows unauthenticated attackers to hijack administrative sessions.

Cisco released security hardening updates for the Snort 3 engine to address multiple internally discovered vulnerabilities, including out-of-bounds write issues categorized as CWE-787.

An OS command injection vulnerability in the TOTOLINK X2000R router allows an authenticated attacker to execute arbitrary system commands via the boa formPasswordSetup function.

A logic error in the Stormshield Network Security (SNS) dynamic data file signature verification routine allows attackers to bypass validation and inject unauthenticated updates during the autoupdate process.

Multiple vulnerabilities identified in Stormshield Network Security firmware may allow remote attackers to bypass security policies, manipulate data integrity, or conduct cross-site scripting (XSS) attacks.

This brief provides detection logic for identifying network traffic associated with dual-use remote access tools like AnyDesk, TeamViewer, and LogMeIn within Cisco Secure Firewall logs.

This brief details the detection of potential reverse shell and C2 communication attempts by identifying outbound traffic over non-standard, suspicious port patterns within Cisco Secure Firewall logs.

Threat actors are employing the LegionRelay command-and-control framework to facilitate malicious operations against organizations within Ukraine, necessitating network-based detection for C2 traffic.

CISA Malcolm versions v26.07.1 and earlier contain multiple high-severity vulnerabilities, including authentication bypass, SSRF, and authorization flaws, allowing unauthenticated or low-privileged users to gain administrative control.

A heap-based buffer overflow in the api.cgi component of Wavlink WN530HG4B firmware allows unauthenticated remote attackers to execute arbitrary code via malformed input to the api=info&client=app handler.

An unauthenticated remote code execution vulnerability (CVE-2026-110957) in the Wavlink WL-WN530BE2-A router allows attackers to inject OS commands via the REMOTE_ADDR parameter in api.cgi.

Lantronix XPress-DR and XPress-DR-I devices running firmware version 8.1.0.0 and earlier are vulnerable to remote configuration manipulation via an unauthenticated UDP configuration protocol.

An improper input validation vulnerability in the VPN daemon of Juniper Networks Junos OS on SRX Series allows an authenticated attacker to achieve remote code execution via a buffer overflow in AutoDiscovery VPN messages.

An OS command injection vulnerability in the TACACS component of Juniper Junos OS Evolved allows authenticated, low-privileged users to achieve root-level code execution.

An unauthenticated heap-based buffer overflow in the Secure Vector Routing (SVR) component of Juniper Junos OS allows remote attackers to trigger denial-of-service or potentially execute arbitrary code via malformed IPv4 packets.

Multiple vulnerabilities in Ubiquiti UniFi network management software allow remote, unauthenticated attackers to execute arbitrary OS commands, bypass security controls, and disrupt service.

A vulnerability in Fortinet FortiOS allows a remote, unauthenticated attacker to trigger a denial of service condition on the target appliance.

Multiple vulnerabilities across several Fortinet products, including FortiOS and FortiManager, permit remote code execution, privilege escalation, and denial-of-service.

This analytic identifies potential adversary activity by monitoring for non-standard SSH client banners in network traffic, which can indicate the use of custom offensive tooling, tunneling utilities, or malware for C2 and lateral movement.

This detection identifies anomalous HTTP POST requests containing heavily encoded bodies, specifically using hex escape sequences or base64 character blocks often used by adversaries to obfuscate C2 traffic or exfiltrated data.

A critical buffer overflow vulnerability in the Edimax BR-6208AC router allows unauthenticated remote code execution via manipulation of the ifname argument in the /goform/formWlSiteSurvey handler.

The user_ok function in the Netcore NR268 CGI execution component contains an authentication bypass vulnerability, CVE-2026-108907, which allows remote attackers to gain unauthorized access.

The Linksys E1700 router (v1.0.0.4.003) is vulnerable to a remote stack-based buffer overflow in the Mac Filter component, allowing for potential unauthenticated remote code execution.

Multiple high-severity vulnerabilities in HPE Networking AOS-Switch could allow unauthenticated attackers to achieve remote code execution, perform unauthorized actions, or cause denial of service.

TVU Networks Receiver and Transceiver firmware versions prior to 7.9 contain an authentication bypass vulnerability in the /tvu/Login endpoint, allowing unauthenticated attackers to gain administrative sessions.

IBM Guardium Data Protection 12.2.2 is susceptible to an unauthenticated remote denial-of-service attack via malformed gRPC task data that causes the edge-controller process to crash.

OpenSSH is affected by multiple vulnerabilities that allow a remote, unauthenticated attacker to bypass security controls, cause a denial-of-service (DoS) condition, or perform privilege escalation on the affected system.

Threat actors, linked to Red Menshen, are deploying advanced Linux backdoors like BPFDoor and AVERAT against telecom and network appliances in South Korea and Taiwan, utilizing process name spoofing and BPF-based triggers to evade detection.

The proxy-addr package is vulnerable to IP spoofing due to improper validation of IPv4-mapped IPv6 trust subnets, allowing attackers to manipulate X-Forwarded-For headers and bypass IP-based security controls.

A vulnerability in Apache Traffic Server (CVE-2024-41754) allows a remote, unauthenticated attacker to bypass security policies, potentially resulting in unauthorized traffic manipulation.

This detection analytic identifies Potentially Unwanted Applications by monitoring for specific HTTP User-Agent strings in web logs, which can signify unauthorized tool usage or active compromise on the network.

This analytic identifies potential C2 traffic by matching HTTP User-Agent strings from proxy or web logs against a repository of known malicious agents used by infostealers including Lokibot, Lumma, Meduza, and RedLine.

This detection identifies DNS queries from internal hosts to known dynamic domain providers, a technique frequently used by attackers to maintain flexible command-and-control infrastructure and host malicious payloads.

This detection utilizes Cisco Secure Firewall logs to identify TLS-encrypted sessions established using known malicious or blacklisted SSL certificate fingerprints associated with C2, malware, and phishing.

This detection logic identifies anomalous downloads of potentially malicious file types including executables, archives, and scripts using Cisco Secure Firewall Threat Defense telemetry.

An SQL injection vulnerability (CVE-2026-80298) in HAVELSAN Sef - AI Chatbot Platform versions before 2.1 allows unauthenticated attackers to execute arbitrary SQL commands against the backend database.

Unauthenticated attackers are actively exploiting a path traversal and NULL byte injection vulnerability (CVE-2026-104286) in FortiMail to write arbitrary files and establish persistence.

The 'MikroTrick' campaign exploits vulnerabilities in the RouterOS SSH service to achieve unauthenticated remote code execution and administrative account persistence.

An unauthenticated remote attacker can trigger a permanent 100% CPU utilization loop in iperf3 versions prior to 3.22 by sending a crafted control-channel message followed by a specific UDP datagram.

This brief describes the detection of anomalous MQTT traffic to external brokers, a communication channel leveraged by malware like BambooToken and WailingCrab for command and control.

An unauthenticated remote authorization bypass vulnerability exists in the Netcore NBR100V2 router, allowing attackers to manipulate system configurations via the ACL Handler component.

Zoraxy versions 3.2.3 through 3.3.4 contain a vulnerability in IPv6 address parsing that allows unauthenticated attackers to spoof the X-Forwarded-For header and bypass IP-based access controls.

An unauthenticated remote attacker can cause a denial of service on the IBM Advanced System Management Interface (ASMI) by sending malformed HTTPS requests, triggering a crash and repeated interface restarts.

A critical out-of-bounds write vulnerability in the D-Link DIR-825 firmware (version 3.00b32) allows remote attackers to trigger memory corruption via the peer_hostname parameter.

Forcepoint has disclosed CVE-2026-12974, a security policy bypass vulnerability affecting multiple versions of the Forcepoint Security Engine (NGFW) that requires urgent administrative review and patching.

The LTSecurity LTK3500SF device stores root and guest account credentials in a recoverable format, allowing attackers to gain full administrative access via SSH or Telnet.

Arista VeloCloud Orchestrator (VCO) On-Prem is vulnerable to CVE-2026-93952, which is confirmed to be under active exploitation in the wild.

A critical unauthenticated remote code execution vulnerability in F5 BIG-IP Access Policy Manager is currently being exploited in the wild, allowing attackers to gain full system control.

An unauthenticated remote code execution vulnerability (CVE-2026-94127) exists in F5 BIG-IP APM when an OAuth profile is configured on a virtual server, allowing attackers to execute arbitrary code via malformed traffic.

A critical remote code execution vulnerability in Barracuda Email Security Gateway caused by improper input validation of email attachments allows attackers to execute arbitrary code.

Adversaries and malware, including Trickbot and APT actors, leverage plain HTTP POST requests to exfiltrate sensitive system information, such as process lists and network configurations, to remote C2 infrastructure.

This analytic identifies instances where network traffic, specifically using prohibited ports and protocols such as FTP or Telnet, is allowed by Cisco Secure Firewall, signaling potential misconfigurations or unauthorized activity.

An unauthenticated remote command injection vulnerability (CVE-2026-94139) in the Cookie Handler component of Feiyu Star Router allows attackers to execute arbitrary system commands via a manipulated session_id argument.

Netcore NBR200V2 version 1.3.241127.071246 is vulnerable to remote command injection via the Traceroute Diagnostic Feature, allowing unauthenticated attackers to execute arbitrary commands.

D-Link DIR-868L version 2.01b05 contains a critical stack-based buffer overflow vulnerability in the web authentication handler that allows unauthenticated remote code execution via malformed input.

A critical command injection vulnerability in the D-Link R95 BE9500 firmware (1.00.16) allows remote attackers to execute arbitrary OS commands via the DHMAPI component.

Detection engineering logic that correlates Elastic Defend endpoint alerts with network security events from PAN-OS, FortiGate, and Suricata to identify potentially compromised hosts based on multi-source telemetry.

Attackers may force HTTP protocol downgrades from secure versions like HTTP/2 to legacy versions to exploit header parsing inconsistencies and facilitate request smuggling or cache poisoning.

This detection leverages cross-platform correlation between FortiGate network application logs and endpoint telemetry to identify processes acting as SOCKS proxies for potential command and control obfuscation.

This detection capability correlates Palo Alto Networks (PANW) firewall command and control alerts with Elastic Defend endpoint events to identify the specific process responsible for network traffic flagged as malicious.

Detection rule monitors GenAI tools and CLI package managers for network connections to high-risk Top-Level Domains frequently utilized by threat actors for C2 infrastructure.

A stack-based buffer overflow vulnerability in the web server of PLANET IGS-5225-8P2T4S industrial managed switches allows authenticated remote attackers to achieve denial of service or remote code execution via CVE-2026-81944.

A vulnerability in hickory-resolver versions prior to 0.26.2 causes the library to ignore bogus DNSSEC proof states, allowing attackers to inject forged DNS records as validated data.

Cisco has released emergency patches for dozens of critical vulnerabilities across Identity Services Engine (ISE), Secure Firewall Management Center (FMC), and Nexus Dashboard, including several flaws currently exploited in the wild.

A critical remote code execution vulnerability (CVE-2026-91843) affects multiple Check Point security management servers, allowing unauthenticated attackers to execute arbitrary code.

Analysis of the SilkParasite campaign reveals a 13-server command-and-control cluster facilitating the deployment of SpiceRAT against targets in Central Asia.

An authenticated remote attacker can exploit a vulnerability in Netgate pfSense to bypass security controls and execute arbitrary PHP code and shell commands.

A remote OS command injection vulnerability in the TOTOLINK X5000R router allows unauthenticated attackers to execute arbitrary commands via the exportOvpn function.

An unauthenticated remote command injection vulnerability in the D-Link DSL-3782 router allows attackers to execute arbitrary system commands via the Diagnostics component.

A vulnerability in HAProxy (CVE-2023-45538) allows remote, unauthenticated attackers to bypass security restrictions, manipulate data, and trigger denial-of-service conditions.

A remote command injection vulnerability in the D-Link DWR-M921 router allows unauthenticated attackers to execute arbitrary OS commands by manipulating the partition argument in the formDiskFormat function.

A remote command injection vulnerability in the D-Link DWR-M920 router allows unauthenticated attackers to execute arbitrary system commands via the /boafrm/formPinManageSetup interface.

A stack-based buffer overflow in the Tenda W20E formDelWebAuthWhiteUser function allows remote unauthenticated attackers to execute arbitrary code or cause a denial of service via manipulation of the webAuthWhiteUserIndex argument.

A critical stack-based buffer overflow vulnerability in the D-Link DIR-878 router enables remote code execution via malformed Dynamic DNS IPv6 configuration parameters.

This detection identifies potential defense evasion where a newly observed network flow exporter subsequently acts as the source of suspicious security alerts within a 30-minute window.

WAVLINK WN535M1 and WN535M3 routers are vulnerable to unauthenticated arbitrary file writes via the sync_server daemon, enabling attackers to gain root-level persistence.

Detection logic identifies internal reconnaissance activity characterized by a single source IP probing a large volume of unique destination ports using SYN packets.

Detection of potentially unauthorized IPSEC NAT Traversal (NAT-T) tunnels indicates potential command and control (C2) or exfiltration activity masked by encrypted traffic.

This detection capability correlates network-layer Suricata alerts with host-based process telemetry from Elastic Defend to identify malicious outbound command and control communication.

Multiple vulnerabilities in Arista EOS allow an attacker to achieve privilege escalation, arbitrary code execution, security bypass, and denial-of-service.

Check Point has disclosed critical vulnerabilities, including CVE-2026-85102 and CVE-2026-85103, affecting various Security Gateway, Management Server, and Spark Firewall deployments.

A stored cross-site scripting (XSS) vulnerability in the PAN-OS web interface allows an authenticated administrator to execute arbitrary JavaScript within the context of the management interface.

OpenVPN versions 2.6.22 and 2.7.6 and earlier contain a vulnerability in the reliability layer that can be triggered by unbounded TLS timeouts and acknowledgments for non-outstanding packets, potentially leading to denial-of-service.

Multiple vulnerabilities, including remote code execution and security policy bypass, have been disclosed in strongSwan versions prior to 6.1.0.

Multiple vulnerabilities in MikroTik RouterOS are being actively exploited in the wild, targeting internet-exposed SSH services to achieve full system compromise.

A critical authentication bypass vulnerability, CVE-2026-86300, exists in the Tenda AC9 firmware version 15.03.05.14, allowing remote attackers to circumvent security controls via the Web Management interface.

An OS command injection vulnerability (CVE-2026-86299) in the Linksys RE7000 version 2.0.15 allows unauthenticated remote code execution via the PingTest Handler component.

A stack-based buffer overflow vulnerability in the udhcpcd component of D-Link DIR-822A routers allows unauthenticated remote attackers to execute arbitrary code.

Multiple vulnerabilities in Netgate pfSense Plus and CE allow remote attackers to execute arbitrary code or conduct cross-site scripting attacks, posing a high risk to network perimeter security.

Advantech WISE-6610 series gateways are vulnerable to unauthenticated remote command injection via the Basic Station Certificate-Deletion Handler, potentially leading to full system compromise.

Versions of ntop nDPI before 6.0 are vulnerable to a heap-based buffer overflow in the ndpi_json_string_escape function, allowing attackers to trigger memory corruption via crafted network traffic.

This brief details a detection strategy for identifying unauthorized outbound network connections initiated by native Windows Living Off the Land Binaries and Scripts (LOLBAS) often used for C2 and payload delivery.

IBM ContextForge MCP Gateway is susceptible to server-side request forgery (SSRF) via DNS rebinding, allowing a remote authenticated attacker to access sensitive internal network information.

North Korean state-sponsored actors are deploying a sophisticated Linux backdoor named 'ted' by replacing legitimate HAProxy binaries with trojanized versions to intercept web traffic and execute malicious commands.

The pAntler component in essential-moos versions 10.0.1 and earlier allows unauthenticated attackers to achieve remote code execution by publishing a crafted MISSION_FILE message to the MOOSDB.

A pre-authentication heap overflow vulnerability in the MOOSCommPkt packet handling of MOOS core-moos versions up to 10.4.0 allows remote unauthenticated attackers to perform arbitrary memory writes via crafted packets.

The pShare component in MOOS essential-moos versions up to 10.0.1 is vulnerable to unauthenticated UDP message injection and denial-of-service.

Cisco has issued security advisories for unpatched S/MIME vulnerabilities in Secure Email and critical RCE and authentication bypass flaws across its IOS XR, Nexus, and VoIP phone product lines.

An authenticated user with any role can exploit a vulnerability in the F5 BIG-IP Traffic Management User Interface to create arbitrary administrative accounts.

Multiple vulnerabilities in WatchGuard Fireware OS, including the Mobile Security component, allow unauthenticated remote attackers to execute arbitrary code via specially crafted network traffic.

A vulnerability in Samba tracked as CVE-2024-4323 allows a remote, authenticated attacker to trigger a Denial of Service condition through specific request handling.

An unauthenticated remote command injection vulnerability in the mail-report.sh script of Cobham SATCOM VSAT7090 devices allows attackers to execute arbitrary system commands via crafted JSON input.

A critical authentication bypass vulnerability in the Tenda AC18 router allows remote, unauthenticated attackers to gain unauthorized access via the Telnet service.

Tenda AC1206 firmware version 15.03.06.23 contains an authentication bypass vulnerability in the /goform/telnet handler, allowing remote attackers to gain unauthorized access.

This brief details detection logic for identifying potentially malicious RPC traffic originating from internal segments toward external networks, a common vector for initial access and lateral movement.

Publicly accessible Remote Procedure Call (RPC) services on TCP port 135 facilitate initial access and backdoor establishment by threat actors.

The exposure of VNC services to the public internet enables unauthorized remote access, providing adversaries a vector for initial access or persistent backdoors.

Adversaries, including FIN7, utilize the downloading of RAR archives and PowerShell scripts from external sources to retrieve encoded or encrypted payloads to facilitate initial access and lateral movement.

A critical stack-based buffer overflow vulnerability in D-Link DIR-825M firmware allows unauthenticated remote attackers to achieve code execution via the /boafrm/formDiskFormat endpoint.

PLANET GS-4210-16P2S switches running firmware older than 3.441b260626 are vulnerable to authenticated OS command injection via the memberTags parameter.

Multiple high-severity vulnerabilities, including CVE-2026-77533 and CVE-2026-77537, affect Ubiquiti UniFi products, potentially allowing for system compromise.

Detection engineers can identify potential C2 activity by flagging outbound TLS connections using recently issued self-signed certificates where issuer and subject distinguished names match.

This detection logic identifies potential DNS tunneling activity by monitoring for a high volume of unique, unusually long DNS subdomains directed to the same registered domain within a short timeframe.

This detection logic identifies potentially unauthorized remote or administrative VPN access by monitoring for successful login combinations of user, source IP, and appliance not observed in the previous 14 days.

Multiple DrayTek VigorSwitch models contain a pre-authentication command injection vulnerability (CVE-2026-71921) in the setget.cgi interface that allows unauthenticated remote attackers to execute arbitrary commands as root.

Cisco Industrial Ethernet 1000 Series Switches contain multiple vulnerabilities, including CVE-2024-20412, CVE-2024-20413, and CVE-2024-20414, which allow unauthenticated attackers to cause a denial-of-service or perform cross-site scripting attacks.

Cisco Secure Workload is affected by multiple vulnerabilities allowing unauthenticated remote attackers to execute arbitrary code, escalate privileges, and cause service disruptions.

A remote, unauthenticated attacker can exploit a vulnerability in Arista EOS and WiFi Access Point firmware to trigger a denial of service condition by crashing affected network devices.

An unauthenticated stack-based buffer overflow in the Netis NC63 router management interface allows remote code execution via a crafted HTTP request to skk_set.cgi.

A critical stack-based buffer overflow vulnerability in the /sbin/mycli binary of TRENDnet TEW-755AP access points allows remote unauthenticated attackers to execute arbitrary code via the 'ssid' argument.

A critical stack-based buffer overflow vulnerability in the UTT HiPER 1250GW HTTP handler allows remote authenticated attackers to execute arbitrary code via a crafted 'pvid' parameter.

A stack-based buffer overflow vulnerability in the UTT HiPER 1200GW router allows remote attackers to trigger memory corruption via a malicious 'timestart' parameter, with proof-of-concept exploits publicly available.

A command injection vulnerability in TRENDnet Router 1.1.02b01 allows remote, authenticated attackers to execute arbitrary commands by manipulating the wan_type parameter.

A critical stack-based buffer overflow in the TRENDnet TEW-WLC100 HTTP Header Handler allows remote attackers to achieve arbitrary code execution via a malformed 'Server' header.

Multiple GL.iNet router models running firmware versions up to 4.8.x contain an authorization bypass vulnerability in the WebDAV service, allowing remote unauthenticated attackers to manipulate file operations.

A stack-based buffer overflow in the Tenda AC1206 firmware version 15.03.06.23_multi_TD01 allows remote attackers to trigger memory corruption via the httpd web management interface.

An authenticated path traversal vulnerability in the luci-app-openvpn component of OpenWrt allows remote attackers to write arbitrary files to the filesystem and achieve persistent root-level code execution.

A local authentication bypass vulnerability in the Palo Alto Networks Prisma Access Agent for Windows enables an administrative user to disable security inspections and manipulate network traffic.

SonicWall GMS contains multiple vulnerabilities allowing remote code execution with root privileges, privilege escalation, security bypass, and information disclosure.

The Undertow AJP listener incorrectly trusts ssl_cert and is_ssl attributes within the AJP protocol without validating a shared secret, allowing unauthenticated attackers to bypass CLIENT-CERT authentication.

An OS command injection vulnerability in Zyxel WAH7601 devices (CVE-2026-13206) allows unauthenticated remote attackers to execute arbitrary system commands.

Tenda CH22 firmware version 1.0.0.1 is vulnerable to unauthenticated remote command injection via the formCertListInfo function, allowing for arbitrary system command execution.

D-Link DWR-M961 devices with hardware version C1 and firmware versions prior to 1.1.5_C1_202607071108 are vulnerable to unauthenticated command injection via the fota_url parameter.

A security policy bypass vulnerability (CVE-2026-0516) in SonicWall SonicOS affects multiple hardware generations and virtual appliances, potentially allowing unauthorized access or configuration subversion.

Multiple Zbtlink router models are susceptible to the ENDLESSDOORS root implant, which leverages the rctl remote control tool for unauthorized access and persistent phone-home capabilities.

Zbtlink router firmware ships with the ENDLESSDOORS remote-control implant, which runs as root, masquerades as a kernel process, and enables unauthenticated remote command execution.

An authenticated path traversal vulnerability in Zyxel ATP and USG series firmware allows administrators to execute arbitrary configuration files, potentially leading to command execution.

Detection logic identifies ransomware-like activity on NFS shares by flagging high-frequency bursts of successful WRITE, REMOVE, and RENAME operations from a single client within a one-minute window.

Unauthorized actors can leverage the lack of native authentication in Memcached to perform data manipulation or session hijacking, as identified in CVE-2026-29093.

Detection of malicious SIP REGISTER authentication attempts targeting VoIP infrastructure through anomalous 401, 403, and 407 response code patterns.

Detection logic targeting unauthorized Apache Thrift RPC method invocations from external IP addresses to identify exposed internal microservices or potential exploitation of data platforms.

The PostgreSQL 'COPY ... PROGRAM' feature enables users with elevated privileges to execute arbitrary operating-system commands, a technique frequently abused by attackers to deploy cryptominers or establish persistence.

Elastic's Data Exfiltration Detection integration leverages machine learning to identify rare processes writing data to external devices, indicating potential data exfiltration by adversaries using benign-looking processes.

A machine learning job by Elastic detects potential data exfiltration by identifying anomalous network traffic patterns where high bytes are sent to an unusual destination port, suggesting data is being exfiltrated via command and control channels.

Elastic's machine learning rule detects potential data exfiltration by identifying anomalous network traffic, specifically large data transfers to unusual geo-locations via IP addresses, indicating possible exfiltration over command and control channels.

Multiple vulnerabilities have been identified in Progress Software LoadMaster and MOVEit WAF products, allowing an attacker from an adjacent network to execute arbitrary program code and gain root privileges on the affected systems.

This threat brief details how threat actors exploit the insecure Telnet protocol on its default port 23 for initial access, lateral movement, and command and control, leveraging its unencrypted nature to compromise systems and exfiltrate data, emphasizing the need for robust detection and mitigation strategies.

This brief describes a critical network threat where attackers leverage ICMP tunneling, a technique to embed command and control (C2) or exfiltrated data within large ICMP Echo payloads, enabling covert communication channels that bypass traditional firewall rules, posing a significant risk of data theft and unauthorized system control.

This brief details the detection of ICMP Redirect messages (IPv4 type 5, IPv6 type 137) originating from internal IP addresses, which strongly indicates Adversary-in-the-Middle (MITM) activity designed to manipulate routing, potentially leading to credential access or data exfiltration by directing target host traffic through a compromised internal system.

This brief details the detection of unencrypted Telnet traffic on its default port 23, a legacy protocol commonly used for remote administration but frequently exploited by threat actors for initial access or as a backdoor due to its plain-text nature, which exposes sensitive information and facilitates unauthorized access.

A remote denial-of-service vulnerability exists in Stormshield Network Security (SNS) versions 4.3.x before 4.3.43, 4.4.x to 4.8.x before 4.8.16, and 5.x before 5.0.6, allowing an attacker to disrupt service availability.

free5GC's NEF nnef-pfdmanagement API is vulnerable to unauthenticated access, allowing attackers with network access to read PFD data and create/delete PFD subscriptions by using forged bearer tokens due to the absence of inbound OAuth2/bearer-token authorization.

Suricata versions 8.0.0 to before 8.0.4 exhibit a quadratic complexity vulnerability (CVE-2026-31934) when searching for URLs in MIME-encoded SMTP messages, leading to significant performance degradation and potential denial-of-service conditions; this is fixed in version 8.0.4.

This brief covers a newly observed Fortigate alert rule added to the Elastic detection rules repository, potentially indicating emerging threat activity targeting Fortigate devices.

An EC2 Route Table creation event in AWS can indicate an attacker attempting to disrupt network traffic, reroute communications, or maintain persistence by creating unauthorized routes.

The deletion of an Amazon EC2 network access control list (ACL) or its entries can indicate an attacker attempting to disable security controls for unauthorized access or data exfiltration.

This analytic detects suspicious configuration changes on Cisco devices by analyzing archive logs for activities such as backdoor account creation, SNMP community string modifications, and TFTP server configurations, potentially indicating attacker presence and lateral movement.