Threat Summary A critical zero-day vulnerability (CVE-2026-50656/“RoguePlanet”) in Microsoft Defender’s Malware Protection Engine (mpengine.dll) enables local users, including standard, low-privilege accounts, to escalate privileges to
Summary On July 30th, 2026, SolarWinds released fixes for a critical Authentication-Bypass vulnerability in Web Help Desk (WHD) tracked as CVE-2026-28323, and a related high-severity
Threat Summary Threat actors are actively exploiting two high-severity authentication bypass vulnerabilities, CVE-2026-18556 and CVE-2026-18577, in N-able N-Central, a widely deployed remote monitoring and management
Threat Summary CVE-2026-20316 is a newly discovered zero-day vulnerability affecting Cisco Secure Firewall Management Center (FMC) software, allowing unauthenticated, remote attackers to log in using
Threat Summary Cybersecurity and Infrastructure Security Agency (CISA) has added several critical zero-day vulnerabilities targeting Microsoft SharePoint Server. CVE-2026-58644 is a deserialization flaw in SharePoint
Threat Summary CVE-2026-6875 is a critical remote code execution (RCE) vulnerability in the ServiceNow AI Platform. The flaw allows unauthenticated attackers to escape the sandbox
Threat Summary On April 14, 2026, Fortinet released fixes for a critical OS command injection vulnerability in FortiSandbox, tracked as CVE-2026-39808. The flaw allows remote
Threat Summary Arctic Wolf has observed a ClickFix-style intrusion pattern in which a user-executed PowerShell command downloads and runs remote content directly in memory. In
Threat Summary Two severe vulnerabilities affecting SonicWall Secure Mobile Access 1000 (SMA1000) series appliances have been confirmed as under active exploitation since their public disclosure
Threat Summary On July 6, 2026, Apache disclosed CVE-2026-43867. Fixed releases (4.21.0 on July 1 and 4.18.3 on July 3) were available prior to public
Overview Arctic Wolf Internal Security Operations (SecOps) recently identified a GitHub page impersonating Arctic Wolf to target our customers and prospects. The SecOps team immediately
Summary CVE-2026-48558 is a critical authentication bypass vulnerability in SimpleHelp Remote Monitoring and Management (RMM) software, caused by improper validation of OpenID Connect (OIDC) token
Threat Summary A suite of severe vulnerabilities has been disclosed in libssh2 (an SSH client library widely embedded in software such as curl, Git GUI
Summary In mid-June 2026, security researchers identified an active, large-scale credential compromise campaign affecting Fortinet FortiGate firewalls, dubbed FortiBleed. Threat actors have been systematically extracting
Threat Summary CVE-2026-25089 is a critical OS command injection (CWE-78) vulnerability discovered in Fortinet FortiSandbox versions 4.4.0–4.4.8, 5.0.0–5.0.5, and corresponding Cloud and Platform as a
Threat Summary On June 9, 2026, Microsoft released its regular Patch Tuesday security update, fixing 206 vulnerabilities (with 39 rated Critical) affecting a broad spectrum
Summary A critical unauthenticated remote code execution vulnerability in Oracle PeopleSoft PeopleTools, tracked as CVE-2026-35273, is under active exploitation by the ShinyHunters extortion group in
On June 9–10, 2026, Ivanti disclosed and patched two maximum-severity vulnerabilities in the Sentry appliance (formerly MobileIron Sentry): CVE-2026-10520 (OS command injection, CVSS 10.0) and
Threat Summary CVE-2026-50751 is a critical vulnerability (CVSS 9.3) in Check Point Remote Access VPN, Mobile Access, and Spark Firewall products using the deprecated IKEv1 key
For the latest insight into this threat, see our latest research publication. In early June 2026, Arctic Wolf observed an increase in active exploitation of
On May 6, 2026, Palo Alto Networks disclosed a critical buffer overflow vulnerability (CVE-2026-0300) in the User-ID™ Authentication Portal (Captive Portal) component of PAN-OS. This
Updated May 1 Anthropic has officially launched Claude Security, moving its AI‑driven code vulnerability detection, validation, and patching capabilities from a limited research preview into
On April 14, 2026, Microsoft released its April 2026 security update, addressing 165 newly disclosed vulnerabilities. Among these, Arctic Wolf has highlighted two vulnerabilities in
Summary On April 4, 2026, Fortinet released a hotfix for a critical vulnerability in FortiClient EMS (CVE-2026-35616) that allows unauthenticated remote threat actors to execute
On March 10, 2026, Progress ShareFile released fixes for two critical severity vulnerabilities in Progress ShareFile Storage Zones Controller (SZC) 5.x, tracked as CVE-2026-2699 and
The widely used Axios npm package, a JavaScript library that enables applications to make HTTP/S requests and is included as a dependency in millions of
On March 28, 2026, F5 updated its security advisory for a vulnerability impacting BIG-IP APM that was originally disclosed in October 2025 (CVE-2025-53521). The vulnerability
Arctic Wolf has recently observed a phishing campaign targeting Microsoft 365 that abuses the OAuth device code flow to trick victims into providing authentication codes.
Summary The threat actor TeamPCP has recently launched a coordinated campaign targeting security tools and open-source developer infrastructure by pivoting with stolen CI/CD secrets and
On March 23, 2026, Citrix released fixes for a critical vulnerability affecting NetScaler ADC and NetScaler Gateway (CVE‑2026‑3055) that allows unauthenticated threat actors to perform
