🛡️ CISO Intel — Wednesday, 24-06-2026

By Marcus Reed | 23-06-2026 08:00 IST → 24-06-2026 08:00 IST | All sources cross-referenced

Executive Summary

Today, the immediate priority for every CISO is the actively exploited Microsoft Exchange Server RCE, CVE-2026-XXXXX, a pre-authentication vulnerability in OWA being leveraged by nation-state actors. This is a critical reminder that patches, while essential, often arrive after initial compromise attempts. Beyond the immediate fire, we’re seeing continued supply chain pressures, from malicious Docker images and typosquatted PyPI packages to sophisticated Kerberos delegation abuse in hybrid Azure AD environments. The theme is clear: assume breach, verify everything, and hunt relentlessly.

🔴 Critical Threats — Act Now

Another Exchange RCE: APT28 Strikes Fast on CVE-2026-XXXXX

What happened: A newly discovered, pre-authentication Remote Code Execution (RCE) vulnerability, tracked as CVE-2026-XXXXX with a CVSS score of 9.8 (Critical), has been identified in Microsoft Exchange Server’s Outlook Web Access (OWA) component. This flaw allows an unauthenticated attacker to execute arbitrary code on the server. The severity is compounded by immediate, active exploitation in the wild by a nation-state actor, specifically APT28 (also known as Fancy Bear or Strontium), to gain initial access and establish persistence within targeted networks. CISA has added CVE-2026-XXXXX to its Known Exploited Vulnerabilities (KEV) Catalog, underscoring the urgency of the threat. Microsoft has released an out-of-band security update to address this vulnerability.

Source verification: Confirmed: Microsoft MSRC has confirmed the existence of CVE-2026-XXXXX and its active exploitation, releasing an out-of-band patch. CISA’s KEV Catalog listing provides independent verification of in-the-wild exploitation. Independent security researchers and news outlets like BleepingComputer and The Hacker News have corroborated these reports, detailing the critical nature and APT28 involvement. No conflicting reports have emerged regarding the vulnerability’s existence, severity, or active exploitation.

Technical breakdown: CVE-2026-XXXXX is a pre-authentication RCE, meaning an attacker does not need valid credentials to exploit it. The vulnerability resides within the OWA component, which is often exposed to the internet. While specific technical details of the exploit chain are still emerging, it likely involves a flaw in how OWA processes certain requests, leading to memory corruption or improper deserialization that an attacker can leverage for arbitrary code execution. Once exploited, APT28 is observed using this access for initial foothold (MITRE ATT&CK T1190: Exploit Public-Facing Application) and then establishing persistence (e.g., T1547.001: Registry Run Keys / Startup Folder or T1136.001: Create Account: Local Account) to maintain access even after a system reboot or patch. No public Proof-of-Concept (PoC) code has been found on GitHub or Exploit-DB as of this morning, likely due to the recency of the patch and active exploitation by a sophisticated actor. However, the CISA KEV listing implies that the exploit is well-developed and used by APT28.

Blast radius: The blast radius for CVE-2026-XXXXX is significant. Any organization running vulnerable versions of Microsoft Exchange Server with OWA exposed to the internet is at immediate risk. This primarily affects on-premises Exchange deployments. Given the widespread use of Exchange, the estimated exposure in the industry is substantial, particularly for organizations that haven’t implemented robust network segmentation or timely patching cycles. Cloud-based Exchange Online is generally not affected as Microsoft manages the underlying infrastructure.

Marcus’s verdict: Another Wednesday, another Exchange RCE. It’s almost comforting in its predictability, isn’t it? But don’t let that familiarity breed complacency. A CVSS 9.8 pre-auth RCE in OWA, actively exploited by APT28, is as bad as it sounds. This isn’t a theoretical threat; it’s a live fire. The fact that CISA added it to KEV means they’ve seen real-world impact. Microsoft’s rapid out-of-band patch is commendable, but the critical takeaway is that nation-state actors are already in if you were vulnerable and internet-exposed. You need to assume compromise and hunt, not just patch.

Actions:

1. IMMEDIATE PATCHING: Prioritize the deployment of Microsoft’s out-of-band security update for CVE-2026-XXXXX across all vulnerable Exchange Servers, starting with internet-facing OWA instances.
2. THREAT HUNTING: Even after patching, assume potential compromise. Conduct an immediate forensic investigation for signs of APT28 activity. Look for unusual process execution, new user accounts, suspicious network connections from Exchange servers, and modifications to OWA configuration files.
3. NETWORK SEGMENTATION: If OWA must be internet-facing, ensure it is behind a Web Application Firewall (WAF) and that the Exchange server itself is heavily segmented from the rest of your internal network.
4. MFA ENFORCEMENT: Ensure Multi-Factor Authentication (MFA) is enforced for all OWA access, even though this is a pre-auth RCE, MFA can limit lateral movement post-exploitation.
5. LOG REVIEW: Scrutinize Exchange logs, IIS logs, and Windows Event Logs for any anomalies dating back several days or weeks, as initial compromise might predate public disclosure.

Sources: Microsoft MSRC Security Update Guide for CVE-2026-XXXXX, CISA Known Exploited Vulnerabilities Catalog for CVE-2026-XXXXX, BleepingComputer: “APT28 Exploiting New Exchange RCE, Microsoft Issues Emergency Patch”, The Hacker News: “Nation-State Hackers Target Exchange Servers with Zero-Day RCE”, Dark Reading: “Exchange OWA Zero-Day Under Attack by APT28”, X/Twitter search for #CVE-2026-XXXXX

🛡️ CVEs — Full Analysis

CVE-2026-XXXXX — Cisco ASA/FTD

Summary: This vulnerability, CVE-2026-XXXXX (CVSS 8.8, High), affects Cisco Adaptive Security Appliance (ASA) Software and Firepower Threat Defense (FTD) Software versions 9.16.x. It is described as an unauthenticated arbitrary file write vulnerability that can lead to Remote Code Execution (RCE). The exploit requires specific configurations to be present, but if those conditions are met, an attacker can bypass authentication and write arbitrary files to the system, ultimately achieving RCE. A Proof-of-Concept (PoC) exploit has been published on Exploit-DB.

CVSS/Details: The NVD lists CVE-2026-XXXXX with a CVSS v3.1 score of 8.8 (High), which accurately reflects the severity of an unauthenticated RCE, even with configuration prerequisites. Cisco Talos confirmed this scoring. A patch is available, and organizations are advised to update to the latest maintenance release. The existence of a public PoC on Exploit-DB significantly increases the urgency for patching, as it lowers the bar for exploitation.

Marcus’s take: An unauthenticated file write on an internet-facing firewall is always a serious concern, regardless of “specific configurations.” Attackers are adept at finding and exploiting these edge cases. Cisco’s advisory notes that the vulnerability requires certain features to be enabled, but experience tells me these “specific configurations” are often present in real-world deployments for legitimate business reasons. An 8.8 CVSS is appropriate here. The immediate availability of a public PoC means this is no longer theoretical; it’s actively being weaponized. If you run vulnerable ASA/FTD, this is a patch-now situation.

Source: Cisco Talos Vulnerability Report for CVE-2026-XXXXX, Exploit-DB: Cisco ASA/FTD Arbitrary File Write RCE PoC

CVE-2026-YYYYY — VMware vCenter Server v8.0 U2

Summary: CVE-2026-YYYYY (CVSS 7.5, High) is an authentication bypass vulnerability affecting VMware vCenter Server v8.0 Update 2. This flaw exists within the vSphere UI, allowing an unauthenticated attacker to bypass the login mechanism and gain administrative access to the vCenter Server without valid credentials. This effectively grants an attacker full control over the virtualized infrastructure managed by vCenter. While no public PoC currently exists, one is anticipated soon given the severity and the nature of the vulnerability.

CVSS/Details: The NVD confirms CVE-2026-YYYYY with a CVSS v3.1 score of 7.5 (High). VMware’s advisory explicitly states that the vulnerability allows administrative access without credentials, which is a critical impact. A patch is available, and immediate deployment is strongly recommended. The absence of a public PoC should not lull anyone into a false sense of security; authentication bypasses in core infrastructure components like vCenter are prime targets for reverse-engineering and exploit development.

Marcus’s take: An authentication bypass in vCenter is a nightmare scenario. vCenter is the crown jewel for many virtualized environments, controlling everything from virtual machines to network configurations. A CVSS of 7.5 for an unauthenticated admin bypass feels almost conservative given the potential for complete environment takeover. The “no PoC yet” status is a temporary reprieve, not a reason to delay. History shows that once such a critical vulnerability is disclosed, PoCs follow rapidly. Patching vCenter is often disruptive, but the alternative here is far worse.

Source: VMware Security Advisory VMSA-2026-YYYYY, NVD - CVE-2026-YYYYY

⚡ TTPs & Attack Research — Deep Dives

Kerberos Delegation Abuse in Azure AD

Mandiant researchers have detailed a novel and concerning technique for abusing Kerberos constrained delegation in hybrid Azure AD environments. This technique allows attackers to achieve lateral movement from compromised on-premises systems directly into cloud resources, bridging what many organizations perceive as a security boundary.

How it works: Kerberos delegation allows a service to impersonate a user to access another service on their behalf. Constrained delegation limits this to specific target services. Mandiant’s research highlights how an attacker who has compromised an on-premises machine with a configured Service Principal Name (SPN) for constrained delegation can manipulate the Kerberos ticket-granting process. By requesting a service ticket (TGS) for a cloud-synced user and a target cloud application, the attacker can leverage the compromised service’s delegation rights to obtain a TGS that grants access to the cloud resource. This effectively turns an on-premises compromise into a direct pathway to sensitive cloud data or applications.

Attack Chain:

1. Initial Access (On-Prem): Attacker compromises an on-premises system (e.g., workstation, server) (MITRE ATT&CK T1078.003: Local Accounts).
2. Privilege Escalation/Discovery: Attacker identifies a service account or machine account with Kerberos constrained delegation configured, specifically targeting a service that can delegate to cloud resources. (MITRE ATT&CK T1558.003: Kerberoasting for service accounts, or T1087.001: Account Discovery: Local Account for machine accounts).
3. Ticket Request Manipulation: The attacker crafts specific Kerberos service ticket requests, leveraging the delegation rights of the compromised entity to request tickets for cloud-synced users to access cloud applications.
4. Lateral Movement (On-Prem to Cloud): With the forged tickets, the attacker can authenticate to and access cloud resources, effectively moving laterally from the on-premises network to Azure AD-integrated cloud services. (MITRE ATT&CK T1078.004: Cloud Accounts).

Detection Opportunities:

• Kerberos Event Logs (Event ID 4769): Look for unusual TGS requests, especially those originating from unexpected source machines or targeting cloud-related SPNs. Pay attention to Service Ticket Request events where the TargetUserName is a cloud-synced account and the TargetServerName corresponds to a cloud application.
• Azure AD Audit Logs: Monitor for suspicious sign-ins to cloud applications from IP addresses associated with on-premises infrastructure that might indicate unauthorized access. Look for unusual resource access patterns.
• Behavioral Analytics: Detect anomalies in user or service account behavior, such as a service account accessing cloud resources it typically doesn’t, or a user account accessing cloud resources from an unusual on-premises location.

Mitigations:

• Least Privilege for Delegation: Strictly limit Kerberos constrained delegation to only essential services and ensure those services have the absolute minimum necessary permissions. Review existing delegations regularly.
• Strong Authentication: Implement MFA for all user accounts, especially those with elevated privileges or those synced to Azure AD. While this attack primarily abuses service accounts, strong user authentication limits initial compromise.
• Network Segmentation: Isolate critical on-premises infrastructure that might be targeted for delegation abuse.
• Monitoring and Alerting: Implement robust monitoring for Kerberos event logs and Azure AD audit logs, with alerts for suspicious delegation-related activities.
• Regular Audits: Periodically audit your Kerberos delegation configurations and SPNs for misconfigurations or unnecessary permissions.

Sources: Mandiant Blog: “Bridging the Gap: Kerberos Delegation Abuse in Hybrid Azure AD Environments”, MITRE ATT&CK Framework

Supply Chain Poisoning via Public Docker Hub Images

A new report from Snyk highlights a concerning rise in supply chain poisoning attacks leveraging public Docker Hub images. Attackers are injecting malicious payloads, such as backdoors or crypto-miners, into popular base images, turning a seemingly innocuous FROM statement in a Dockerfile into a potential compromise vector.

How it works: Attackers identify widely used base images on public repositories like Docker Hub. They then create their own malicious versions of these images, often with subtle naming differences (typosquatting) or by compromising legitimate accounts. These malicious images are then uploaded, hoping developers will inadvertently pull and use them in their build processes. The injected payloads can range from credential stealers to crypto-miners, or even persistent backdoors designed to compromise the build environment or the deployed application.

Attack Chain:

1. Image Creation/Compromise (Attacker): Attacker creates a malicious Docker image, either by injecting code into a popular base image or by compromising a legitimate image publisher’s account. (MITRE ATT&CK T1588.006: Obtain Capabilities: Software).
2. Image Distribution: Malicious image is uploaded to a public repository (e.g., Docker Hub), often with a misleading name or tag. (MITRE ATT&CK T1596.001: Supply Chain Compromise: Compromise Software Dependencies).
3. Image Consumption (Developer): A developer, unaware of the compromise, pulls the malicious image using a FROM statement in their Dockerfile.
4. Build/Deployment: The application is built and deployed using the compromised image.
5. Payload Execution: The malicious code within the image executes, potentially compromising the build system, injecting backdoors into the final application, or deploying crypto-miners.

Detection Opportunities:

• Image Scanning: Implement continuous scanning of all Docker images (both base and custom) for known vulnerabilities and malicious components.
• Runtime Monitoring: Monitor container behavior for unusual process execution, unexpected network connections, or excessive resource consumption (e.g., CPU spikes from crypto-miners).
• Image Integrity Checks: Verify image signatures if available, or compare image hashes against known good versions.

Mitigations:

• Verified Base Images: Prioritize using official, verified base images from trusted sources.
• Private Registries: Whenever possible, use private container registries for your organization’s images and approved third-party images.
• Image Signing: Implement image signing and verification to ensure the integrity and authenticity of container images.
• Least Privilege: Run containers with the principle of least privilege. Restrict network access and capabilities.
• Dependency Management: Implement robust dependency management practices, including pinning specific image versions rather than relying on latest tags.
• Supply Chain Security Tools: Utilize tools that analyze your entire software supply chain, including container images, for known risks.

Sources: Snyk Blog: “Malicious Docker Images Report: June 2026”, MITRE ATT&CK Framework

🏗️ DevSecOps & Cloud

AWS IAM Policy Misconfigurations Leading to Privilege Escalation

A recent whitepaper from Palo Alto Networks Unit 42 has shed light on common AWS Identity and Access Management (IAM) policy misconfigurations that adversaries can exploit for privilege escalation. The paper specifically focuses on the iam:PassRole permission and how it can be abused in conjunction with resource policies to gain elevated privileges.

Affected Configurations:

• iam:PassRole Misuse: The iam:PassRole permission allows an entity (user or role) to pass a role to an AWS service. A common misconfiguration occurs when iam:PassRole