This week’s intelligence highlights an intense wave of zero-day exploitation across network perimeters, virtualization platforms, and supply chain identity systems. Threat actors are weaponizing authentication bypasses in enterprise VPNs, deploying stealthy memory-resident implants via centralized management servers, hijacking Docker Hub tokens, and evolving commodity malware to bypass MFA via live browser hijacking.

SISA Weekly Threat Watch – our weekly feature brings to you a quick snapshot of all the major security vulnerabilities that posed a threat to organizations worldwide. These recurring actionable threat advisories will also provide information and recommendations that will help security teams take appropriate actions to defend against the latest and critical threats.

1. Actively Exploited Zero-Days & Perimeter Compromise

Edge network appliances and centralized orchestration platforms are under active bombardment from unauthenticated threat actors executing remote code and deploying advanced, memory-only RATs.

• Ivanti, Palo Alto & PAN-OS Zero-Days — Multiple VPN and firewall perimeters are actively being breached. Ivanti Connect Secure suffers from a CVSS 8.6 authentication bypass (CVE-2026-104935). Palo Alto Networks GlobalProtect is being exploited by Qilin and Settra ransomware groups via a cookie authentication override flaw (CVE-2026-0257). Furthermore, an authenticated PAN-OS management interface zero-day (CVE-2026-0322) is being actively weaponized to execute root-level commands.
• FortiManager PEERSTITCH & FortiSandbox Exploits — Advanced actors (UNC5820) exploited a missing authentication flaw in FortiManager (CVE-2024-47575) to steal configuration databases for over 500 managed firewalls. Attackers used this access to deploy PEERSTITCH, a memory-resident Linux implant that hooks miglogd and iked daemons to bypass VPN authentication. Separately, FortiSandbox disclosed a CVSS 9.6 GUI authentication bypass (CVE-2026-107656).
• Cisco Secure Email Gateway Active Exploitation — An unauthenticated arbitrary file write zero-day (CVE-2026-76519) in the Cisco Secure Email Gateway AMP engine allows remote attackers to execute arbitrary system commands via crafted email attachments, requiring no user interaction.

2. Core OS, Infrastructure & Hypervisor Vulnerabilities

Deep architectural flaws in operating systems, domain controllers, and hypervisors are granting attackers paths to collapse infrastructure and escape virtual environments.

• Windows Shell 0-Day & DFS Denial-of-Service — Microsoft's record-breaking October 2026 Patch Tuesday addressed a Windows Shell zero-day (CVE-2026-96951) that bypasses Mark of the Web (MotW) protections. Concurrently, a zero-day in the Windows Distributed File System (DFS) driver (mup.sys) allows an unauthenticated network attacker to crash entire Windows Servers and Domain Controllers using a single crafted SMB packet (CVE-2026-70111).
• Cisco NX-OS, Citrix NetScaler & XenServer Escapes — Cisco Nexus 3000/9000 switches face critical RCE flaws in NGOAM and MPLS OAM subsystems. Citrix NetScaler ADC/Gateway disclosed a CVSS 9.5 memory boundary violation for SAML SP/IdP configurations (CVE-2026-107406). Additionally, Citrix XenServer (8.4 and 9) patched multiple flaws allowing administrative guest users to breach hypervisor isolation and compromise the physical host.
• AnyDesk Linux Pre-Auth RCE ("AnyPwn") — A functional exploit has been released for AnyDesk Linux (CVE-2026-107406) exploiting an integer wrap-around. The flaw provides unauthenticated attackers with root privileges over direct TCP connections (port 7070) before any session authorization dialog appears.

3. Supply Chain Attacks & Enterprise Web Flaws

Identity management flaws in developer ecosystems and memory corruption in web servers are exposing enterprise supply chains to unauthorized code execution.

• Docker Hub Token Impersonation Flaw — A critical flaw in Docker Hub’s account-to-organization conversion workflow (CVE-2026-105445) allowed attackers to retain control of Personal Access Tokens (PATs) after an account was transferred. This enabled adversaries to inherit a victim's registry permissions and push backdoored container images without authorization.
• F5 NGINX & Vercel Next.js Critical Flaws — NGINX Open Source and Plus variants are affected by three high/critical memory corruption vulnerabilities causing worker termination and potential RCE. Vercel Next.js patched two critical unauthenticated RCE flaws affecting the App Router use cache functions and SVG image processing capabilities.

4. Advanced Commodity Malware & Endpoint Infiltration

Commodity malware operators are upgrading their arsenals with psychological harassment tools and interactive session hijacking capabilities to circumvent MFA.

• XWorm Reborn & ICMacOS Evolution — The XWorm infostealer has evolved into a full surveillance platform, introducing HBrowser to hijack live, MFA-authenticated browser sessions invisibly. It also features silent GPS tracking via registry manipulation and live audio capture. The ICMacOS malware utilizes ClickFix lures and AppleScript spoofing to harvest keychains, maintaining persistence via WebSockets C2 and LaunchAgents.
• KGB RAT Endpoint Infiltration — Distributed under a MaaS model and disguised as an IT tool, KGB RAT utilizes daily-updated FUD crypters to evade Microsoft Defender. Beyond standard HVNC and crypto-clipping, it integrates a ransomware module and psychological harassment tools, including audio screamers and forced Blue Screens of Death (BSOD).

Proactive Steps for the Week

• Isolate Management Interfaces & Apply Edge Patches: Ensure administrative interfaces for Palo Alto PAN-OS, FortiManager, FortiSandbox, and Citrix NetScaler are isolated from the public internet. Immediately apply emergency patches across Ivanti Connect Secure, Cisco Secure Email Gateway, and Cisco Nexus infrastructure to halt active zero-day campaigns.
• Audit Docker Hub Tokens: Organization owners and developers should review active Docker Hub Personal Access Tokens (PATs). Revoke unrecognized or stale tokens, and transition CI/CD pipelines to scoped Organization Access Tokens (OATs).
• Harden Endpoints Against Live Hijacking: To combat XWorm’s HBrowser MFA bypass, implement Continuous Adaptive Risk and Trust Assessment (CARTA), enforce short session lifetimes, and utilize device-bound session credentials (such as FIDO2 hardware tokens).
• Deploy Microsoft October 2026 Updates: Deploy cumulative updates immediately to resolve the actively exploited Windows Shell MotW bypass and the DFS unauthenticated DoS vulnerability. Monitor for unexpected kernel crashes (Event ID 41/6008) indicative of DFS exploitation.
• Hunt for Memory-Resident Implants: For organizations running FortiManager/FortiGate, conduct memory map inspections of /bin/miglogd and /bin/iked processes to hunt for the PEERSTITCH implant. Look for anonymous 16 KB memory regions allocated with Read-Write-Execute (rwx) permissions.