Threat Advisories

Earlier this week we wrote a blog post on the cyber affairs amidst the US-Israel war on Iran, called Operation Epic Fury. In which we observed that there would be an elevated response from state sponsored threat actors, against the western organisations with a middle eastern presence as a retaliation for these attacks.  

Cisco has released emergency patches for two maximum‑severity (CVSS 10.0) vulnerabilities affecting Cisco Secure Firewall Management Center (FMC). These flaws tracked as CVE‑2026‑20079 and CVE‑2026‑20131, allow unauthenticated, remote attackers to obtain root‑level control over FMC appliances, posing a severe risk to enterprise firewall infrastructure. No exploitation in the wild has been observed yet, but the critical nature and ease of exploitation elevate these vulnerabilities to immediate remediation priority.

Cybersecurity researchers have uncovered a new wave of supply-chain attacks attributed to North Korean state aligned threat actors, involving the publication of 26 malicious npm packages posing as legitimate developer tools. The campaign tracked as “StegaBin”, uses Pastebin based steganography to conceal command and control (C2) endpoints and ultimately deploy credential stealers and a cross platform remote access trojan (RAT). The infrastructure supporting these operations spans 31 Vercel deployments, highlighting a sophisticated and evolving threat to the global software supply chain.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a newly disclosed VMware Aria Operations vulnerability, tracked as CVE‑2026‑22719to its Known Exploited Vulnerabilities (KEV) catalog after confirming active exploitation in the wild. The flaw is a command injection vulnerability enabling unauthenticated remote code execution (RCE) under certain conditions. VMware (Broadcom) released patches on February 24, 2026, but reports indicate attackers are now leveraging the issue against unpatched systems. Federal civilian agencies have been mandated to remediate the vulnerability by March 24, 2026.

The global geopolitical and cybersecurity landscape has shifted dramatically following the February 28, 2026 launch of Operation “Epic Fury” by the United States and the parallel Israeli campaign Operation “Roaring Lion” against Iran. The coordinated military strikes successfully eliminated key Iranian leadership, including Supreme Leader Ayatollah Ali Khamenei, and heavily degraded Iran's conventional military and nuclear infrastructure.

Cisco Catalyst SD-WAN platforms are widely deployed across enterprises, governments, and service providers, often serving as the core infrastructure that links remote offices, data centers, and cloud environments. Because these controllers are frequently reachable from external networks to support distributed operations, they represent a highly visible and attractive target for threat actors.

SolarWinds has released urgent patches for four critical vulnerabilities affecting ServU 15.5. All flaws are rated CVSS 9.1 and can allow an attacker with sufficient privileges to execute arbitrary code as root, potentially taking full control of affected systems. The issues are resolved in ServU version 15.5.4.

CVE‑2026‑2329 is a critical stack‑based buffer overflow vulnerability affecting the Grandstream GXP1600 series of VoIP desk phones. The flaw sits in the device’s web‑based API endpoint and can be exploited remotely without any authentication. If successfully exploited, an attacker can gain full remote code execution with root privileges on the phone.

CVE-2026-2649 is a high severity integer overflow vulnerability in the V8 JavaScript engine used by Google Chrome. The issue affects Chrome versions earlier than 145.0.7632.109. If a user opens a specially crafted HTML page, the flaw can lead to heap corruption inside the browser.
Because V8 handles JavaScript execution, weaknesses in this component can have wide impact across normal browsing and sandboxed processes.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a critical SolarWinds Web Help Desk (WHD) vulnerability—CVE‑2025‑40551—to its Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild. The flaw carries a CVSS score of 9.8 and enables unauthenticated remote code execution (RCE) via deserialization of untrusted data. This vulnerability poses a severe risk to enterprises, government agencies, and critical infrastructure relying on SolarWinds WHD.