Zero-Days at Every Layer: Exploit Kits, RATs, and Ransomware Target Enterprise Infrastructure

This week tested every layer of the enterprise defense stack. Zero-days landed faster than patches could follow, exploit kits proliferated across threat clusters within days, and firewalls meant to protect networks became the very doors attackers walked through.

CISA added nine actively exploited vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog this week, spanning products from Microsoft, Google, Cisco, Fortinet, Citrix NetScaler, N-Able N-Central, and Adobe Commerce and Magento. Two Microsoft Windows vulnerabilities and two Google Chrome vulnerabilities were confirmed as zero-day attacks exploited prior to patching, alongside critical flaws in network security appliances, e-commerce platforms, and remote monitoring infrastructure. Active exploitation was also detected in MikroTik RouterOS, where Poland's CERT agency identified the "MikroTrick" exploit chain combining an SSH authentication bypass with a privilege escalation flaw to seize full administrative control of internet-exposed routers.

On the malware front, four espionage-motivated threat clusters rapidly adopted the BlueMoon exploit kit across multiple targeted campaigns, whereas a Russian cybercrime operation deployed PivotC2, a purpose-built FortiGate RAT, across 178 confirmed infections out of over 30,000 targeted devices. Apart from this, three separate threat clusters converged on Cisco FMC vulnerabilities, deploying malware and ransomware through the same attack surface.

Key highlights of the week:

• Cisa added 9 vulnerabilities to its KEV catalog
• MikroTrick exploit chain actively targeting internet-exposed MikroTik routers.
• BlueMoon exploit kit rapidly adopted by four espionage-motivated threat clusters.
• PivotC2 RAT deployed across 178 FortiGate devices out of 30,000+ targeted.
• Three distinct threat clusters converged on Cisco FMC to deliver malware and ransomware.

Several high-impact vulnerabilities are currently trending across the cybersecurity community, demanding immediate attention and patch prioritization. Monitoring these emerging and widely discussed threats provides valuable insights, enabling organizations to make informed security decisions and strengthen their overall defense posture.

CVE-2026-19490 - Authentication Bypass Using an Alternate Path or Channel vulnerability in Citrix NetScaler  

An Authentication-Bypass vulnerability involving an alternate path or channel in Citrix NetScaler ADC and NetScaler Gateway allows an unauthenticated remote attacker to bypass authentication when the appliance is configured as an AAA virtual server or as a Gateway (SSL VPN, ICA Proxy, CVPN, or RDP Proxy). The vulnerability affects NetScaler ADC versions 14.1 through 73.32 and 13.1 through 63.21, and Gateway versions 14.1 through 73.32 and 13.1 through 63.21. According to Shadowserver, over 22,000 NetScaler ADC appliances and nearly 1,700 Gateway instances are currently exposed online, though the number of vulnerable or unpatched systems among them remains unclear. This vulnerability has been actively exploited in the wild, with proof of concept publicly available further lowering the barrier to exploitation, and CISA has since added it to the KEV Catalog confirming active exploitation.

CVE-2026-20079 - Authentication Bypass Using an Alternate Path or Channel vulnerability in Cisco Firewall Management Center

An Authentication Bypass vulnerability in Cisco Firewall Management Center (FMC) Software and Security Cloud Control (SCC) allows an unauthenticated, remote attacker to bypass authentication and execute scripts on the affected device to obtain root access, due to an improper system process created at boot time. According to Cisco Talos, three distinct threat actor clusters are actively exploiting this vulnerability: UAT-12197 deployed JSP web shells and JAR-based command executors to exfiltrate user credentials from internal databases; UAT-11823, which overlaps in tooling with the Russian APT Sandworm, exploited the flaw to deploy Netcat-based reverse shells and a variant of Cyclops Blink malware capable of credential harvesting, packet sniffing, and arbitrary command execution; and UAT-11988, assessed with high confidence as a Qilin ransomware operator, leveraged the access to conduct extensive domain reconnaissance, deploy SOCKS5 proxies and reverse-SSH tunnels, harvest Active Directory credentials, and ultimately deploy Qilin ransomware across selected endpoints. Cisco has released hotfixes, with a comprehensive hardening release expected soon, and CISA added this vulnerability to the KEV catalog.

CVE-2026-67276 - SSH Authentication Bypass vulnerability in Mikrotik RouterOS

An SSH authentication bypass vulnerability in MikroTik RouterOS allows a remote attacker to log in without the legitimate private key by exploiting incomplete RSA public key validation. The flaw exists because RouterOS compares only the public modulus of a user's RSA key instead of the entire key, enabling an attacker who knows a username and its corresponding modulus to craft a different key and authenticate as that user, gaining that account's privileges. This vulnerability affects only the RouterOS 7.x branch and is being actively exploited in the wild as part of a chained exploit dubbed "MikroTrick" by Poland's CERT agency, which discovered the flaw with the assistance of GPT-5.5-cyber and GPT-5.6-sol. Attackers are leveraging this vulnerability alongside a separate SSH privilege escalation flaw to take full administrative control of MikroTik routers with SSH services exposed to the internet. MikroTik addressed the vulnerability in RouterOS versions 7.23.4 (Long-term) and 7.24.2 (Stable).

CVE-2026-75650 - Improper Neutralization of Special Elements Used in a Template Engine vulnerability

An improper neutralization of special elements used in a template engine vulnerability in Adobe Commerce and Magento allows an unauthenticated attacker to execute arbitrary code on vulnerable storefronts. Dubbed StyleSmuggler by Sansec, the flaw abuses Magento's email template engine by first injecting attacker-controlled PHP content into an accessible file such as an application log or failure notification, then triggering the template-processing chain via a crafted HTTP request that loads the poisoned file using PHP include, executing the injected code with the application's own privileges through the Payment Transaction Failed Reminder rendering path. This vulnerability has been actively exploited as a zero-day since at least September 4, 2026, with threat actors deploying Rust-based Linux backdoors and PHP web shells on compromised storefronts. Adobe released a critical security update addressing this vulnerability, and CISA added it to the KEV Catalog.

CVE-2026-81963 - Link Following vulnerability in Microsoft Windows

A Link Following vulnerability in the Microsoft Windows Update Stack allows a local attacker to escalate privileges up to SYSTEM level. The Windows Update Stack is the core framework responsible for discovering, downloading, installing, and managing system updates, and it operates with elevated system privileges to modify protected OS files and configurations. According to Microsoft, this vulnerability has been actively exploited as a zero-day in the wild, though no additional details regarding the exploitation activity, including the identity of the threat actors involved or the methods of exploitation, are known at this time. Microsoft addressed this vulnerability in its September 2026 Patch Tuesday release, and CISA KEV catalog.

CVE-2026-85046 - Type Confusion vulnerability in Google Chromium V8

A Type Confusion vulnerability in the V8 JavaScript engine of Google Chromium allows a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. The flaw resides in the Maglev compiler's TryReduceArrayPrototypeSort function, where an insufficient map check during the copy-back phase of an inlined insertion sort allows an attacker to train the compiled function with both PACKED_SMI_ELEMENTS and PACKED_ELEMENTS arrays, then exploit a user-supplied comparator to migrate the array's map backwards in place, causing the engine to treat tagged object pointers as small integers and yielding address-disclosure and fake-object primitives that grant arbitrary read and write access across the JavaScript heap. The bug affects both the Maglev and TurboFan compilers and impacts multiple Chromium-based browsers including Google Chrome, Microsoft Edge, and Opera. This vulnerability has been actively exploited as a zero-day, and proof of concept is publicly available. Google addressed the flaw in Chrome Stable channel versions 152.0.7977.82/.83 for Windows and Mac and 152.0.7977.82 for Linux, and CISA added it to the KEV Catalog.

CVE-2026-85880 - Heap-Based Buffer Overflow vulnerability in Microsoft Windows

A Heap-Based Buffer Overflow vulnerability in Windows Advanced Local Procedure Call (ALPC), a kernel-level inter-process communication mechanism, allows a local attacker to escalate privileges on the affected system. An attacker who can execute code within a low-privileged AppContainer could exploit this vulnerability to escape the sandbox and elevate privileges to SYSTEM level with no additional user interaction required. This vulnerability has been actively exploited as a zero-day in the wild, though Microsoft did not release any additional details about the exploitation activity or specify who is exploiting this vulnerability and in what manner. Microsoft addressed this vulnerability in its September 2026 Patch Tuesday release, and CISA added it to the KEV Catalog.

CVE-2026-86060 - SSH Privilege Escalation vulnerability in Mikrotik RouterOS

An SSH privilege escalation vulnerability in MikroTik RouterOS allows an attacker to obtain full administrative privileges due to improper handling of specially crafted usernames. An attacker can exploit this flaw by manipulating the SSH session with a crafted username to escalate privileges beyond the initially authenticated account. This vulnerability forms the second half of the "MikroTrick" exploit chain identified by Poland's CERT agency, where attackers combine it with an SSH authentication bypass flaw to take complete control of MikroTik routers with SSH services exposed to public networks. Poland's CERT confirmed active exploitation, warning that attacks against internet-accessible RouterOS devices have been observed in recent days. MikroTik addressed the vulnerability in RouterOS versions 7.25beta3, 7.24.2, 7.23.4, and 6.49.21, released on September 3, and the updates include a compromise-detection mechanism that identifies signs of unauthorized configuration changes at startup, disables malicious entries, and logs a critical warning, though Poland's CERT cautioned that the absence of a compromise marker should not be taken as a guarantee that a router has not been compromised.

CVE-2026-86218 - Static Code Injection vulnerability in N-able N-Central

A Static Code Injection vulnerability in N-Able N-Central allows a remote, unauthenticated attacker to achieve pre-authentication remote code execution on the server without credentials, privileges, or user interaction. According to Huntress, the server fails to properly neutralize directives inside statically saved code, allowing attacker-supplied input to be injected and executed with the server's own privileges, and successful exploitation grants access to management functions, stored secrets, and the ability to push scripts and initiate remote-control sessions across all managed endpoints. Both cloud-hosted and on-premises deployments are impacted, and the N-Central server runs a custom AlmaLinux 9 distribution that does not often have EDR deployed, making detection significantly harder. This vulnerability has been actively exploited as a zero-day, though conflicting statements from N-Able regarding exploitation status were ultimately settled when CISA added it to the KEV catalog. N-Able addressed the vulnerability in N-Central 2026.3.1.14.

CVE-2026-87491 - Out of Bounds Write vulnerability in Google Chromium V8

An Out-of-Bounds Write vulnerability in the V8 JavaScript engine of Google Chromium allows a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page, impacting multiple Chromium-based browsers including Google Chrome, Microsoft Edge, and Opera. This vulnerability has been actively exploited as a zero-day in the wild, affecting all versions prior to 153.0.8010.36. Google addressed the flaw in Chrome Stable channel version 153.0.8010.36 but provided no further details about the vulnerability or its exploitation activity, in line with its usual practice of withholding information while a fix is still rolling out to users. CISA added this vulnerability to the KEV catalog confirming active exploitation.

CVE-2025-25249 - Heap-Based Buffer Overflow vulnerability in Fortinet Multiple Products

A Heap-Based Buffer overflow vulnerability in the cw_acd daemon of Fortinet FortiOS, FortiSwitchManager, and FortiSASE allows a remote, unauthenticated attacker to execute arbitrary code or commands via specially crafted CAPWAP packets sent to UDP port 5246, without requiring any authentication. According to SOCRadar, active exploitation dates back to at least July 2026, with over 30,000 IPs targeted and 178 confirmed infections, primarily in the United States, where successful exploitation delivers PivotC2, a purpose-built Node.js Remote Access Trojan designed specifically for FortiGate post-exploitation, capable of interactive shells, SOCKS5 tunneling, configuration harvesting, and automated credential decryption. SOCRadar assesses with high confidence that this is a Russian-speaking, financially motivated cybercrime operation, with at least two US-based organizations suffering full network intrusions and confirmed data exfiltration. Fortinet has released patches, and CISA added this vulnerability to its KEV catalog.

Cytellite telemetry captured active exploit attempts and mass scanning campaigns against exposed services globally. The data highlights which vulnerabilities are under attack and provides source IPs and payloads to authorized teams for detailed threat analysis and validation.

Active malware campaigns exploited specific vulnerabilities to deliver payloads and carry out post-exploitation actions. Each targeted vulnerability is proactively monitored, manually analysed, and mapped to MITRE ATT&CK tactics and techniques. Insights are derived from the LOVI vulnerability intelligence platform, which aggregates and curates data from multiple sources, OSINT groups, blogs, and data leak sites.

BlueMoon Exploit Kit: Four State-Aligned Threat Actors Chain Chrome and Windows Zero-Days in Rapid Espionage Campaigns

According to Proofpoint, four espionage-motivated threat actors rapidly adopted a newly identified exploit kit dubbed BlueMoon, which chains a Chrome V8 type confusion vulnerability, a V8 sandbox escape, and a Windows kernel privilege escalation zero-day to achieve full code execution with elevated privileges outside the browser sandbox. The first adopter was China-aligned TA412 (APT31), which targeted US NGOs, mining, and commodity trading organizations and delivered GemStone, a previously undocumented browser surveillance backdoor disguised as a Google Gemini extension. Within days, UNK_LateNight targeted US aerospace and defense industrial base entities to deliver the ShadowPad backdoor, UNK_DoubleCheck targeted Vietnamese manufacturing via a compromised Southeast Asian government email to deploy a Rust-based loader chain, and UNK_QuietRacket targeted government, consulting, and financial organizations in Singapore and Indonesia with custom malware using Google DNS-over-HTTPS for command and control. Both Chrome V8 vulnerabilities were patch-gap zero-days, where upstream fixes were publicly available but not yet rolled into stable browser releases, creating a nearly four-week exploitation window, and development artifacts within the kit are broadly consistent with AI-assisted exploit development. Proofpoint assesses that BlueMoon will likely proliferate further and be adopted by both espionage-motivated and financially motivated threat actors.  

Russian Cybercrime Operation Exploits FortiGate Zero-Day to Deploy PivotC2 RAT

According to SOCRadar, a Russian-speaking, financially motivated cybercrime operation has been actively exploiting a heap-based buffer overflow vulnerability in the FortiOS and FortiSwitchManager cw_acd daemon since at least July 2026, targeting over 30,000 FortiGate IP addresses and confirming 178 infections, with the highest concentration in the United States. Successful exploitation delivers PivotC2, a purpose-built Node.js Remote Access Trojan designed specifically for FortiGate post-exploitation, capable of interactive shells, SOCKS5 and HTTP proxy tunneling, local and remote port forwarding, CIDR-range port scanning, and automated FortiGate configuration harvesting with AES credential decryption. PivotC2 features an auto-mode flag that turns every new infection into a fully autonomous pipeline, automatically harvesting configurations, decrypting credentials, extracting internal networks, and launching port scans without operator intervention. The codebase contains detailed inline comments and usage guidance consistent with AI-assisted development, and the recovered version (0.2.3) indicates the tool is still evolving. Two US-based organizations suffered full network intrusions with confirmed data exfiltration of Exchange mailbox files to attacker-controlled Wasabi S3 storage buckets, with the threat actor leveraging additional tools including ldapdomaindump, Rust-based SSH relays, and browser credential extraction for lateral movement.

Active Exploitation of Cisco FMC Delivers Cyclops Blink and Qilin Ransomware across three threat clusters

According to Cisco Talos, three distinct threat actor clusters are actively exploiting authentication bypass and static credential vulnerabilities in Cisco Secure Firewall Management Center (FMC) Software to achieve root access on affected devices. UAT-12197 exploited the authentication bypass to deploy web shells and exfiltrate user credentials from internal databases. UAT-11823, which overlaps in tooling with the Russian APT Sandworm, chained both vulnerabilities to deploy a variant of Cyclops Blink malware capable of credential harvesting, packet sniffing, and arbitrary command execution. UAT-11988, assessed with high confidence as a Qilin ransomware affiliate, leveraged static credentials to conduct extensive domain reconnaissance, establish internal tunnels, and ultimately deploy Qilin ransomware across selected endpoints.

Open-Source Software (OSS) vulnerabilities are security weaknesses discovered in publicly available codebases that can be exploited across widely used libraries, frameworks, and tools, often impacting thousands of downstream applications.

PRE-NVD vulnerabilities refer to security flaws that are discovered, discussed, or even exploited in the wild before their official inclusion in the National Vulnerability Database (NVD). These early-stage vulnerabilities often emerge through threat actor chatter, exploit proof-of-concepts, and technical disclosures shared across social media platforms and underground forums, signaling potential exploitation risks before public awareness.

The convergence of state-sponsored espionage, financially motivated cybercrime, and ransomware operations exploiting the same vulnerability surfaces within the same reporting period signals a threat landscape where the boundaries between actor types are rapidly dissolving. Defenders can no longer afford to treat patching as a scheduled activity when zero-days are being weaponized within days of disclosure and exploit kits are proliferating across multiple threat clusters simultaneously. The Loginsoft Vulnerability Intelligence (LOVI) team continues to monitor, analyze, and deliver actionable intelligence on emerging vulnerabilities and active exploitation campaigns to help organizations stay ahead of this accelerating threat curve. Stay informed, stay patched, and stay vigilant.

FAQs

1) Why are firewalls and edge devices becoming primary attack targets?

Firewalls, RMM platforms, and edge devices operate with elevated privileges and typically lack endpoint detection coverage, making them high-value targets that provide immediate deep access. This week's exploitation of FortiGate, Cisco FMC, and N-Able N-Central demonstrates that attackers are increasingly prioritizing the very infrastructure organizations rely on for security and management as their preferred entry point.

2) What is a patch-gap zero-day and why does it matter?

A patch-gap zero-day occurs when a vulnerability fix is publicly available in upstream source code but has not yet been rolled into stable releases that end users can install. The BlueMoon exploit kit exploited exactly this gap in Chromium, weaponizing publicly available patches within days and creating a nearly four-week window where every Chrome user remained vulnerable despite a fix technically existing.

3) Does inclusion in the CISA KEV catalog mean exploitation is widespread?

Not necessarily widespread - but confirmed. KEV inclusion indicates verified in-the-wild exploitation. While the scale may vary, the operational reality is that threat actors possess working exploits, making patch prioritization urgent regardless of observed targeting volume.

4) How does LOVI help organizations manage vulnerabilities effectively?

Loginsoft Vulnerability Intelligence empowers you to efficiently prioritize and respond to potential vulnerabilities by focusing on those actively exploited in the wild. LOVI correlates vulnerability data with real-world threat activity to reduce noise and improve decision-making. This approach enables faster remediation and stronger security posture.

5) What is Cytellite?

Cytellite is a Loginsoft security intelligence platform that provides real-time visibility into emerging threats through a global sensor network. It delivers actionable IP intelligence to help organizations detect, analyze, and respond to attacks quickly. By correlating threat data with live activity, Cytellite strengthens resilience across dynamic threat landscapes.