FlagThis — Daily Cybersecurity Intelligence Briefing

In June 2026, Check Point disclosed two critical authentication bypass flaws (CVE‑2026-50751 CVSS 9.3, CVE‑2026-50752 CVSS 7.4) in Quantum VPN gateways that allow unauthenticated attackers to establish IKEv1 VPN sessions when legacy Remote Access clients are enabled and machine‑certificate validation is not enforced; post‑authentication steps can lead to privileged remote code execution. Active exploitation of CVE‑2026-50751 was observed from May 7 2026, linked to a Qilin ransomware affiliate, prompting urgent warnings from the Dutch NCSC and inclusion considerations for CISA’s KEV catalog.

A critical zero-day vulnerability, tracked as CVE-2026-76460, is currently being exploited in the wild targeting Cisco Identity Services Engine (ISE) and the ISE Passive Identity Connector (ISE-PIC). Rated with a maximum CVSS score of 10.0, the flaw enables unauthenticated remote attackers to bypass authentication mechanisms, granting unauthorized access to core identity infrastructure. Successful exploitation permits attackers to manipulate Network Access Control (NAC) policies, effectively compromising the entire network admission process. Given the active exploitation and extreme severity, CISA has issued an emergency directive requiring federal agencies to apply security patches by September 19, 2026, to mitigate the risk of full identity infrastructure takeover.

The "FortiBleed" campaign targets internet-facing Fortinet FortiGate firewalls through the systematic exploitation of vulnerabilities to extract sensitive configuration files. These files contain administrative credential hashes, which threat actors subject to offline cracking attacks to obtain plaintext credentials. The campaign has impacted 86,644 devices across 194 countries, resulting in the compromise of an estimated 30,000 to 75,000 verified administrator accounts. This widespread access enables threat actors to achieve full administrative control over network infrastructure, facilitating lateral movement, data exfiltration, and persistent network compromise within highly sensitive enterprise environments.

The China-nexus threat actor "Fire Ant" has shifted its operational focus toward "trusted infrastructure," specifically targeting Cisco routers, Linux-based management hosts, and authentication systems. By compromising the core network fabric, the actor establishes persistence below the endpoint visibility layer, enabling the interception of credentials and the manipulation of system logs to evade detection. This strategic pivot allows Fire Ant to leverage trusted network pathways to penetrate isolated, high-value environments for long-term intelligence collection and espionage, effectively bypassing standard EDR and endpoint security controls.

CVE-2026-20212 is a critical vulnerability in Cisco Nexus 9000 switches utilizing Silicon One ASICs that allows an unauthenticated remote attacker to achieve root-level code execution. The attack vector involves targeting TCP ports 43210 and 43211 within the default L3 VRF. Due to the prevalence of Silicon One hardware in high-bandwidth AI training and inference clusters, this flaw introduces a systemic risk to AI data center fabrics. Successful exploitation enables complete compromise of the underlying network infrastructure, granting the attacker full control over device management and data traffic steering for critical AI workloads.

A collection of 21 critical vulnerabilities within the Ubiquiti UniFi OS and Networking Application enables a multi-stage exploit chain targeting enterprise network infrastructure. The attack surface involves authentication bypass via compromised UniFi OS API endpoints, followed by command injection within the Networking Application to achieve Remote Code Execution (RCE). Subsequent exploitation of vulnerabilities such as CVE-2026-47369 facilitates local-to-root privilege escalation, granting attackers full administrative control. These flaws permit unauthorized access, lateral movement, and complete system compromise. Organizations must prioritize firmware updates to neutralize these vectors and monitor for exploitation patterns reminiscent of long-tail vulnerabilities like Log4Shell.

A sophisticated supply chain attack targeted the Virtualizor and Softaculous update infrastructure through BGP hijacking. Attackers utilized unauthorized BGP route announcements and rogue Autonomous System Numbers (ASNs) to intercept traffic destined for legitimate update servers. By redirecting requests to attacker-controlled endpoints, the threat actors served fraudulent update payloads to unsuspecting clients. This interception facilitates high-impact risks, including Remote Code Execution (RCE) on management hosts and potential lateral movement within high-density VPS and dedicated server environments. The campaign demonstrates the critical vulnerability of network-level trust in software distribution lifecycles, specifically targeting hosting provider management workflows.