IMPRIMIS CYBER INTELLIGENCE

CISA added CVE-2022-0492, an improper authentication flaw in the Linux kernel cgroups v1 release_agent mechanism, to the Known Exploited Vulnerabilities Catalog on June 2, 2026. The vulnerability enables local privilege escalation and full container escape on affected hosts.

FCEB agencies must remediate by June 5, 2026 under BOD 22-01. Maps to NIST 800-171 §3.4.2 (baseline configuration) and §3.14.1 (flaw remediation). Container runtime forensic evidence (cgroup mount, release_agent path, audit logs) must be preserved.

CISA added CVE-2025-48595, an integer overflow in the Android Framework, to the Known Exploited Vulnerabilities Catalog on June 2, 2026 alongside the Linux kernel flaw. Active in-the-wild exploitation was confirmed by CISA prior to listing.

MDM-managed Android fleets supporting CUI handling must inventory exposed devices and confirm patch level. Maps to CMMC L2 SI.L2-3.14.1 (flaw remediation) and CM.L2-3.4.1 (baseline configuration).

CISA added CVE-2026-45247, a deserialization of untrusted data flaw in the Mirasvit Full Page Cache Warmer Magento extension, to the KEV Catalog on June 3, 2026. Successful exploitation leads to remote code execution on affected e-commerce hosts.

E-commerce platforms running Magento with the Mirasvit extension are in scope. Evidence preservation includes web-server access logs, Magento /var/log entries, and any out-of-band shell artifacts. Relates to NIST 800-171 §3.14.2 (malicious code protection).

CISA added CVE-2026-28318, an unauthenticated resource-consumption flaw in SolarWinds Serv-U file-transfer software, to the KEV Catalog on June 5, 2026 with a remediation deadline of June 19, 2026. A specially crafted POST with Content-Encoding: deflate crashes the service.

Approximately 12,000 Serv-U instances are exposed online per Shodan. Hotfix is Serv-U 15.5.4 Hotfix 1. File-transfer logs and crash dumps preserve evidence. Maps to NIST 800-171 §3.14.1 and §3.13.5 (boundary protection).

CVE-2026-41089, a stack-based buffer overflow in Windows Netlogon (CVSS 9.8), is under active exploitation against domain controllers. Network-exploitable without authentication; successful exploitation yields full SYSTEM-level compromise of the DC.

The Centre for Cybersecurity Belgium issued an exploitation warning on May 29. DC event-log preservation (Security/System/Netlogon channels), memory captures, and Microsoft Defender for Identity alerts are primary evidence. Maps to NIST 800-171 §3.5.3 (multifactor) and §3.14.6 (system monitoring).

CVE-2026-3055 (CVSS 9.8) is an insufficient input-validation flaw in NetScaler ADC and NetScaler Gateway when configured as a SAML IDP, leading to a memory over-read exploitable for remote code execution. Large-scale active exploitation was confirmed.

In-scope environments include identity-broker NetScaler deployments. Preserve SAML authentication logs, NetScaler nstrace captures, and out-of-band shell artifacts. Maps to NIST 800-171 §3.5.3 and §3.13.1 (boundary protection).

Cisco disclosed CVE-2026-20245, an unpatched zero-day in Catalyst SD-WAN Manager actively exploited for root privilege escalation via crafted file upload. All deployment types — On-Prem, SD-WAN Cloud-Pro, SD-WAN Cloud, and SD-WAN for Government (FedRAMP) — are affected.

No workarounds; patches are pending a future release. Catalyst SD-WAN Manager audit logs, file-upload service logs, and process-creation telemetry must be preserved. Maps to NIST 800-171 §3.1.5 (least privilege) and §3.14.1.

NDAA FY2026 directs DoD to develop a cybersecurity and physical-security framework for AI/ML technologies acquired by the Pentagon and to integrate that framework into DFARS and the CMMC program. A formal status update to Congress is required by June 16, 2026.

DIB contractors developing, deploying, storing, or hosting AI/ML for DoD will be subject to additional CMMC obligations. Track changes via NIST AI RMF crosswalk to NIST 800-171 and the forthcoming DFARS implementation clause.

Compliance with the SEC's amended Regulation S-P, which requires incident response programs, breach notification, and safeguard requirements for covered financial firms, took effect for smaller firms on June 3, 2026. Larger firms were already subject as of late 2025.

Broker-dealers, investment advisers, transfer agents, and investment companies under the rule must maintain a written incident-response plan and notify affected individuals as soon as practicable, no later than 30 days after discovery of unauthorized access.

CISA, through its CI Fortify initiative, issued planning guidance directing water utilities, transportation operators, and other critical-infrastructure organizations to prepare for sustained cyber outages tied to a potential geopolitical crisis. Updated guidance was reissued through early June 2026.

Operators are expected to maintain manual operations playbooks, validated backups, and tested degraded-mode procedures. Maps to NIST CSF 2.0 RC.RP and to NIST 800-171 §3.6.1 (incident-handling capability) where DIB overlap exists.

The DoD class deviation issued February 1, 2026 renumbers and reorganizes the FAR and DFARS information-security and supply-chain clauses, removes parallel self-assessment mechanisms, and elevates CMMC as the primary compliance path for handling FCI and CUI. Contractors and primes continue to operationalize the change through Q2 2026.

Contracting officers are expected to flow down the renumbered clauses on new awards. Affected contractors should update SSP cross-references, supplier flow-down packages, and SPRS scoring narratives accordingly.

Microsoft's June 9, 2026 Patch Tuesday is the final scheduled release before the absolute Secure Boot certificate validation deadline of June 26, 2026. Devices that fail to complete certificate validation by that date face catastrophic boot-level security failures or degraded security state per Microsoft guidance.

Expected coverage includes Windows OS, Office, SharePoint, and an Exchange Server update addressing the previously exploited CVE-2026-42897. Adobe Creative Cloud and Chrome 150 also drop in the same window. Maps to NIST 800-171 §3.14.1 and §3.13.11 (FIPS-validated cryptography).

Authentication-bypass vulnerabilities in the Palo Alto PAN-OS GlobalProtect portal/gateway (CVE-2026-0257) are now seeing limited but confirmed exploitation as of late May into June 2026. Successful exploitation establishes unauthorized VPN sessions on unpatched edge devices.

Operators should pivot from advisory-only posture to active threat-hunting on GlobalProtect logs, authentication telemetry, and outbound flow records. Maps to NIST 800-171 §3.13.5 and §3.1.13 (remote-access cryptographic protection).

Palo Alto disclosed CVE-2026-0300, an unauthenticated buffer overflow in the PAN-OS User-ID Authentication Portal service. The flaw allows arbitrary code execution with root privileges on PA-Series and VM-Series firewalls via specially crafted packets.

PAN-OS upgrade is the prescribed remediation. Inspect device system logs, GlobalProtect captive-portal logs, and any out-of-band management-plane access. Maps to NIST 800-171 §3.4.1 and §3.13.5.

Fortinet disclosed CVE-2026-44277 (CVSS 9.1), an insufficient-access-control flaw in FortiAuthenticator that allows unauthenticated attackers to execute unauthorized code or commands via manipulated requests. Patches are available in the current FortiAuthenticator train.

FortiAuthenticator sits in the identity-broker path for many DIB tenants. Preserve admin event logs, RADIUS/TACACS+ accounting, and any anomalous certificate-issuance events. Maps to NIST 800-171 §3.5.3 and §3.14.6.

Ivanti released fixes for five high-severity flaws in Endpoint Manager Mobile (EPMM), including CVE-2026-6973, which was exploited as a zero-day. The flaw is an improper-input-validation issue allowing administrative-credentialed attackers to execute arbitrary code on EPMM instances.

CISA added the flaw to the KEV catalog and ordered FCEB agencies to remediate within three days. Fixed versions: EPMM 12.6.1.1, 12.7.0.1, 12.8.0.1. Maps to NIST 800-171 §3.14.1, §3.4.1, and §3.5.3.

Apple issued iOS 26.5.1 and macOS Tahoe 26.5.1 on June 1, 2026 to address iPhone 17 charging issues and M5 Mac shutdown problems ahead of WWDC on June 8. The release carries no published CVE entries, though it follows iOS/iPadOS 26.5 which addressed more than 60 CVEs including 20 WebKit issues.

MDM-managed Apple fleets should validate update rings and confirm Platform SSO continuity. Defer aggressive force-install policies for at least 48 hours to absorb post-release regressions. Maps to NIST 800-171 §3.14.1.

China-aligned threat actor Salt Typhoon expanded operations into South American telecom networks in 2026 and continues to maintain deep, persistent access to U.S. government communications via previously breached carriers. New implants observed include TernDoor, PeerTime, and BruiteEntry.

Telecom-adjacent DIB tenants should treat Salt Typhoon TTPs as living-off-the-land with router-CLI manipulation, native admin tools, and credential reuse. Hunt against published IoCs from FBI and CISA joint advisories. Maps to NIST 800-171 §3.14.6.

An Iranian-affiliated APT group has, since March 2026, disrupted programmable logic controllers (PLCs) deployed across multiple U.S. critical-infrastructure sectors, including government services and facilities. Disruption is achieved through malicious interactions with project files and manipulation of data displayed on HMI/SCADA panels.

OT operators should validate engineering-workstation isolation, project-file integrity baselines, and HMI tag-write authority. Preserve PLC ladder-logic snapshots and HMI screen-capture archives. Maps to NIST 800-82r3 and to NIST 800-171 §3.13.1 where OT/IT bridges exist.

The FBI issued an IC3 alert seeking public help to identify and contextualize Salt Typhoon victims, indicators of compromise, and targeting telemetry. The advisory is part of an active multi-agency investigation into the PRC-linked campaign against U.S. and allied telecommunications and government targets.

Affected organizations are directed to report through the IC3 portal and to preserve full network telemetry including NetFlow, DNS, and authentication logs. Maps to NIST 800-171 §3.6.2 (incident reporting).

The FBI IC3 issued a June 2, 2026 alert detailing Silent Ransom Group activity in which threat actors impersonate IT personnel via voice phishing to obtain credentials, deploy remote-monitoring-and-management tooling, and exfiltrate data prior to extortion. The group operates without traditional ransomware deployment.

Service-desk procedures must validate caller identity through out-of-band channels. Detect unauthorized RMM installs (ScreenConnect, AnyDesk, Atera) on user endpoints. Maps to NIST 800-171 §3.2.1 (security training) and §3.5.3.

DentaQuest disclosed a data breach on June 2, 2026 affecting approximately 2.6 million individuals. Exposed elements include names, dates of birth, contact information, government-issued identifiers, and health insurance information. Data was publicly leaked after a ShinyHunters extortion attempt failed.

HIPAA breach-notification clock applies to the covered entity and any business-associate handlers. Records-of-disclosure inventories must be updated; OCR breach portal entry expected. Maps to HIPAA Security Rule §164.308 and §164.312.

Carnival Corporation confirmed a cyber incident exposing personal information of nearly 6 million customers following claims by the ShinyHunters group of theft during an April intrusion. Exposed elements include names, addresses, dates of birth, contact information, and government-issued identifiers.

State breach-notification timelines apply across multiple jurisdictions. Carnival is expected to file with state attorneys general and offer credit monitoring. Maps to NIST 800-171 §3.6.2 where DIB cruise-logistics overlap exists.

A supply-chain attack on June 1, 2026 compromised at least 32 packages published under the @redhat-cloud-services npm namespace. Poisoned versions were published across all 32 packages within a 72-second window using automation, delivering the Miasma payload. The affected packages cover the entire Red Hat Hybrid Cloud Console JavaScript ecosystem with nearly 10 million collective downloads.

Miasma harvests GitHub Actions secrets, npm tokens, cloud credentials, Kubernetes/Vault material, SSH keys, Git credentials, and other sensitive files. SBOM audits and CI/CD secret rotation are mandatory for any consuming pipeline. Maps to NIST 800-218 SSDF and 800-171 §3.4.8 (denylist execution).

On June 5, 2026 the Miasma worm campaign reached Microsoft's Azure GitHub organizations as a downstream effect of the May 11 TanStack/Mini Shai-Hulud compromise. GitHub disabled 73 repositories across four Microsoft GitHub organizations to contain spread. Two OpenAI employee macOS devices were also compromised earlier in the chain.

The cascading TTPs are consistent with TeamPCP's Mini Shai-Hulud npm supply-chain campaign. Consuming organizations must rotate all GitHub PATs, npm publish tokens, and cloud-provider keys touched by affected CI runners. Maps to NIST 800-218 PO.5 and PW.4.