IMPRIMIS CYBER INTELLIGENCE

Threat actors are actively exploiting a chained vulnerability in BerriAI LiteLLM, a widely deployed open-source AI proxy gateway. CVE-2026-42271 (command injection in MCP test endpoints) combined with CVE-2026-48710 (a Starlette Host-header validation bypass) yields unauthenticated remote code execution with a combined CVSS of 10.0. CISA added CVE-2026-42271 to the KEV catalog on June 8, 2026.

Successful exploitation exposes model-provider credentials, stored API keys, and downstream AI infrastructure — a direct CUI and credential-exposure concern under NIST 800-171 §3.1 (Access Control) and §3.13 (System and Communications Protection). CISA set a federal remediation deadline of June 22, 2026; fixed in LiteLLM v1.83.7.

CISA ordered federal agencies to secure Check Point Remote Access VPN and Mobile Access deployments against CVE-2026-50751, an authentication-bypass flaw (CVSS 9.3) exploited as a zero-day. Unauthenticated attackers can establish a VPN session on Mobile Access/SSL VPN, Remote Access VPN, or Spark firewalls. Forensic evidence places first exploitation on May 7, 2026; hotfixes shipped June 8.

Added to the KEV catalog with a three-day remediation order under BOD 22-01 (secure by June 11). VPN boundary compromise maps to NIST 800-171 §3.13.1 (boundary protection) and §3.5.3 (multifactor authentication) and is a priority finding for any remote-access architecture.

A stack-based buffer overflow in the Windows Netlogon service (CVSS 9.8) is under active exploitation. An unauthenticated remote attacker can send a crafted request to a domain controller and execute arbitrary code with SYSTEM privileges. Microsoft addressed the flaw in its Patch Tuesday cycle; priority patching is advised for all domain controllers.

Domain-controller compromise is a worst-case identity event affecting NIST 800-171 §3.1 (Access Control) and §3.5 (Identification and Authentication). Organizations should treat any unpatched DC as presumed-exposed and review authentication logs for anomalous Netlogon traffic.

On June 9, 2026, CISA added CVE-2026-20245, an improper output-encoding/escaping vulnerability in Cisco Catalyst SD-WAN Manager, to the Known Exploited Vulnerabilities catalog, confirming real-world exploitation against the network-management plane.

SD-WAN management compromise threatens network segmentation integrity and configuration assurance under NIST 800-171 §3.13.1 and §3.4 (Configuration Management). KEV listing imposes binding federal remediation timelines under BOD 22-01.

CISA added CVE-2026-35273, a missing-authentication-for-critical-function vulnerability in Oracle PeopleSoft Enterprise PeopleTools, to the KEV catalog on June 12, 2026. The flaw permits access to critical functionality without authentication on exposed PeopleSoft deployments.

ERP/HCM platforms frequently process PII and sensitive business data; missing authentication maps to NIST 800-171 §3.5.1/§3.5.2 and §3.1.1. Internet-exposed PeopleSoft instances should be prioritized for patching and access review.

CISA flagged CVE-2022-0492, a Linux kernel improper-authentication flaw in the cgroups v1 release_agent feature, as actively exploited and linked to ransomware deployment. The flaw allows privilege escalation and container escape on affected systems.

Container-escape and privilege-escalation risk on Linux hosts affects NIST 800-171 §3.1.5 (least privilege) and §3.4.2 (security configuration enforcement). CISA mandated federal remediation by June 5, 2026; legacy kernels remain widely deployed.

Palo Alto Networks warned of CVE-2026-0300 (CVSS 9.3), a critical firewall vulnerability with limited observed exploitation targeting User-ID Authentication Portals exposed to untrusted IPs or the public internet. A patch is forthcoming; exploitation requires internet-exposed endpoints.

Perimeter firewall/identity-portal exposure maps to NIST 800-171 §3.13.1 (boundary protection) and §3.14 (system monitoring). Organizations should restrict User-ID portal exposure and monitor for anomalous authentication while awaiting the vendor fix.

Under the FY2026 NDAA, June 1, 2026 was the statutory deadline for the Secretary of War to harmonize cybersecurity requirements applicable to the Defense Industrial Base, part of broader Defense Acquisition reforms requiring FAR and DFARS revisions before the end of June 2026.

DIB contractors should expect tighter alignment across DFARS 252.204-70xx clauses and CMMC. Programs handling FCI/CUI should review flow-down obligations and prepare for accelerated harmonized assessment expectations.

Following the final CMMC DFARS rule (effective November 10, 2025), the DoD may begin conditioning awards of relevant solicitations on Level 2 C3PAO and Level 3 DIBCAC assessment requirements starting November 10, 2026, with full mandatory inclusion in all applicable contracts by November 10, 2028.

Contractors targeting Level 2 must complete C3PAO assessment ahead of the November 2026 window. Self-attestation gaps now translate directly into bid eligibility risk under NIST 800-171 Rev. 2 control implementation.

A report covered June 10, 2026 warns that the Pentagon and its contractors require proactive defenses against infostealer malware. Stolen government or contractor credentials can provide adversaries footholds into the broader DIB, where third-party and supply-chain access is as consequential as primary network access.

Infostealer-harvested credentials undermine NIST 800-171 §3.5 (Identification and Authentication) and §3.1 (Access Control). The guidance reinforces continuous credential hygiene, MFA enforcement, and supply-chain access governance across the DIB.

FedRAMP will finalize its Consolidated Rules for 2026 by the end of June, providing standardized guidance through 2028 and taking effect at the start of July with optional transition periods extending toward January 1, 2027. The rules also retire Low/Moderate/High baselines in favor of lettered Certification Classes A–D.

Cloud service providers and agencies relying on FedRAMP authorizations must map existing baselines to the new Certification Classes. The change affects authorization boundaries and continuous-monitoring obligations referenced by NIST SP 800-53 control selection.

Microsoft's June 2026 Patch Tuesday addressed roughly 200 vulnerabilities — the largest single release in program history — including multiple publicly disclosed zero-days such as a BitLocker security-feature bypass (CVE-2026-50507), an HTTP.sys denial-of-service (CVE-2026-49160), and a CTFMON elevation-of-privilege flaw (CVE-2026-45586). The update included roughly 33 Critical-rated issues, most enabling remote code execution.

The volume reflects a sustained 'new normal' of 200+ CVE cycles, straining patch-management SLAs under NIST 800-171 §3.4.2 and §3.14.1 (flaw remediation). Organizations should prioritize Critical RCE and the disclosed zero-days in the current maintenance window.

On June 9, 2026, CISA added CVE-2026-11645, an out-of-bounds read and write vulnerability in the Google Chromium V8 JavaScript engine, to the Known Exploited Vulnerabilities catalog, confirming active exploitation. The flaw affects Chrome and Chromium-based browsers across the enterprise.

Browser-engine exploitation is a primary initial-access vector affecting NIST 800-171 §3.14.1 (flaw remediation) and §3.13.13 (mobile-code control). Enterprise browser fleets should be confirmed on patched Chromium builds via managed update channels.

Researchers disclosed CIFSwitch, a vulnerability resident in the Linux kernel for roughly 19 years that lets low-privileged users obtain root on numerous distributions. A one-character flaw enables local root access, and proof-of-concept exploit code is now publicly available.

Public PoC availability sharply raises near-term exploitation risk on multi-user Linux hosts under NIST 800-171 §3.1.5 (least privilege) and §3.4.2. Inventory and patch exposed Linux endpoints and servers, prioritizing shared/interactive systems.

SecurityWeek reported a newly disclosed Linux kernel vulnerability dubbed Fragnesia that allows local root privilege escalation. The flaw adds to a cluster of June Linux kernel privilege-escalation disclosures affecting a broad range of distributions.

Privilege-escalation primitives in the kernel undermine host-level least-privilege enforcement (NIST 800-171 §3.1.5, §3.4.2). Defenders should track distribution advisories and apply kernel updates as vendors release fixes.

A vulnerability in the SSH subsystem of Cisco Adaptive Security Appliance (ASA) Software allows an authenticated remote attacker to execute operating-system commands as root. The issue was reported among a wave of network-vendor advisories highlighted by CISA covering Fortinet, Palo Alto, and Cisco.

Root command execution on a security appliance collapses the trust boundary it is meant to enforce, mapping to NIST 800-171 §3.13.1 and §3.1.5. Restrict and monitor management-plane SSH access and apply Cisco fixes promptly.

A supply-chain attack compromised dozens of packages published under the @redhat-cloud-services npm namespace, deploying credential-stealing malware. The campaign, dubbed 'Miasma: The Spreading Blight,' is a variant of the Mini Shai-Hulud family and bypassed code review to push its payload; affected versions averaged tens of thousands of weekly downloads.

Developer and CI/CD credential theft via the software supply chain maps to NIST 800-171 §3.4 (Configuration Management) and §3.1 (Access Control), and underscores SBOM and dependency-pinning controls. Organizations should audit npm dependency trees and rotate exposed CI/CD secrets.

Snyk is tracking a June 2026 node-gyp supply-chain compromise covering 57 affected packages across hundreds of malicious versions, all classified as embedded malicious code at Critical severity. A weaponized binding.gyp triggers node-gyp to execute attacker-controlled code during npm install, harvesting credentials across npm, GitHub, AWS, GCP, Azure, HashiCorp Vault, and Kubernetes.

Self-propagating install-time worms threaten build pipelines directly, implicating NIST 800-171 §3.4.1/§3.4.2 and §3.5 credential controls. Pin dependencies, disable install scripts where feasible, and rotate any credentials exposed to compromised build agents.

Check Point linked the active VPN zero-day exploitation (CVE-2026-50751) to Qilin ransomware affiliates. Qilin has been associated with over 400 victims globally across critical infrastructure, government, healthcare, and the private sector, leveraging the VPN authentication bypass for initial access.

Ransomware initial access via perimeter VPN reinforces the priority of boundary protection and MFA (NIST 800-171 §3.13.1, §3.5.3) plus tested incident-response and backup recovery (§3.6, §3.8.9). Treat Qilin TTPs as an active threat to any Check Point remote-access deployment.

Evanston Township High School near Chicago suffered a ransomware attack on Sunday, June 7, 2026, and did not reopen until midweek at the earliest. The incident forced closure of operations, illustrating continued ransomware pressure on the education sector.

Operational-disruption ransomware against a public institution highlights the importance of segmentation, offline backups, and tested recovery (NIST 800-171 §3.8.9, §3.6.1). Education and small-organization targets remain attractive due to constrained security resources.

7-Eleven confirmed a data breach after the ShinyHunters group claimed to have stolen information from its systems and issued a ransom demand. The disclosure adds the convenience-retail giant to a string of ShinyHunters-linked extortion incidents.

Extortion-driven breaches reinforce data-inventory, encryption, and access-logging obligations (NIST 800-171 §3.1, §3.13.11, §3.3 audit and accountability). Affected retailers should validate scope and notify per applicable state breach-notification law.

ServiceNow disclosed a security incident in which attackers exploited a flaw to query customer instance tables. On June 5, 2026, ServiceNow applied a security update to hosted customer instances and confirmed that customer data was exposed.

SaaS platform exposure shifts breach risk to tenant data governance and shared-responsibility boundaries (NIST 800-171 §3.1.3 information flow, §3.13.11 cryptographic protection). Customers should review instance audit logs and confirm exposure scope with the vendor.

Carnival disclosed a personal-data breach affecting nearly six million people, reported in the data-breach roundup for the week of June 5–11, 2026. The disclosure represents one of the larger consumer-data exposures of the period.

Large-scale PII exposure triggers multi-jurisdiction breach-notification obligations and underscores data-minimization and encryption-at-rest controls (NIST 800-171 §3.13.11, §3.1.3). Scale increases downstream phishing and identity-fraud risk for affected individuals.

Xsolis confirmed a data breach affecting individuals' personal information, with attorneys announcing investigations into the incident in June 2026. The healthcare-analytics provider's exposure places sensitive health-related data at risk.

Healthcare-adjacent data exposure raises HIPAA and state breach-law exposure alongside NIST 800-171 §3.1 and §3.13.11 considerations for organizations handling sensitive data. Impacted parties should monitor for notification and identity-protection guidance.

SoFi Hong Kong warned that it suffered a data breach after attackers gained access to a database at a third-party vendor containing customer information, as reported in the June 12, 2026 news roundup. The incident is a fresh example of vendor-driven data exposure in financial services.

Third-party/vendor breaches reinforce supply-chain risk-management and vendor access governance (NIST 800-171 §3.1.1, §3.12 security assessment, and DFARS flow-down expectations). Financial firms should reassess third-party data-handling and contractual security controls.