Active Exploitation of Critical Zero-Days in Microsoft Exchange and Cisco SD-WAN; Windows Flaws Exposed by Public PoCs

The Canadian Centre for Cyber Security has confirmed active exploitation of CVE-2026-20182, noting attackers have successfully escalated privileges to root. This update also highlights that threat actors continue to exploit older SD-WAN vulnerabilities. Comprehensive new sections on detection, response, and mitigation strategies, including auditing logs, monitoring configuration drift, SSH key auditing, and network baselining, have been provided to help organizations defend against this critical threat. Specific guidance on restricting management access and network segmentation is also included.

The actively exploited Exchange zero-day, CVE-2026-42897, has new technical details. Microsoft confirmed no patch in May 2026 Patch Tuesday. The vulnerability's impact is further detailed, including potential for credential theft, session hijacking, data exfiltration, and broader network intrusions. Crucially, new cyber observables and hunting hints are provided, such as specific URL patterns, IIS log monitoring for script tags, and EDR checks for w3wp.exe spawning cmd.exe or powershell.exe. Detection and mitigation guidance is expanded with more specific actions for EEMS, IIS logs, EDR, and network monitoring.

The Belarus-aligned FrostyNeighbor (Ghostwriter) APT continues its campaign against Ukrainian government organizations, active since March 2026. ESET has now released specific Indicators of Compromise (IOCs) to aid defenders. The group's geofenced infrastructure performs detailed validation, including IP address and user agent checks, before delivering JavaScript-based payloads. This update provides actionable intelligence for detection and mitigation efforts against this persistent cyber-espionage threat.

The new article provides additional context regarding the YellowKey and GreenPlasma zero-day exploits. It highlights that the PoCs were released immediately after Microsoft's May Patch Tuesday, emphasizing the lack of official patches. The affected server versions for GreenPlasma are updated to include Windows Server 2026. Crucially, the article references the researcher's past disclosure of 'BlueHammer,' which was subsequently exploited, reinforcing the high likelihood of these new exploits being weaponized by threat actors.

The latest analysis of Rex Ransomware provides explicit command-line usage for deleting Volume Shadow Copies (vssadmin.exe Delete Shadows /all /quiet), offering a more precise indicator for detection. Additionally, the report expands on MITRE ATT&CK techniques, including T1071.001 (Web Protocols) and T1567 (Exfiltration Over Web Service) for data exfiltration, and T1112 (Modify Registry) for potential persistence. Enhanced detection methods now include specific behavioral monitoring for these commands, and mitigation advice emphasizes immutable offline backups, network segmentation, and least privilege principles.