CISA Mandates Urgent Patches for Exploited Ivanti & Oracle Flaws; Global Crackdowns Target Cybercrime Infrastructure

The 2026 Verizon DBIR update provides more granular details on ransomware, noting its presence in 48% of all breaches (up from 44%), with the percentage of victims paying ransom dropping to 31% and the median payment slightly decreasing to $139,875. Additionally, the report highlights that threat actors are leveraging generative AI to increase the speed and scale of their attacks, from reconnaissance to malware development, further shrinking the window for defenders to patch vulnerabilities.

The critical Ivanti Sentry vulnerability, CVE-2026-10520, is now confirmed to be under active exploitation, leading the U.S. Cybersecurity and Infrastructure Security Agency (CISA) to add it to its Known Exploited Vulnerabilities (KEV) catalog. CISA has issued an emergency directive requiring federal agencies to patch the flaw by June 15, 2026. Security researchers report widespread exploitation attempts against internet-exposed Sentry admin portals, warning that unpatched systems are likely already compromised. This significantly increases the urgency and severity of the threat, moving from potential to confirmed active attacks.

New technical analysis of the 'GreatXML' exploit reveals specific attack steps, including planting both `unattend.xml` and `ReAgent.xml` files on the recovery partition. The exploit was demonstrated on Windows 11 24H2. The report details the process from gaining physical access to achieving a SYSTEM-level command prompt within WinRE. MITRE ATT&CK TTPs identified include T1068, T1547.001, and T1007. Additional mitigation strategies like Secure Boot, BIOS/UEFI passwords, and BitLocker with TPM+PIN are suggested. The researcher is identified as Nightmare Eclipse, providing further context to the ongoing disclosures.

The critical Oracle PeopleSoft zero-day, CVE-2026-35273, has been added to CISA's Known Exploited Vulnerabilities (KEV) catalog, requiring federal agencies to remediate by June 15, 2026. A joint report by Mandiant and Google confirms ShinyHunters breached over 100 organizations, with 68% in the U.S. higher education sector, exploiting the 9.8 CVSS flaw between late May and early June 2026. This update provides a more precise victim count, a confirmed CVSS score, and highlights the increased urgency due to CISA's mandate.