Weekly Threat Briefing — 2026-04-21 to 2026-04-27
21 findings8 sections
- Critical findings
- 0
- High findings
- 0
- CISA KEV additions
- 0
- First seen in this period
- 572 CVEs8,215 IOCs
First seen in this period: CVEs rated CVSS 7.0+ (NVD, GitHub, WordPress) · CISA KEV catalog additions · new abuse.ch indicators (ThreatFox, URLhaus, Feodo Tracker), dated by abuse.ch.
Priority queue
Act on these first
Critical and high findings from this briefing and its live updates. Most severe first, then newest.
- Critical severitySection VulnerabilitiesSource: KEV
- Critical severitySection VulnerabilitiesSource: KEV
- Critical severitySection VulnerabilitiesSource: KEV
- Critical severitySection VulnerabilitiesSource: CVE
- High severitySection VulnerabilitiesSource: KEV
- High severitySection VulnerabilitiesSource: KEV
- High severitySection VulnerabilitiesSource: KEV
- High severitySection VulnerabilitiesSource: CVE
- High severitySection VulnerabilitiesSource: CVE
- High severitySection VulnerabilitiesSource: CVE
Executive summary · as of 07:00 UTC
The situation
This week's threat landscape is dominated by critical vulnerabilities in network infrastructure and remote management software, alongside persistent IoT botnet activity. Six vulnerabilities were added to CISA's Known Exploited Vulnerabilities catalog, including critical remote code execution flaws in SimpleHelp (CVE-2024-57728), Marimo (CVE-2026-39987), and Samsung MagicINFO Server (CVE-2024-7399). The SimpleHelp vulnerabilities are particularly concerning as they enable privilege escalation and arbitrary code execution, posing significant risk to organizations using this remote support tool.
The NVD database revealed 30 additional high and critical severity vulnerabilities, with a concentration of buffer overflow vulnerabilities affecting Tenda router models and command injection flaws in various MCP (Model Context Protocol) implementations. These vulnerabilities demonstrate continued targeting of network edge devices and emerging AI/automation frameworks. The Tenda router vulnerabilities (CVE-2026-7019 through CVE-2026-7057) represent a coordinated disclosure of multiple remotely exploitable buffer overflows affecting the F456 and FH1202 models.
Malware distribution activity remains focused on IoT botnets, with 50 malicious URLs identified distributing Mirai and Mozi variants targeting multiple architectures. Notably, the ClearFake malware campaign continues with multiple distribution URLs detected, alongside AdaptixC2 and cryptocurrency mining payloads. The predominance of command injection and buffer overflow vulnerabilities, combined with active botnet campaigns, underscores the persistent threat to inadequately secured network infrastructure and IoT devices.
Browse the full briefing
21 findings · 8 sections- 4 critical
- 11 high
- 4 medium
- 2 info
- Vulnerabilities4 findingsCritical Remote Code Execution Vulnerabilities4 critical
- Vulnerabilities2 findingsPrivilege Escalation and Authorization Bypass2 high
- Vulnerabilities3 findingsNetwork Infrastructure and IoT Device Vulnerabilities3 high
- Vulnerabilities3 findingsCommand Injection in Emerging Technologies3 high
- Malware3 findingsIoT Botnet Distribution Activity2 high · 1 medium
- Malware2 findingsSocial Engineering and Cryptomining Campaigns2 medium
- Tools & Techniques2 findingsBrowser and Application Memory Corruption1 high · 1 medium
- DFIR Lab2 findingsDetection Engineering and Threat Intelligence Resources2 info
Critical Remote Code Execution Vulnerabilities
Multiple critical RCE vulnerabilities added to CISA KEV catalog require immediate patching
- Critical severityCVE-2026-39987: Marimo Pre-Authentication Remote Code Execution (opens the source in a new tab)
Marimo contains a pre-authorization remote code execution vulnerability allowing unauthenticated attackers to gain shell access and execute arbitrary system commands. This represents a complete system compromise vector requiring no authentication.
- Critical severityCVE-2024-57728: SimpleHelp Path Traversal Leading to RCE (opens the source in a new tab)
SimpleHelp remote support software contains a path traversal vulnerability (zip slip) allowing admin users to upload arbitrary files anywhere on the file system, leading to arbitrary code execution in the context of the SimpleHelp server user.
- Critical severityCVE-2024-7399: Samsung MagicINFO 9 Server Path Traversal (opens the source in a new tab)
Samsung MagicINFO 9 Server path traversal vulnerability enables attackers to write arbitrary files with SYSTEM authority, providing complete system-level access to digital signage infrastructure.
- Critical severityCVE-2026-7037: Totolink A8000RU Remote OS Command Injection (opens the source in a new tab)
Critical remote OS command injection in Totolink A8000RU router (CVSS 9.8) affecting setVpnPassCfg function in CGI handler, allowing unauthenticated remote code execution.
Privilege Escalation and Authorization Bypass
Multiple vulnerabilities enabling privilege escalation in enterprise software platforms
- High severityCVE-2024-57726: SimpleHelp Missing Authorization Vulnerability (opens the source in a new tab)
Missing authorization flaw allows low-privileged SimpleHelp technicians to create API keys with excessive permissions, enabling privilege escalation to server admin role. Combined with CVE-2024-57728, this creates a critical attack chain.
- High severityCVE-2026-33825: Microsoft Defender Privilege Escalation (opens the source in a new tab)
Insufficient granularity of access control in Microsoft Defender allows authorized attackers to escalate privileges locally, potentially compromising endpoint security controls.
Network Infrastructure and IoT Device Vulnerabilities
Extensive vulnerabilities in network edge devices enabling remote compromise
- High severityCVE-2025-29635: D-Link DIR-823X Command Injection (opens the source in a new tab)
D-Link DIR-823X routers vulnerable to command injection via POST request to /goform/set_prohibiting. Product may be end-of-life with no patches available, requiring device replacement.
- High severityMultiple Tenda Router Buffer Overflow Vulnerabilities (CVE-2026-7019 to CVE-2026-7057) (opens the source in a new tab)
Coordinated disclosure of 15+ remotely exploitable buffer overflow vulnerabilities in Tenda F456 and FH1202 router models (CVSS 8.8). Affects multiple httpd functions including SafeEmailFilter, RouteStatic, VirtualSer, and WrlclientSet. Public exploits available.
- High severityCVE-2026-7036: Tenda i9 Path Traversal Vulnerability (opens the source in a new tab)
Path traversal vulnerability in Tenda i9 router (CVSS 7.3) affecting R7WebsSecurityHandlerfunction in HTTP Handler component, enabling unauthorized file access.
Command Injection in Emerging Technologies
Multiple command injection vulnerabilities in Model Context Protocol implementations and AI tooling
- High severityCVE-2026-7064: AgentDeskAI browser-tools-mcp Command Injection (opens the source in a new tab)
Remote OS command injection in AgentDeskAI browser-tools-mcp (CVSS 7.3) affecting browser-connector.ts component. Public exploit available.
- High severityCVE-2026-7062: Intina47 context-sync Command Injection (opens the source in a new tab)
OS command injection in git integration component of context-sync package (CVSS 7.3), exploitable remotely with public exploit disclosure.
- High severityCVE-2026-7058: MiroFish Simulation IPC Command Injection (opens the source in a new tab)
Command injection vulnerability in MiroFish simulation IPC service (CVSS 7.3) affecting SimulationIPCClient.send_command function, enabling remote code execution.
IoT Botnet Distribution Activity
Extensive Mirai and Mozi botnet distribution targeting multiple IoT architectures
- High severityMulti-Architecture Mirai Distribution Campaign (opens the source in a new tab)
Multiple distribution URLs (85.11.167.177, 176.65.139.177) serving Mirai variants for ARM, MIPS, PowerPC, x86, and other architectures. Campaign named 'Yboats' and 'iran' targeting diverse IoT device types with User-Agent based payload delivery.
- High severityMozi Botnet Infrastructure Activity (opens the source in a new tab)
Active Mozi botnet distribution from multiple compromised hosts (91.80.188.11, 39.81.20.88, 59.88.37.134, 221.203.123.44) serving 32-bit ELF payloads targeting MIPS and ARM architectures. Persistent IoT compromise campaign.
- Medium severityAdaptixC2 Agent Distribution (opens the source in a new tab)
Windows-based AdaptixC2 agent distributed from 20.198.18.136:8080 (agent.x64.exe), demonstrating C2 framework deployment targeting Windows endpoints.
Social Engineering and Cryptomining Campaigns
ClearFake malware and cryptocurrency mining operations
- Medium severityClearFake Malware Distribution Network (opens the source in a new tab)
Multiple ClearFake distribution domains detected (nov2sirel.in.net subdomains, vortex-node.in.net) using consistent file naming pattern (load-file0dsdf567.chk). Social engineering campaign impersonating software updates.
- Medium severityAmadey-Delivered Cryptocurrency Miner (opens the source in a new tab)
CoinMiner payload (file_e1a96e130788ce89.exe) distributed via 91.92.241.243, dropped by Amadey botnet loader. Indicates active monetization through cryptomining operations.
Browser and Application Memory Corruption
Memory safety vulnerabilities in Firefox and legacy software requiring updates
- High severityCVE-2026-6786/CVE-2026-6785: Firefox and Thunderbird Memory Safety (opens the source in a new tab)
Memory corruption bugs in Firefox ESR 140.9 and Firefox 149 (CVSS 8.1) with potential for arbitrary code execution. Patched in Firefox ESR 140.10, Firefox ESR 115.35, and Firefox 150.
- Medium severityLegacy Software Buffer Overflow Vulnerabilities (opens the source in a new tab)
Buffer overflow vulnerabilities disclosed in legacy applications including CEWE Photoshow 6.3.4 (CVE-2018-25294), iSmartViewPro 1.5 (CVE-2018-25283), and Faleemi Desktop Software 1.8.2 (CVE-2018-25263), enabling local code execution.
Detection Engineering and Threat Intelligence Resources
New educational content published on YARA rules and IOC enrichment methodologies
- Info severityYARA Rules Tutorial: Writing Detection Rules from Scratch (opens the source in a new tab)
Comprehensive tutorial on developing YARA detection rules for malware analysis and threat hunting. Valuable resource for building custom detection capabilities.
Source: Blog - Info severityIOC Enrichment Explained: Why Multi-Source Threat Intelligence Matters (opens the source in a new tab)
Educational content on IOC enrichment methodologies and the importance of correlating threat intelligence from multiple sources for improved detection and response.
Source: Blog
Sources & Attribution
These briefings are compiled from publicly available threat-intelligence feeds, which may include CISA KEV, NIST NVD, the GitHub Advisory Database (OSV), abuse.ch, and Wordfence Intelligence. Data-breach and credential-leak items may include data from Have I Been Pwned and ransomware.live.
CVE® is a registered trademark of The MITRE Corporation. CVE Records are © The MITRE Corporation, reproduced under the CVE Program Terms of Use. WordPress vulnerability data is provided by Wordfence Intelligence, © Defiant, Inc. Breach data from Have I Been Pwned is licensed under CC BY 4.0.