What is the Vulnerability?

What is the recommended Mitigation?

Organizations should:

• Immediately upgrade to the latest patched UniFi OS release.
• Restrict UniFi management interfaces to trusted administrative networks.
• Avoid exposing UniFi OS management portals directly to the Internet.
• Monitor logs for suspicious authentication attempts and command execution.
• Review systems for indicators of compromise if Internet exposure existed prior to patching.
• Apply network segmentation and least-privilege administrative access.

What FortiGuard Coverage is available?

• FortiGuard Intrusion Prevention System (IPS) protects against exploit attempts. Intrusion Prevention | FortiGuard Labs
• FortiGuard Web Filtering blocks access to known malicious infrastructure used to host payloads or support post-exploitation command-and-control activity.
• FortiGuard Antivirus detects and blocks malware payloads, web shells, and other malicious files delivered following successful exploitation.
• FortiEDR detects suspicious post-exploitation behavior, including unauthorized command execution, persistence mechanisms, privilege abuse, and lateral movement originating from compromised systems.
• FortiGuard Incident Response Service assists organizations in investigating potential compromise, determining the scope of attacker activity, and supporting containment, remediation, and recovery efforts following exploitation.

What is the Vulnerability?

What is the recommended Mitigation?

Affected:
Ivanti Sentry 10.5.1 and earlier
Ivanti Sentry 10.6.1 and earlier
Ivanti Sentry 10.7.0 and earlier

Fixed:
10.5.2
10.6.2
10.7.1

Recommended Actions
• Immediately upgrade to Ivanti Sentry 10.5.2, 10.6.2, or 10.7.1.
• Assume internet-exposed, unpatched appliances may already be compromised.
• Review administrative accounts for unauthorized additions.
• Search for web shells, persistence mechanisms, and suspicious root-level processes.
• Rotate credentials and invalidate tokens if compromise is suspected.
• Monitor for exploitation attempts and anomalous outbound connections.
• Enable IPS protections and virtual patching while emergency updates are being deployed.

What FortiGuard Coverage is available?

• FortiGuard IPS protects against exploit attempts targeting vulnerable Ivanti Sentry appliances. Intrusion Prevention | FortiGuard Labs
• FortiGuard Web Filtering blocks access to known malicious infrastructure used to host payloads or support post-exploitation command-and-control activity.
• FortiGuard AntiVirus detects and blocks malware payloads, web shells, and other malicious files delivered following successful exploitation.
• FortiEDR detects suspicious post-exploitation behavior, including unauthorized command execution, persistence mechanisms, privilege abuse, and lateral movement originating from compromised systems.
• FortiGuard Incident Response Service assists organizations in investigating potential compromise, determining the scope of attacker activity, and supporting containment, remediation, and recovery efforts following exploitation.

What is the Attack?

What is the recommended Mitigation?

Affected:
Splunk Enterprise 10.2 prior to 10.2.4
Splunk Enterprise 10.0 prior to 10.0.7

Upgrade to:
Splunk Enterprise 10.2.4 or later
Splunk Enterprise 10.0.7 or later

If immediate patching is not possible:
• Disable the PostgreSQL sidecar service as recommended by Splunk.
• Restrict network access to Splunk management interfaces.
• Monitor for unexpected file creation or service behavior.
• Review logs for suspicious unauthenticated access attempts.

What FortiGuard Coverage is available?

• FortiGuard IPS provides protection against exploit attempts targeting vulnerable services.
• FortiGuard Web Filtering blocks access to known malicious infrastructure used during exploitation.
• FortiGuard AntiVirus detects and blocks malware payloads delivered following successful exploitation.
• FortiEDR detects suspicious post-exploitation behavior, including unauthorized file modifications and persistence techniques.
• FortiGuard Incident Response Service assists organizations in investigating and determining the scope of compromise, and supporting remediation efforts following exploitation.

What is the Attack?

What is the recommended Mitigation?

Potentially exposed systems include:
Internet-facing Oracle PeopleSoft deployments.

• Immediately apply Oracle's security updates for CVE-2026-35273.
• Restrict external access to PeopleSoft Environment Management services.
• Review logs for suspicious activity between May 27 and June 9, 2026.
• Hunt for unauthorized MeshCentral agents and remote management tools.
• Monitor for unusual administrative activity, data access, and large outbound transfers.
• Conduct compromise assessments on exposed PeopleSoft systems.

What FortiGuard Coverage is available?

• FortiGuard IPS: Detects and blocks exploitation attempts targeting Oracle PeopleSoft vulnerabilities. Intrusion Prevention | FortiGuard Labs
• FortiGuard Web Filtering: Blocks access to known malicious infrastructure and command-and-control domains.
• FortiGuard AntiVirus and Behavior-Based Detection: Detects Mesh-Central-based payloads and malicious post-exploitation activity.
• FortiEDR and FortiXDR: Identify suspicious remote administration activity, persistence mechanisms, and lateral movement behavior.
• FortiSIEM and FortiAnalyzer: Provide visibility into exploitation attempts and post-compromise activity across the environment.

What is the Vulnerability?

What is the recommended Mitigation?

• Restrict access to SD-WAN Manager administrative interfaces to trusted management networks.
• Review Cisco-provided indicators of compromise and audit logs for evidence of suspicious file uploads, root-level activity, or unauthorized configuration changes.
• Verify the integrity of SD-WAN edge device configurations and policies.
• Rotate privileged SD-WAN credentials and investigate potential credential exposure.
• Monitor Cisco security advisories and apply updates immediately once a fix becomes available.
• Engage incident response procedures if signs of compromise are identified, as patching alone may not remediate an already compromised environment.

What FortiGuard Coverage is available?

• FortiGuard Antivirus & Behavior Detection: Detects and blocks malicious payloads and abnormal process execution that may result from successful exploitation.
• FortiGuard Incident Response Service: Assists organizations in investigating potential compromise, identifying attacker activity, and supporting remediation efforts.
• FortiGuard Managed Detection and Response (MDR): Provides continuous monitoring and detection of post-exploitation activity, privilege escalation attempts, and unauthorized configuration changes within affected environments.

What is the Attack?

What is the recommended Mitigation?

• Audit all recently installed npm dependencies for unauthorized or suspicious packages.
• Implement software composition analysis (SCA) and dependency monitoring solutions.
• Enforce package integrity verification and package provenance validation.
• Rotate npm, GitHub, cloud, and CI/CD credentials if compromise is suspected.
• Restrict the use of long-lived access tokens and enforce least-privilege permissions.
• Monitor developer endpoints and build systems for unusual network activity.
• Implement continuous monitoring for unauthorized package publishing activity.
• Review software supply chain security controls and dependency approval processes.

What FortiGuard Coverage is available?

• FortiGuard Antivirus & Behavior Detection: Detects and blocks malware components, credential theft modules, and suspicious behaviors associated with malicious npm packages and multi-stage payload delivery.
• FortiGuard IOC Service: Added coverage for all publicly disclosed malicious infrastructure and indicators of compromise associated with this campaign at the time of publication.
• FortiGuard IPS Service: Provides protection against known command-and-control communications, malware delivery infrastructure, and exploitation techniques used by follow-on payloads.
• FortiGuard Attack Surface Security Service: Helps identify exposed developer assets, CI/CD infrastructure, and internet-facing systems that may be leveraged following a credential compromise.
• FortiGuard Incident Response Service: Assists organizations in investigating software supply chain compromises, identifying affected systems, assessing credential exposure, and supporting remediation efforts.
• FortiGuard Managed Detection and Response (MDR) Service: Provides continuous monitoring and threat hunting to identify suspicious package activity, credential abuse, unauthorized cloud access, and post-compromise attacker activity.

What is the Vulnerability?

What is the recommended Mitigation?

Affected products include vulnerable versions of:
Palo Alto Networks PAN-OS with GlobalProtect enabled.
Prisma Access deployments running vulnerable releases.

According to Palo Alto Networks, Panorama and Cloud NGFW are not affected by this vulnerability.

Recommended Actions
• Upgrade PAN-OS and Prisma Access deployments to fixed versions identified by Palo Alto Networks.
• Disable authentication override cookies if operationally feasible.
• Review GlobalProtect configurations for affected authentication settings.
• Monitor VPN authentication logs for anomalous or unauthorized access.
• Investigate successful VPN connections originating from unexpected users, geographies, or devices.
• Validate that all externally exposed GlobalProtect gateways are fully patched.

What FortiGuard Coverage is available?

• FortiGuard Intrusion Prevention System (IPS) Service: Provides protection against exploitation attempts targeting CVE-2026-0257 and related GlobalProtect authentication bypass activity.
• FortiGuard Antivirus & Behavior Detection: Detects and blocks malware or post-compromise activity that may be delivered following unauthorized VPN access.
• FortiGuard Attack Surface Security Service: Helps identify externally exposed PAN-OS GlobalProtect services and vulnerable internet-facing assets.
• FortiGuard Incident Response Service: Assists organizations in investigating unauthorized VPN access, determining the scope of compromise, and supporting remediation efforts following exploitation.

What is the Vulnerability?

What is the recommended Mitigation?

Affected products include Check Point Remote Access VPN, Mobile Access, and Spark Firewall deployments utilizing IKEv1. Organizations running legacy VPN configurations should immediately apply the vendor hotfixes and assess exposed VPN gateways for signs of unauthorized access.

• Check Point Remote Access VPN
• Check Point Mobile Access
• Check Point Spark Firewall
• Deployments configured to use the deprecated IKEv1 key exchange protocol

Recommended Actions
• Apply the latest Check Point hotfixes and security updates immediately.
• Disable IKEv1 where operationally feasible and migrate to supported VPN configurations.
• Review VPN logs for suspicious authentication activity and unexpected remote access sessions.
• Investigate any unauthorized VPN connections originating from unknown users or devices.
• Conduct threat hunting activities to identify potential post-compromise activity following successful VPN access.
• Reset credentials and review privileged account activity if compromise is suspected.

What FortiGuard Coverage is available?

• FortiGuard Antivirus & Behavior Detection: Detects malware and suspicious behaviors associated with ransomware operators and threat actors leveraging compromised VPN access for lateral movement and payload deployment.
• FortiGuard Managed Detection and Response (MDR): Provides continuous monitoring and detection of post-exploitation activity, privilege escalation attempts, and unauthorized configuration changes within affected environments.
• FortiGuard Incident Response Services: Organizations that suspect exposure or compromise resulting from exploitation of CVE-2026-50751 should engage FortiGuard Incident Response for investigation, containment, and remediation assistance.

What is the Vulnerability?

What is the recommended Mitigation?

• Immediately apply Microsoft's May 2026 security updates addressing CVE-2026-41089.
• Prioritize patching all internet-facing or externally accessible domain controllers.
• Restrict RPC access to domain controllers wherever operationally feasible.
• Review domain controller logs for unusual Netlogon, RPC, or authentication-related activity.
• Monitor for unexpected account creation, privilege escalation, or Group Policy modifications.
• Validate that domain controller backups are current and recoverable.
• Conduct threat hunting activities to identify signs of post-exploitation activity in Active Directory environments.

What FortiGuard Coverage is available?

• FortiGuard Intrusion Prevention System (IPS) Service: Provides protection against known exploitation techniques and suspicious activity targeting the Windows Netlogon Remote Code Execution Vulnerability. Intrusion Prevention | FortiGuard Labs
• FortiGuard Endpoint Vulnerability Service provides a systematic and automated method of patching applications on an endpoint, eliminating manual processes while reducing the attack surface. Endpoint Vulnerability | FortiGuard Labs
• FortiGuard Antivirus & Behavior Detection: Protects against malicious payloads and post-exploitation activity associated with compromised Windows domain controllers, including privilege escalation, unauthorized account creation, credential theft, lateral movement, suspicious process execution, and attempts to establish persistence within Active Directory environments.
• FortiGuard Incident Response: Organizations that suspect exposure or compromise involving vulnerable Windows domain controllers should engage FortiGuard Incident Response for rapid investigation, compromise assessment, containment, forensic analysis, Active Directory recovery support, and remediation.
• FortiGuard Web Filtering: Prevents access to known malicious infrastructure, attacker-controlled domains, and command-and-control servers leveraged in campaigns targeting vulnerable Windows environments and domain services.
• FortiGuard Labs Threat Intelligence: FortiGuard Labs continues to monitor active exploitation activity, emerging attacker techniques, and infrastructure associated with CVE-2026-41089 to provide timely protection updates, threat intelligence, and actionable guidance for defenders.

What is the Vulnerability?

What is the recommended Mitigation?

• Affected versions include cPanel & WHM releases prior to:

11.110.0.97
11.118.0.63
11.126.0.54
11.132.0.29
11.134.0.20
11.136.0.5

Organizations should immediately:
• Upgrade to vendor-fixed releases
• Restrict exposure of WHM administrative interfaces
• Review session directories and authentication logs
• Rotate administrative credentials
• Hunt for suspicious session creation activity

What FortiGuard Coverage is available?

• FortiGuard Intrusion Prevention System (IPS) Service: FortiGuard IPS Service provides coverage to detect and block exploitation attempts targeting CVE-2026-41940, including malicious authentication bypass attempts against vulnerable cPanel & WHM deployments.

• FortiGuard Antivirus & Behavior Detection: Protects against malicious payloads and post-exploitation activity associated with compromised cPanel environments, including detection of suspicious administrative session creation, web shell deployment, unauthorized privilege escalation, and abnormal process execution originating from exploited hosting infrastructure.

• FortiGuard Web Application Firewall (WAF): FortiGuard WAF provides protection against authentication bypass attempts, malicious HTTP requests, CRLF injection abuse, and suspicious session manipulation targeting vulnerable cPanel & WHM services.

• FortiGuard Web Filtering: Blocks access to known malicious domains, attacker-controlled infrastructure, and command-and-control servers associated with exploitation campaigns targeting exposed cPanel administrative interfaces.

• FortiGuard Incident Response: Organizations that suspect compromise or unauthorized administrative access involving CVE-2026-41940 should engage FortiGuard Incident Response for rapid investigation, persistence analysis, credential exposure assessment, containment, and remediation.

• FortiGuard Labs Threat Intelligence: FortiGuard Labs continues to monitor active exploitation activity, emerging indicators of compromise, attacker infrastructure, and evolving tactics associated with CVE-2026-41940 to provide timely protections and actionable intelligence updates.