Impacket

Search everything

Mentions · 7d0
Mentions · 30d1
All mentions2
First seenSep 11, 2026
Last mentioned8d ago

Timeline

2 articles · newest first

Operators hit FortiGate, FortiWeb and GlobalProtect to steal stored passwords

Group-IB and NyxLab tie the edge-device campaign to k0t and report more than 70,000 exposed credentials.

Cyber Security NewsOct 22, 06:30 UTC · 8d agoExploit / PoCExploitedCVE-2025-64446 CVE-2026-02575 · 3 reads

Critical Cisco FMC Flaws Actively Exploited to Gain Root Access and Deploy Malware

Threat actors actively exploit Cisco FMC CVE-2026-20079 (CVSS 10.0) for root access, with clusters linked to Sandworm and Qilin ransomware.

GBHackersSep 11, 05:30 UTC · Sep 11, 2026Exploit / PoCExploitedCVE-2026-20079 CVE-2026-203165 · 2 reads

Related CVEs

by mentions

CVE-2026-2007988%10.0
Authentication bypass to root access in Cisco Secure Firewall Management Center
published Mar 4, 2026Cisco Secure Firewall Management Center (FMC) Software (web interface)KEVPoC ×2
CVE-2025-6444691%9.8
Unauthenticated Path Traversal in Fortinet FortiWeb Enables Admin Command Execution
published Nov 14, 2025Fortinet FortiWebKEVPoC
CVE-2026-025795%7.8
Authentication Bypass in Palo Alto Networks PAN-OS GlobalProtect Portal and Gateway
published May 13, 2026Palo Alto Networks PAN-OS (GlobalProtect portal and gateway)KEVRansomware
CVE-2026-2031635%5.3
Hard-Coded Password Vulnerability in Cisco Secure Firewall Management Center
published Jul 29, 2026Cisco Secure Firewall Management Center (FMC)KEVRansomware

Appears with

Cisco Security Managerproduct · 1
Ateramalware · 1
FortiWebproduct · 1
Mimikatzmalware · 1
UAT-12197threat actor · 1
PAN-OSproduct · 1
Rclonemalware · 1
Fortinetvendor · 1
FortiGateproduct · 1
UAT-11823threat actor · 1
Ciscovendor · 1
NetExecmalware · 1
GlobalProtectproduct · 1
Cisco Talosorganization · 1
Sandwormthreat actor · 1
k0tthreat actor · 1

Entities are extracted by the model from each article. First seen Sep 11, 2026, last mentioned 8d ago. Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.