New SharkLoader Malware Deploys Cobalt Strike in StrikeShark Cyberattacks

Apache Shiro versions before 1.2.5 use a hard-coded default cryptographic key (CWE-321) to encrypt the 'remember me' session cookie when administrators have not configured their own key. A remote attacker who knows this default key can craft a malicious remember-me cookie/request parameter containing a crafted serialized Java object, triggering unsafe deserialization that yields arbitrary code execution or a bypass of the application's access restrictions. Successful exploitation gives an unauthenticated attacker control over the affected Java application with the privileges of the application process. Any application embedding a vulnerable Apache Shiro version is affected, including Apache Shiro directly, Apache Aurora, and Red Hat Fuse/JBoss Middleware products that bundle it. The flaw is confirmed exploited in the wild (listed in CISA KEV since 2021-11-03) with a very high predicted exploitation likelihood (EPSS 93.0%, 100th percentile), and a public proof-of-concept exploit is available.

Do: Upgrade Apache Shiro to 1.2.5 or later, applying the latest available vendor release; if upgrading is not immediately possible, configure a unique, strong cipher key for the remember-me feature rather than relying on the built-in default. Inventory applications that embed Shiro — including Red Hat Fuse, JBoss Middleware, and Apache Aurora deployments — and apply the vendor advisory updates required by the CISA KEV listing. Verify that no deployed application still uses the default remember-me key and monitor for exploitation attempts against internet-facing Java services.

CVE-2021-26855 is a server-side request forgery flaw (CWE-918) in Microsoft Exchange Server that allows an unauthenticated remote attacker to send specially crafted HTTP requests and have the Exchange server process them as itself, disclosing sensitive session information. When chained with sibling Exchange flaws (the 'ProxyLogon' chain), it yields authentication bypass and arbitrary file write, escalating to full remote code execution with SYSTEM-level privileges on the on-premises Exchange server. Any organization running an affected on-premises Exchange server reachable over HTTP/HTTPS (typically outbound webmail) is exposed; Exchange Online was not affected. Exploitation is confirmed in the wild at large scale: the flaw was mass-exploited beginning in early 2021 (notably by the HAFNIUM group), is on the CISA KEV with documented ransomware use, and has a maximum EPSS score of 100% (100th percentile), despite no public PoC listing.

Do: Apply the vendor's March 2021 Exchange security updates (or later cumulative updates) immediately, per the CISA required action; until patched, limit Exchange (ECP/OWA) exposure to the internet via firewall/VPN rules. Hunt for compromise: review IIS logs for unrecognized authenticated activity against FrontEnd HttpProxy endpoints, and check for malicious files or webshells under inetpub\wwwroot\aspnet_client, given the known ransomware use.

Microsoft SharePoint Server Remote Code Execution Vulnerability

CVE-2021-36260 is a command injection flaw (CWE-78) in the web server embedded in a wide range of Hikvision security camera and related devices, caused by insufficient input validation. An attacker triggers it by sending a crafted HTTP request to the device's web management interface, allowing commands to be executed on the device without authentication. Successful exploitation grants unauthenticated remote code execution on the camera or recorder, letting an attacker take control of the device, pivot into the surrounding network, or use the devices as a botnet platform. Any Hikvision device running the affected web server firmware is at risk, which includes cameras, recorders, and other surveillance hardware deployed in homes, businesses, and government facilities. Exploitation is confirmed in the wild: the flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2022-01-10 and carries a 99.9% EPSS probability of exploitation within 30 days, while no public proof-of-concept code is cataloged in the provided data and no CVSS score has been issued yet.

Do: Apply firmware updates issued by Hikvision per the vendor's instructions, as required by CISA's KEV listing for this vulnerability. Restrict the device web management interface to trusted networks or VPN access and avoid direct internet exposure. Review web server logs for anomalous HTTP requests to the device interface and signs of command execution, and prioritize internet-facing devices for patching first.

CVE-2022-27925 is a directory traversal flaw (CWE-22) in the mailbox import (mboximport) functionality of Synacor Zimbra Collaboration Suite (ZCS), which accepts a ZIP archive and extracts files from it without properly validating paths. An authenticated user with administrator rights can trigger the flaw by submitting a malicious ZIP archive, causing arbitrary files to be written outside the intended directory. By planting attacker-controlled files in arbitrary locations, an attacker can achieve remote code execution on the server. All organizations running ZCS 8.8.15 or 9.0 are potentially affected, and the flaw has been mass-exploited in the wild — CISA added it to the Known Exploited Vulnerabilities catalog on 2022-08-11, ordered civilian agencies to patch it, and ransomware operators and other actors are known to be using it.

Do: Apply the vendor's updates/patches for ZCS 8.8.15 and 9.0 as instructed by Zimbra, per CISA's required action. Limit external access to Zimbra's mailbox import/administration endpoints to trusted networks only, and hunt for indicators of compromise such as unexpected files or webshells in the Zimbra web root, unusual admin activity, and signs of follow-on ransomware deployment.

Fortinet's FortiOS, FortiProxy, and FortiSwitchManager contain an authentication bypass vulnerability (CWE-288) that lets an unauthenticated remote attacker gain access to the administrative interface. It is triggered by sending specially crafted HTTP or HTTPS requests directly to the admin interface, with no credentials or exploit code required. By bypassing authentication, an attacker can perform administrative operations on the device, such as modifying configuration or creating privileged accounts. Any organization running the affected products is exposed, particularly where the management interface is reachable from the internet. The flaw is being actively exploited: it was added to CISA's Known Exploited Vulnerabilities catalog on 2022-10-11 with known ransomware use, and EPSS assigns it roughly a 100% probability of exploitation within 30 days, although no public PoC is known.

Do: Upgrade FortiOS, FortiProxy, and FortiSwitchManager to the fixed releases identified in Fortinet's advisory per the KEV required action. As mitigation, restrict access to the admin interface (e.g., disable WAN-facing management and use local-in policies or allow-lists for management IPs). Review admin logs and device configuration for signs of unauthorized access, such as unexpected admin accounts, added SSH keys, or config changes.

CVE-2022-41082, dubbed "ProxyNotShell," is an authenticated remote code execution vulnerability in Microsoft Exchange Server; the associated CWE-502 indicates deserialization of untrusted data. It is exploited in a chain with CVE-2022-41040, a server-side request forgery in Exchange that lets an unauthenticated attacker reach the vulnerable endpoint via crafted web requests and trigger the remote code execution. Successful exploitation gives an attacker the ability to run code on the Exchange server, and CISA notes known ransomware use. Any organization running an on-premises Microsoft Exchange Server deployment is potentially affected, with the specific version ranges per Microsoft's advisory. The flaw is actively exploited in the wild: it was added to CISA KEV on 2022-09-30 with ransomware use known, and EPSS assigns a 100% probability of exploitation within 30 days, even though no public proof-of-concept is known.

Do: Apply Microsoft's Exchange security updates immediately per vendor instructions, as required by CISA's KEV listing (added 2022-09-30). If patching is delayed, apply Microsoft's interim mitigations that restrict access to the Autodiscover endpoint used in the CVE-2022-41040 SSRF chain, and review web and PowerShell logs for signs of compromise given the known ransomware use.

CVE-2023-20198 is a critical (CVSS 10.0) unauthenticated privilege escalation flaw in the web UI of Cisco IOS XE software, triggered by sending crafted network requests to the exposed web management interface. An attacker with no credentials can use the flaw to gain initial access and issue a privilege 15 command, creating a local user with normal login access; the attacker then chained CVE-2023-20273 (CVSS 7.2) to elevate that account to root and write an implant to the file system. Successful exploitation yields full administrative control of the device, including persistence via the planted implant, on Cisco IOS XE devices with the web UI enabled and reachable from the internet or untrusted networks, including Rockwell Automation Allen-Bradley Stratix 5200 and 5800 switches running IOS XE. Exploitation is confirmed in the wild: the flaw was added to CISA's KEV on 2023-10-16 with a BOD 23-02 directive, EPSS stands at 99.6% (100th percentile), and ongoing campaigns (including the 'BADCANDY' activity flagged by Australia's ASD and Cisco-related telecom intrusions attributed to Salt Typhoon) have been reported.

Do: Upgrade affected devices to the fixed releases listed in Cisco's advisory (use Cisco's Software Checker) and, as immediate mitigation, disable the web UI or restrict it to trusted networks/addresses only. Check for compromise by looking for unexpected local user accounts and the implant artifacts Cisco identified (unexpected cisco_tac_alarm.log and cisco_tac.log files in /tmp or /usr/binos/conf), and immediately report positive findings to CISA per BOD 23-02. Keep in mind that patching alone does not remove a root implant, so devices with evidence of compromise should be reimaged or otherwise cleaned per vendor instructions.

CVE-2023-32315 is an unauthenticated path traversal flaw (CWE-22) in the Ignite Realtime Openfire XMPP server that allows a remote attacker to reach pages of the Openfire Admin Console that are reserved for administrative users. It is triggered by sending a crafted HTTP request to the admin console web interface containing path traversal sequences, which bypasses the authentication check protecting those restricted pages. Successful exploitation exposes administrative console functionality to an unauthenticated attacker, potentially enabling further compromise of the server and the chat environment it hosts. Any organization running Openfire is affected, particularly instances whose admin console interface is reachable from the internet. The flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2023-08-24 and carries an EPSS probability of 100% (top percentile), indicating active exploitation in the wild; ransomware use is not yet documented.

Do: Upgrade Openfire to the patched release recommended in the Ignite Realtime advisory for CVE-2023-32315, per the CISA KEV required action; if patching must be delayed, restrict the admin console (default ports 9090/9091) to trusted networks or place it behind a VPN. Review access logs for requests to admin console pages containing traversal sequences, and check for unauthorized admin accounts or configuration changes, since KEV listing confirms exploitation in the wild.

CVE-2023-46747 is a critical authentication bypass (CVSS 9.8) in the F5 BIG-IP Configuration Utility (TMUI) affecting most BIG-IP modules, including LTM, APM, DNS, AWAF, AFM, ASM, and SSL Orchestrator. By sending undisclosed, specially crafted requests to the TMUI, an attacker with network access to the BIG-IP management port and/or self IP addresses bypasses authentication and can execute arbitrary system commands on the system. No privileges or user interaction are required, and successful exploitation effectively yields full control of the affected BIG-IP deployment. Any organization running vulnerable BIG-IP software is exposed, particularly enterprises, service providers, and government agencies whose management interface or self IPs are reachable. The flaw is being actively exploited: it was added to CISA KEV on 2023-10-31 with known ransomware use, public PoC code exists, and reporting links it to Chinese nation-state actors targeting defense and government networks.

Do: Upgrade all affected BIG-IP systems to the fixed releases identified in F5 advisory K13763 (17.1.0.1, 16.1.4, 15.1.9, 14.1.5.5, or 13.1.5.1 depending on the train, or later); the CISA KEV listing makes remediation mandatory for federal agencies. As an interim mitigation, restrict network access to the TMUI management port and self IP addresses and apply F5's documented mitigation guidance. Given active nation-state and ransomware exploitation, also audit appliances for indicators of compromise such as unexpected accounts, scheduled tasks, and configuration changes.

CVE-2024-21762 is a critical (CVSS 9.8) out-of-bounds write (CWE-787) in the SSL VPN functionality of Fortinet FortiOS and FortiProxy, allowing an unauthenticated remote attacker to execute unauthorized code or commands by sending specifically crafted requests to the vulnerable service. No authentication or user interaction is required, and network access to the SSL VPN interface is the only precondition. Organizations running affected FortiOS versions (on FortiGate appliances) or any affected FortiProxy version are exposed, particularly where the SSL VPN is internet-facing. The flaw is actively exploited: it was added to CISA's Known Exploited Vulnerabilities catalog on 2024-02-09 with ransomware use noted, EPSS puts the 30-day exploitation probability at 84.3%, and public scans suggest roughly 150,000 internet-exposed Fortinet devices may be impacted.

Do: Upgrade FortiOS and FortiProxy to fixed releases outside the affected ranges per Fortinet's advisory, prioritizing internet-facing devices; as an interim mitigation, disable SSL VPN (or SSL VPN web mode) where it is not required, per vendor and CISA guidance. After patching, check for signs of compromise and rotate credentials, since Fortinet has warned that attackers retained access to FortiGate devices post-patching. The flaw is in CISA KEV with known ransomware use, so treat this as an urgent patching priority.

OSGeo GeoServer ships the GeoTools library, which evaluates feature property names directly as XPath expressions without proper neutralization (CWE-95), so attacker-supplied input is executed as code rather than treated as data. A remote, unauthenticated attacker triggers the flaw by sending specially crafted requests to a GeoServer service, causing the injected expression to be evaluated in the server's context. Successful exploitation results in remote code execution on the host running GeoServer, giving the attacker control over the mapping server and any data or credentials it can reach. Any organization running GeoServer is affected, and the underlying GeoTools flaw also extends to dependent applications such as GeoNetwork, which shipped its own fix for an unauthenticated RCE chain affecting government geoportal backends. The flaw is being actively exploited: it was added to CISA KEV on 2024-07-15, and EPSS assigns a 99.8% probability of exploitation within 30 days.

Do: Upgrade GeoServer to the fixed releases identified in the OSGeo advisory (2.23.6, 2.24.4 or 2.25.2, or later); where upgrading is not immediately possible, restrict access to GeoServer's public endpoints per vendor mitigations or discontinue use of the product per the KEV required action. Organizations running GeoNetwork or other GeoTools-based applications should apply those vendors' fixes as well. Given active exploitation, hunt for signs of compromise such as unexpected child processes spawned by the GeoServer Java process, new files or services on the host, and unusual map/feature service request patterns.

CVE-2025-55182 is a critical (CVSS 10.0) pre-authentication remote code execution flaw (CWE-502, deserialization of untrusted data) in React Server Components, specifically the react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack packages in versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0. It is triggered when the vulnerable code unsafely deserializes payloads from HTTP requests sent to Server Function endpoints, requiring no authentication or user interaction. An attacker gains arbitrary code execution on the affected server (CVSS scope changed, with high impact to confidentiality, integrity, and availability), and reporting notes a campaign in which hackers used the flaw to breach 766 Next.js hosts and steal credentials. Any React/Next.js application exposing Server Functions with the affected React versions is in scope, which given the ubiquity of React and Next.js is a very large deployed base. Exploitation is confirmed in the wild: the flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2025-12-05 with known ransomware use, EPSS puts the 30-day exploitation probability at 99.8%, multiple public PoC/scanner repositories are available, and coverage has dubbed the flaw React2Shell.

Do: Upgrade the react-server-dom-webpack, react-server-dom-parcel, and react-server-dom-turbopack packages to the vendor-patched releases (any version later than the vulnerable 19.0.0, 19.1.0, 19.1.1, and 19.2.0 line) and update Next.js per Vercel's advisory; as a KEV entry, U.S. federal agencies must apply vendor mitigations per BOD 22-01 or discontinue use. Audit internet-exposed Server Function endpoints for the vulnerable React versions and review logs for exploitation activity, including the reported campaign that breached 766 Next.js hosts and stole credentials, then rotate any exposed credentials.