Major Incidents or Breaches

  • Threat actors are actively exploiting CVE-2025-32975 (CVSS 10.0), a critical vulnerability in Quest KACE Systems Management Appliance (SMA), to hijack unpatched systems. Arctic Wolf reported observed malicious activity targeting vulnerable appliances.
  • There are indications that CVE-2026-21992, a critical vulnerability in Oracle Identity Manager allowing unauthenticated remote code execution, may have been exploited in the wild prior to the release of an emergency patch by Oracle.

Newly Discovered Vulnerabilities

  • CVE-2025-32975 in Quest KACE SMA is a maximum-severity flaw currently being exploited. Details on the exploitation method are not specified in the available summary.
  • CVE-2026-21992 in Oracle Identity Manager is a critical vulnerability that can be exploited remotely without authentication for code execution. Oracle has released an emergency patch to address this issue.

Notable Threat Actor Activity

  • Threat actors are leveraging a new information stealer, VoidStealer, which employs a debugger-based technique to bypass Chrome’s Application-Bound Encryption (ABE) and extract the browser’s master key, enabling decryption of sensitive stored data.

Trends, Tools, or Tactics of Interest

  • VoidStealer demonstrates an evolution in information stealer malware by using debugger tricks to defeat Chrome’s ABE, highlighting an increased focus on extracting encrypted browser credentials through innovative methods.