eSentire's Threat Response Unit (TRU) compiles the following weekly intelligence overview, providing cybersecurity leaders with expert analysis and insights on the most important events of the past week along with important security tips.
Recent Threat Intelligence Advisories
Noteworthy News
Confirmed Zero-day Vulnerability in Fortinet Products
Bottom Line: In response to the ongoing exploitation of an unpatched critical authentication bypass vulnerability (CVE-2026-24858), Fortinet is now preventing SSO logins from devices running vulnerable versions.
On January 27th, 2026, Fortinet released a security advisory disclosing a zero-day vulnerability impacting multiple Fortinet products. The flaw, tracked as CVE-2026-24858 (CVSS: 9.8), is a critical authentication bypass vulnerability in FortiOS, FortiManager, FortiAnalyzer, FortiProxy, and FortiWeb. It allows an attacker with a FortiCloud account and a registered device to authenticate into devices registered to other accounts via an alternate authentication path or channel.
The disclosure followed Fortinet’s confirmation of existence of a vulnerability in FortiOS. Malicious FortiCloud Single-Sign (SSO) activity targeting FortiOS 7.4.9 was observed across multiple Fortinet customers. Security researchers also identified similar activity where malicious login was followed by creation of administrator accounts to maintain persistence, changes to grant VPN access, and exfiltration of firewall configuration data. Fortinet released a list of observed Indicators of Compromise (IoCs) including the attacker-controlled FortiCloud login accounts, names of rogue administrator accounts, IP addresses observed in the activity, and logs that indicate a malicious event. Among the listed IP addresses a few suggested the use of Cloudflare infrastructure by the attackers.
On January 26th, FortiCloud SSO was disabled by Fortinet to prevent further exploitation. It was re-enabled on January 27th, ensuring logins from vulnerable instances are blocked. Fortinet stated that the impact on FortiSwitch Manager was still being investigated at the time of writing. The issue has been confirmed to affect only FortiCloud SSO, while deployments using third-party SAML identity providers or FortiAuthenticator are not impacted. Security updates have been released for FortiAnalyzer, FortiOS, and FortiManager versions 7.6 and 7.4. The updates for other versions are still in progress and will be added to the advisory once available.
eSentire Threat Intelligence Analysis:
CVE-2026-24858 was added to CISA’s Known Exploited Vulnerabilities (KEV) catalog on January 27th, giving federal organizations just three days to address the flaw. This brief window underscores the critical severity of the vulnerability. Although Fortinet has disabled the FortiCloud SSO login feature on affected instances, organizations running vulnerable versions of FortiOS, FortiAnalyzer, and FortiManager must upgrade to secure versions. No immediate action is necessary for FortiWeb and FortiProxy instances; once the security updates are released the vulnerable versions should be upgraded.
The affected FortiCloud SSO login feature is not enabled by default on Fortinet devices. It is active only when the devices are registered with FortiCare and the “Allow administrative login using FortiCloud SSO” option is manually enabled. While it remains disabled on vulnerable instances at the time of writing, organizations are recommended to disable it on client side to reduce the potential risk of exploitation. Organizations should evaluate the necessity of the feature and the potential impact of its exploitation and then make an informed decision on whether to continue using it. In December 2025, another critical authentication bypass flaw, CVE-2025-59718 (CVSS: 9.8), targeting FortiCloud SSO was exploited in the wild. Before the disclosure of CVE-2026-24858, recent intrusion reports indicated that the activity was linked to an exploit bypassing the patch for CVE-2025-59718, based on similarities observed in the exploitation patterns. It is clear now that the flaws differ with CVE-2026-24858 being an authentication bypass by an alternate path or channel, and CVE-2025-59718 occurring due to improper verification of a cryptographic signature. Both vulnerabilities underscore the severe risk associated with the FortiCloud SSO authentication process.
Vulnerabilities in Fortinet devices have long been attractive targets for threat actors. Positioned at the network edge, these devices are exposed to the Internet while remaining connected to internal networks, making it easier for attackers to identify vulnerable systems and exploit flaws to gain initial access. Once compromised, attackers can establish persistence, maintaining long-term access, sometimes even after systems are patched. Theft of sensitive data, such as firewall configuration details, allows attackers to understand network topology and plan subsequent attacks. Recent intrusions show a similar pattern, focusing on establishing persistence and mapping networks, potentially laying the groundwork for future attacks. While no specific targets or threat actors have been confirmed, both financially motivated and state-sponsored actors may be involved.
eSentire MDR for Network has detections in place to identify exploitation of CVE-2026-24858 and eSentire Managed Vulnerability Service (MVS) can identify vulnerable devices. The eSentire Threat Intelligence team published a security advisory addressing the flaw on January 28th, 2026, and is tracking the vulnerability for additional details and detection opportunities.
Microsoft Office Emergency Out-of-Band Update: CVE-2026-21509
Bottom Line: Microsoft released an emergency out‑of‑band security update addressing a high-severity zero-day vulnerability in Microsoft Office, tracked as CVE‑2026‑21509. Microsoft has confirmed both real-world exploitation and the availability of functional Proof‑of‑Concept (PoC) exploit code.
On January 26th, 2026, Microsoft released an emergency out‑of‑band security update addressing a high‑severity zero‑day vulnerability in Microsoft Office, tracked as CVE‑2026‑21509 (CVSS 7.8). The flaw arises from improper reliance on untrusted input during security decision-making within Microsoft Office security controls. Successful exploitation enables attackers to bypass built-in Office security protections by convincing a user to open a specially crafted document, potentially facilitating credential harvesting and paving the way toward Remote Code Execution (RCE).
The vulnerability is currently actively exploited in the wild, with Microsoft confirming both real-world exploitation and the availability of functional Proof‑of‑Concept (PoC) exploit code.
CVE‑2026‑21509 impacts a range of Microsoft Office versions, including:
- Microsoft Office 2016
- Microsoft Office 2019
- Microsoft Office LTSC 2021
- Microsoft Office LTSC 2024
- Microsoft 365 Apps for Enterprise
The vulnerability specifically addresses OLE mitigations, which are designed to safeguard users from malicious COM/OLE controls embedded in Office files.
Microsoft has not disclosed detailed information regarding the nature or scope of the attacks exploiting CVE-2026-21509. However, the company credited the Microsoft Threat Intelligence Center (MSTIC), the Microsoft Security Response Center (MSRC), and the Office Product Group Security Team with identifying and reporting the vulnerability. CISA has formally classified CVE-2026-21509 as a known exploited vulnerability and added it to its KEV Catalog. This action mandates remediation by U.S. federal agencies no later than February 16th, 2026, further emphasizing the severity and urgency associated with this flaw.
eSentire Threat Intelligence Analysis:
CVE‑2026‑21509 represents a significant security risk due to its confirmed exploitation, the existence of functional exploit code, and the potential for adversaries to chain this vulnerability with other attack techniques. Organizations should prioritize patching affected Microsoft Office installations and apply temporary mitigations where necessary. Given the nature of the exploitation and the emergency release of the patch, swift action is essential to reduce exposure to this threat.
For Office 2021 and newer Office versions, the fix is delivered through the update channel and will only require restarting Office applications. Older versions, such as Office 2016 and 2019, may require manual installation of the security update. If patching cannot be completed immediately, temporary mitigations should be applied, such as modifying a specific Windows Registry key under the Office COM Compatibility path to block the vulnerable component. Organizations must ensure that the registry is backed up and that all Office applications are closed before making these changes. Microsoft provides the exact registry paths and configuration values in the Mitigations section of its official security documentation.
The eSentire Threat Intelligence team published a security advisory addressing CVE‑2026‑21509 on January 27th, 2026, and eSentire’s Managed Vulnerability Service (MVS) has plugins in place to assist in identifying vulnerable assets. The eSentire Threat Intelligence team is actively tracking this vulnerability for additional details and identifying potential detection opportunities. It is recommended that organizations apply all available patches without delay and implement Microsoft’s temporary mitigation steps where immediate patching is not feasible.
Ivanti Zero-Day Vulnerabilities
Bottom Line: Two critical Remote Code Execution (RCE) zero-day flaws in Ivanti Endpoint Manager Mobile (EPMM) platform are being exploited by threat actors. Technical details and Proof-of-Concept exploit code are available, making it critical to patch the vulnerable systems immediately.
On January 29th, 2026, Ivanti disclosed two critical zero-day vulnerabilities impacting its Endpoint Manager Mobile (EPMM) product. The vulnerabilities are tracked as CVE-2026-1281 and CVE-2026-1340, both of which were given a CVSS score of 9.8 and involve a code injection flaw leading to unauthenticated Remote Code Execution (RCE). Within their advisory, Ivanti confirmed that they are “aware of a very limited number of customers whose solution has been exploited at the time of disclosure”.
Ivanti indicates that the vulnerabilities impact the In-House Application Distribution and Android File Transfer Configuration features within EPMM, and affect versions up to and including 12.5.0.0, 12.5.1.0, 12.6.0.0, 12.6.1.0, and 12.7.0.0. The advisory iterates that only EPMM is vulnerable, and that the flaws do not impact any other Ivanti products. Patches were released to address the vulnerabilities, with Ivanti noting that a permanent fix will be included within the next product release, version 12.8.0.0 in Q1 2026. An important aspect of the patch is that if organizations upgrade to a new version of EPMM after applying the relevant patch, they will need to reinstall the patch associated with the upgraded version.
Along with the advisory, Ivanti published an Analysis Guide, aimed at “assisting Ivanti customers and defenders” with examining their Ivanti EPMM solutions for any impact. Ivanti states that the Apache Access Logs will record attempted and successful exploitation of both vulnerabilities and have provided a query which can be used to search the relevant logs. It is recommended that logs be searched within a SIEM or other log collector, as exploitation can result in attackers tampering with logs to hide activity. For compromised devices, Ivanti recommends either restoring EPMM from a known good backup and applying relevant patches or building a replacement EPMM and migrating data to the new device.
eSentire Threat Intelligence Analysis:
Ivanti indicates that they are aware of a limited number of customers that were impacted by these vulnerabilities but provide no information on the observed attacks. They state that they do not have “enough information about the threat actor tactics” to provide any actionable Indicators of Compromise (IoCs) regarding identified attacks. Ivanti EPMM devices have a history of being targeted by threat actors, with a recent example including the vulnerabilities CVE-2025-4427 and CVE-2025-4428, which were chained together to achieve unauthenticated RCE. Given a history of EPMM devices being targeted, Ivanti provides guidance for customers to monitor for the deployment of payloads such as webshells and reverse shells that can be used to establish persistent access to impacted devices, which have been techniques observed in previous attacks.
Following the advisory, CISA added CVE-2026-1281 to its Known Exploited Vulnerabilities (KEV) catalog on January 29th, providing federal agencies with a deadline of February 1st, 2026, to apply relevant patches. Two aspects of this addition are notable, with the first being that only one of the two zero-day vulnerabilities was added to the KEV, and the second being the short timeframe to apply mitigations. The information currently available for both CVE-2026-1281 and CVE-2026-1340 is identical, and with CISA not providing any information regarding the observed attacks, it is unclear why only one vulnerability was added but not the other. Additionally, a short timeframe to apply patches is notable, also seen with the recent SharePoint vulnerabilities in July 2025, suggesting that CISA may consider these vulnerabilities as a high risk for federal agencies.
On January 30th, watchTowr Labs published a technical analysis of the vulnerabilities, and provided Proof-of-Concept (PoC) exploit code. The release of PoC exploit code can often be an early warning sign of rapid exploitation by threat actors, as it allows attackers of various skill levels to make use of it. Given that EPMM devices have a history of being targeted, the availability of PoC exploit code, and reports of exploitation, organizations are urged to apply the relevant security patches as soon as possible. The eSentire Tactical Threat Response (TTR) team has developed MDR for Network detections to identify exploitation attempts, and eSentire's Managed Vulnerability Service (MVS) has plugins for both vulnerabilities. eSentire's Threat Intelligence team published an advisory for the vulnerabilities on January 30th, 2026, and continues to track this topic for additional information and detection opportunities.
About the threat briefings:
The threat briefing is a weekly intelligence overview for non-technical users. The Threat Intelligence team at eSentire investigates, analyzes, and organizes the most important events of the past week along with important security tips and redistributes the findings for quick reading. The main goal of this briefing is to improve the overall awareness of readers regarding cyber security.
