eSentire's Threat Response Unit (TRU) compiles the following weekly intelligence overview, providing cybersecurity leaders with expert analysis and insights on the most important events of the past week along with important security tips.
Recent Threat Intelligence Advisories
Noteworthy News
Critical Vulnerabilities in Ivanti Sentry - CVE-2026-10520, CVE-2026-10523
Bottom Line: Ivanti has released an advisory addressing two critical vulnerabilities within the Ivanti Sentry secure mobile gateway solution. As there are publicly available technical details and reports of exploitation, organizations should apply the recommended security patches as soon as possible.
On June 9th, 2026, Ivanti disclosed two critical vulnerabilities affecting its Sentry secure mobile gateway solution, identified as CVE-2026-10520 and CVE-2026-10523. These vulnerabilities have CVSS scores of 10.0 and 9.9 respectively and enable remote, unauthenticated attackers to fully compromise affected systems. Recent reporting on June 10th, 2026, confirms that CVE-2026-10520 is actively being exploited in the wild, with attackers compromising Ivanti Sentry gateways shortly after patches were released.
CVE-2026-10520 is an operating system command injection vulnerability that allows a remote, unauthenticated attacker to execute arbitrary commands with root-level privileges on the underlying system. CVE-2026-10523 is an authentication bypass vulnerability that allows attackers to bypass authentication mechanisms, create arbitrary administrative accounts, and gain unrestricted administrative access to the system. Both of these vulnerabilities impact Ivanti Sentry versions prior to 10.5.2, 10.6.2, and 10.7.1.
WatchTowr Labs published a technical write-up for CVE-2026-10520, detailing how this flaw could be exploited. Researchers at Shadowserver found that two internet-exposed Sentry gateways had already been backdoored shortly after the security updates were released. The Shadowserver Foundation publicly reported on the scope of the activity, noting that a large volume of exploitation attempts were being observed based on the public Proof-of-Concept (PoC).
On June 11th, 2026, the Cybersecurity and Infrastructure Security Agency (CISA) announced that it had added CVE-2026-10520 to its Known Exploited Vulnerabilities (KEV) Catalog based on evidence of active exploitation. CISA has directed U.S. federal agencies to implement fixes for CVE-2026-10520 by June 14th, 2026.
eSentire Threat Intelligence Analysis:
Ivanti Sentry functions as an inline gateway that manages and secures communication between mobile devices and enterprise systems, typically deployed at the network edge. As a result, successful exploitation of these vulnerabilities could lead to complete compromise of the gateway, granting attackers root-level access and control over network traffic. This access could enable interception of sensitive data, lateral movement into internal systems, and establishment of persistent footholds within the environment.
The confirmation of widespread exploitation significantly elevates this vulnerability from a critical risk to an active incident scenario. Currently, there are no specific details about any threat actors who are exploiting this vulnerability. Ivanti products have a documented history of being targeted and exploited by both state-sponsored threat actors and ransomware groups. This historical context indicates a possibility that these vulnerabilities will be quickly exploited by other threat actor groups.
Ivanti has released patched versions 10.5.2, 10.6.2, and 10.7.1 to address these issues. Given that exploitation has already been observed, organizations running affected versions are at immediate risk and should prioritize upgrading to the fixed releases. eSentire’s Threat Response Unit (TRU) has issued an advisory for CVE-2026-10520 and CVE-2026-10523, and has developed detections in MDR for Network to identify exploitation of CVE-2026-10520. It is important to note that watchTowr Labs has published a detection artifact generator on GitHub, which can be used by organizations to assess if their Ivanti Sentry device is vulnerable.
Ransomware Actors Exploit CheckPoint Zero-Day Vulnerability
Bottom Line: Threat actors have been identified targeting a critical CheckPoint Remote Access VPN and Mobile Access vulnerability (CVE-2026-50751) to bypass authentication and deploy ransomware on vulnerable assets.
On June 8th, 2026, Check Point disclosed CVE-2026-50751 (CVSS:9.8), a critical authentication bypass vulnerability in Check Point Remote Access VPN and Mobile Access deployments. The vulnerability is a logic flow weakness in the deprecated IKEv1 key exchange protocol. An unauthenticated attacker can exploit the flaw to bypass user authentication entirely and establish a VPN connection without a valid password. Check Point confirmed that exploitation has been ongoing since at least May 7th, 2026, and that attacks are “limited to a few dozen targeted organizations globally” at the time of disclosure. CISA added CVE-2026-50751 to its Known Exploited Vulnerabilities (KEV) catalog on June 8th, 2026, mandating Federal Civil agencies to apply patches or mitigations by June 11th, 2026.
Check Point has attributed one real-world exploitation instance of CVE-2026-50751 to affiliates of the Qilin Ransomware-as-a-Service (RaaS) group. The campaign is not limited to Check Point devices, with exploitation of vulnerabilities in various related platforms including Palo Alto, Fortinet, and F5 services.
eSentire Threat Intelligence Analysis:
Authentication bypass vulnerabilities are high value targets for threat actors, due to the access they provide. Technical details on CVE-2026-50751 were released in a report by WatchTowr Labs on June 12th. The availability of technical information increases the likelihood that other threat groups will rapidly develop exploits, leading to an increase in real world attacks.
The combination of critical severity, active exploitation pre-dating public disclosure by over a month, and confirmed ransomware-affiliated post-compromise activity makes CVE-2026-50751 a high-urgency remediation requirement for any organization running an affected Check Point gateway. Organizations with vulnerable assets are strongly encouraged to apply the relevant security patches. If immediate patching is not possible, temporary mitigations include removing support for legacy Remote Access client connections, configuring Global properties for Remote Access VPN Authentication to IKEv2 only, and setting the Machine Certification Authentication as mandatory. In response to this release, eSentire has published an advisory on the topic, performed threat hunts, and blocked known malicious infrastructure for eSentire MDR for Network customers.
ShinyHunters Exploiting Oracle PeopleSoft Zero-Day Vulnerability
Bottom Line: Oracle disclosed a critical unauthenticated Remote Code Execution (RCE) vulnerability (CVE-2026-35273) within its PeopleSoft PeopleTool application. Exploitation of the flaw has been identified in the wild and linked to ShinyHunters.
On June 10th, 2026, Oracle disclosed a critical Remote Code Execution (RCE) vulnerability within its PeopleSoft PeopleTools application, tracked as CVE-2026-35273 (CVSS: 9.8). Successful exploitation of the flaw can grant an unauthenticated attacker full control over the PeopleSoft Enterprise PeopleTools application. On June 11th, Google Threat Intelligence Group (GTIG) and Mandiant released a report confirming that exploitation of CVE-2026-35273 has been ongoing since at least May 27th, marking it a zero-day, with attacks attributed to the financially motivated threat actor ShinyHunters.
ShinyHunters leveraged CVE-2026-35273 as part of a data extortion campaign, where exploitation of the flaw granted initial access to target environments. Once access was obtained, threat actors deployed MeshCentral agent binaries, disguised as Microsoft Azure agent services, for staging and lateral movement. Custom scripts were also deployed to perform SSH credential spraying and host enumeration. The attacks resulted in data theft, which would be used for extortion purposes; GTIG identified ShinyHunters posting victim information on their Data Leak Site (DSL) as of June 9th.
GTIG indicates that once they became aware of active scanning and exploitation of CVE-2026-35273, they contacted over 100 global organizations whose IP addresses “correlated with potentially vulnerable endpoints”. GTIG notes that most of these organizations were in the United States, with 68% being in the higher education sector. Oracle has confirmed that patches are available to address CVE-2026-35273 and should be applied as soon as possible.
eSentire Threat Intelligence Analysis:
A large portion of potentially exposed instances of Oracle PeopleSoft were identified to be in the higher education sector, based on the findings of GTIG. The sector’s reliance on Enterprise Resource Planning (ERP) platforms like Oracle PeopleSoft for managing student, financial, and HR data makes it a high-value target for extortion groups seeking large, monetizable datasets. What is notable about this campaign is that ShinyHunters has typically been associated with performing social engineering and voice phishing (vishing) attacks as a means for initial access to cloud environments, rather than vulnerability exploitation. The change to exploitation of a zero-day may indicate adoption of AI for exploit development, although technical evidence to support this theory is not currently available.
ShinyHunters also has a recent history of targeting educational institutions, with a notable example being the breach of the Canvas Learning Management System in April 2026. While specifics on the initial access methods used are not known, ShinyHunters leveraged Free-for-Teacher (FFT) accounts within Canvas, resulting in the exfiltration of over 3.65 TB of data. The attacks also resulted in the defacement of the Canvas site, preventing access to accounts and course materials, until extortion demands were met. The targeting of platforms like Canvas and applications like Oracle PeopleSoft allow for ShinyHunters to target a larger number of organizations and maximize extortion leverage through the type of data that is stolen.
eSentire’s Threat Intelligence team assesses with medium confidence that exploitation of CVE-2026-35273 may ramp up in the near future, now that organizations are aware of the attacks and will begin patching. To protect against this threat, organizations should ensure that relevant patches are applied as soon as possible; if patching is not immediately possible, organizations should disable the Environment Management Hub (EMHub) service, and block external network access to PeopleSoft PeopleTools and sensitive endpoints originating from external or untrusted sources. eSentire Threat Response Unit (TRU) published an advisory for CVE-2026-35273 on June 12th and is continuing to track this topic for additional information and detection opportunities.
About the threat briefings:
The threat briefing is a weekly intelligence overview for non-technical users. The Threat Intelligence team at eSentire investigates, analyzes, and organizes the most important events of the past week along with important security tips and redistributes the findings for quick reading. The main goal of this briefing is to improve the overall awareness of readers regarding cyber security.
