The Latest on Actively Exploited Vulnerabilities: Apache ActiveMQ, Cisco SD-WAN, and Emerging Threats

Introduction

Cybersecurity faces a persistent challenge, with rapid exploitation of known vulnerabilities and the emergence of destructive new threats. Recent disclosures show critical vulnerabilities in common software, such as the actively exploited Apache ActiveMQ flaw and an important Cisco SD-WAN vulnerability. These incidents demonstrate that organizations need strong defenses and should integrate complete cyber threat intelligence platform capabilities.

Beyond these technical exposures, the current situation includes sophisticated data wiper attacks targeting critical infrastructure and complex insider threat scenarios impacting ransomware negotiations. These diverse threats require proactive detection of breaches and continuous intelligence to protect digital assets. Understanding these attack vectors is important for security professionals and business leaders to implement effective mitigation strategies.

Organizations require detailed insights into these threats to manage risks effectively. The following analysis examines several urgent cybersecurity incidents, offering technical details and practical implications for maintaining operational security.

Actively Exploited Apache ActiveMQ Flaw Impacts Thousands of Servers

A high-severity code injection vulnerability, CVE-2026-34197, in Apache ActiveMQ has been identified as actively exploited, affecting over 6,400 servers exposed online. This flaw, which remained undetected for 13 years, allows authenticated threat actors to execute arbitrary code on unpatched systems. Apache ActiveMQ is a common open-source multi-protocol message broker used for asynchronous communication in Java applications.

The vulnerability was discovered by Horizon3 researcher Naveen Sunkavally with assistance from the Claude AI assistant. Apache maintainers released patches for this flaw on March 30 in ActiveMQ Classic versions 6.2.3 and 5.19.4. Despite these patches, many deployments remain vulnerable.

According to threat monitoring service Shadowserver, more than 6,400 IP addresses with Apache ActiveMQ fingerprints exposed to the internet are vulnerable to CVE-2026-34197 attacks. These vulnerable servers are geographically distributed, with the majority located in Asia (2,925), North America (1,409), and Europe (1,334). This wide distribution indicates a large potential attack surface for malicious actors.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) issued a warning that this vulnerability is actively exploited in attacks. CISA mandated that Federal Civilian Executive Branch (FCEB) agencies secure their servers against this flaw by April 30. This directive shows the importance of prompt patching to mitigate risks across government infrastructure.

For administrators, Horizon3 researchers advise searching ActiveMQ broker logs for specific indicators of compromise. These include suspicious broker connections using the internal transport protocol VM and the brokerConfig=xbean: query parameter. Identifying such patterns can aid in early detection of breaches. Organizations should also review prior ActiveMQ vulnerabilities, such as CVE-2016-3088 and CVE-2023-46604, with the latter having been exploited as a zero-day by the TellYouThePass ransomware gang. For more information on critical ActiveMQ vulnerabilities, refer to our blog posts on CVE-2026-34197 ActiveMQ RCE and ActiveMQ RCE CVE-2025-54539.

What SD-WAN Vulnerabilities are Currently Under Active Exploitation?

CVE-2026-20133 in Cisco Catalyst SD-WAN Manager is an information disclosure vulnerability that CISA has flagged as actively exploited in attacks. This flaw allows unauthenticated remote attackers to access sensitive information on unpatched devices. Catalyst SD-WAN Manager, formerly known as vManage, is software designed to monitor and manage up to 6,000 Catalyst SD-WAN devices from a single dashboard.

Cisco patched CVE-2026-20133 in late February, attributing the issue to insufficient file system access restrictions. A successful exploit could allow an attacker to read sensitive information on the underlying operating system. Despite Cisco's advisory not initially confirming active exploitation, CISA added the vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog on Monday.

CISA subsequently issued an order to FCEB agencies to secure their networks against CVE-2026-20133 by Friday, April 24. This mandate aligns with CISA's Emergency Directive 26-03 and accompanying Hunt & Hardening Guidance for Cisco SD-WAN Devices. These resources provide specific instructions for assessing exposure and mitigating risks associated with Cisco SD-WAN systems. Organizations are advised to consult these guidelines. For broader context on actively exploited bugs, our blog on CISA Exploited Bugs Alert provides further detail.

Cisco also previously reported that two other security flaws, CVE-2026-20128 and CVE-2026-20122, patched on the same day as CVE-2026-20133, were being exploited in the wild. A critical authentication bypass vulnerability, CVE-2026-20127, was also exploited in zero-day attacks since at least 2023, enabling threat actors to add malicious rogue peers to targeted networks. Also, Cisco addressed two maximum-severity vulnerabilities in its Secure Firewall Management Center (FMC) software in early March, which could grant attackers root access and arbitrary Java code execution capabilities. Over the years, CISA has identified 91 Cisco vulnerabilities as actively exploited, with six of these being used by various ransomware operations. This shows the ongoing need for diligent patch management and supply chain risk monitoring when integrating third-party components.

New Wiper Malware Targeting Critical Infrastructure: The Lotus Threat

A previously undocumented data-wiping malware named Lotus was deployed in targeted attacks against energy and utilities organizations in Venezuela during late 2025. Researchers at Kaspersky analyzed the malware after it was uploaded to a public platform from a Venezuelan machine in mid-December. This incident coincides with geopolitical tensions in the region, including a cyberattack that disrupted the operations of the state-owned oil company Petroleos de Venezuela (PDVSA) around the same time.

The Lotus attack sequence begins with two batch scripts that prepare the system for the destructive payload.

  • The first script, OhSyncNow.bat, disables the Windows UI0Detect service and performs an XML file check to coordinate execution across domain-joined systems.
  • The second script, notesreg.bat, executes under specific conditions. It enumerates users, disables accounts by changing passwords, logs off active sessions, disables all network interfaces, and deactivates cached logins.

Following these preparatory actions, the script enumerates drives and initiates a complete overwrite using diskpart clean all, filling sectors with zeroes. It also employs robocopy to overwrite directory contents. To hinder recovery further, fsutil is used to create a file that fills the remaining disk space. After this environmental preparation and initial wiping, the batch script decrypts and executes the primary Lotus wiper payload.

The Lotus wiper operates at a low level, directly interacting with physical disks via IOCTL calls. Its actions include:

  • Enabling all privileges within its token to achieve administrative-level access.
  • Deleting all Windows restore points using the Windows System Restore API.
  • Wiping physical drives by retrieving disk geometry and overwriting all sectors with zeroes.
  • Clearing the USN journal to remove traces of file system activity.
  • Deleting files by zeroing their contents, renaming them randomly, and removing them, or scheduling deletion on reboot if files are locked.
  • Repeatedly cycling through drive wiping and restore point deletion multiple times.
  • Updating disk properties using IOCTL_DISK_UPDATE_PROPERTIES after the final wipe operation.

To counter such threats, system administrators should monitor for anomalous activities, including:

  • Changes to NETLOGON shares.
  • Manipulation of the UI0Detect service.
  • Mass account modifications or network interface deactivations.
  • Unexpected usage of commands like diskpart, robocopy, and fsutil`.

Maintaining regular, validated offline backups is a critical defense against data wipers and ransomware, providing the foundation for recovery. Real-time intelligence on ransomware can help identify new wiper strains and TTPs quickly.

How are Insider Threats Facilitating Ransomware Operations?

Insider threats represent a significant risk, as demonstrated by the recent case of Angelo Martino, a former ransomware negotiator who pleaded guilty to aiding BlackCat ransomware attacks. Martino, 41, from Land O'Lakes, Florida, collaborated with BlackCat operators from April to November 2023, providing confidential information about victim organizations. This collaboration enabled the ransomware gang to extract higher ransom payments. This type of activity shows the importance of intelligence from underground forums to track potential insider recruitment and illicit dealings.

Martino, while employed as a negotiator for five different ransomware victims, supplied BlackCat attackers with sensitive details regarding his clients' negotiating positions and strategies. This information, which included victim insurance policy limits and internal negotiation thresholds, was provided without the knowledge or permission of his clients or employer. In exchange, Martino received financial compensation from the ransomware group.

Further investigations revealed Martino's collaboration with two other incident responders, Ryan Goldberg and Kevin Martin. Martino and Martin worked for DigitalMint, while Goldberg was an incident response manager for cybersecurity company Sygnia. Together, these individuals successfully deployed BlackCat ransomware against multiple U.S. victims. In one instance, they extorted approximately $1.2 million in Bitcoin, subsequently laundering the illicit proceeds through various methods.

Authorities seized $10 million in assets from Martino, including digital currency, vehicles, a food truck, and a luxury fishing boat. Martino pleaded guilty to one count of conspiracy to obstruct, delay, or affect commerce by extortion. He is scheduled for sentencing on July 9, 2026, facing a maximum penalty of 20 years in prison. Goldberg and Martin, who pleaded guilty in December 2025, are expected to be sentenced later this month and also face up to 20 years. This case illustrates how insider knowledge can directly facilitate malicious operations, making real-time intelligence on ransomware and strong internal controls vital for organizations.

What are the Risks of Sandbox Vulnerabilities in AI Development Environments?

Sandbox vulnerabilities, such as CVE-2026-5752 in Cohere AI's Terrarium, can pose significant risks, enabling root code execution and container escape, thereby compromising the host environment. This critical security vulnerability, rated 9.3 on the CVSS scoring system, affects a Python-based sandbox used for running untrusted code generated by users or large language models (LLMs). Such flaws show the need for careful supply chain risk monitoring in software development, especially concerning AI components.

Terrarium, an open-source project by Cohere AI, operates as a Docker-deployed container running on Pyodide, a Python distribution for browser and Node.js environments. The core issue behind CVE-2026-5752 is a JavaScript prototype chain traversal vulnerability within the Pyodide WebAssembly environment. This flaw allows sandboxed code to reference and manipulate objects in the host environment, bypassing intended security boundaries.

Successful exploitation of CVE-2026-5752 permits an attacker to:

  • Break out of the sandbox.
  • Execute arbitrary system commands with root privileges within the container.
  • Gain unauthorized access to sensitive files, such as "/etc/passwd".
  • Reach other services on the container's network.
  • Potentially escape the container entirely and escalate privileges further.

The attack requires local access to the system but does not necessitate user interaction or special privileges. Security researcher Jeremy Brown discovered and reported this flaw. Given that the Terrarium project is no longer actively maintained, a patch is unlikely to be released.

To mitigate the risks associated with this and similar sandbox vulnerabilities, organizations should consider the following:

  • Disable features allowing users to submit code to the sandbox where feasible.
  • Segment networks to limit the attack surface and prevent lateral movement in the event of a breach.
  • Deploy a Web Application Firewall (WAF) to detect and block suspicious traffic, including exploitation attempts.
  • Implement continuous monitoring of container activity for any signs of anomalous behavior.
  • Restrict access to containers and their resources to authorized personnel only.
  • Utilize secure container orchestration tools to manage and secure container deployments.
  • Ensure that all software dependencies are regularly updated and patched to address known vulnerabilities.

Technical Takeaways

  • Prompt Patch Management: Actively exploited vulnerabilities like CVE-2026-34197 in Apache ActiveMQ and CVE-2026-20133 in Cisco Catalyst SD-WAN Manager necessitate immediate patching and adherence to CISA directives for publicly exposed systems.
  • Layered Defense Against Destructive Malware: The Lotus wiper attacks against critical infrastructure show the need for strong systems for detecting breaches, complete data backups, and strategies for rapid recovery to minimize data loss.
  • Insider Threat Mitigation: The Angelo Martino case illustrates how insider collaboration can empower ransomware groups. Implementing stringent internal controls, continuous monitoring, and intelligence from underground forums is crucial for identifying and addressing such risks.
  • Secure AI Development and Deployment: The Cohere AI Terrarium sandbox vulnerability (CVE-2026-5752) shows security gaps in AI development environments. Organizations must prioritize secure coding practices, supply chain risk monitoring, and strong sandbox configurations for AI-related systems.
  • Integrated Threat Intelligence: An effective cyber threat intelligence platform is essential for tracking zero-day exploits, new malware strains, and actor tactics, ensuring organizations can respond proactively to emerging threats, including using live API feeds for ransomware data.