Actively Exploited Zero-Day Vulnerabilities 2026

Three actively exploited zero-days, two CVSS 10.0 flaws, and critical supply chain compromises. Threat activity spans infrastructure (Cisco, Microsoft, Fortinet), AI/DevOps platforms (n8n, Chainlit, Zoom), and legacy systems. Dominant pattern: improper input validation enabling unauthenticated infrastructure takeover.

Key Metrics: 3 zero-days exploited | 2 CVSS 10.0 flaws | 509 GB (ASRock Rack) + 861 GB (McDonald’s India) breached | Multi-stage exploitation chains combining memory disclosure → ASLR defeat → RCE → persistence

>>Outpace Attackers With AI-Based Automated Penetration Testing

NEW HACKING TECHNIQUES

1. Content-Type Confusion for Unauthenticated RCE (CVE-2026-21858 “Ni8mare” – n8n)

Attack Chain: Exploits improper webhook handling by changing Content-Type from multipart/form-data to application/json, allowing attackers to read arbitrary files (/home/node/.n8n/config.json). Extracted JWT secrets enable admin session forgery. Expression injection in workflow nodes executes OS commands in n8n daemon context.

Key Payload:

json

POST /api/v1/webhooks/[id] HTTP/1.1

Content-Type: application/json

{“files”: [{“path”: “/home/node/.n8n/config.json”}]}

Scope: 26,500+ internet-exposed instances; ~100,000 globally vulnerable.

2. ASLR Defeat via Information Disclosure Chaining (CVE-2026-20805)

Attack Pattern: Windows DWM memory leak (CVE-2026-20805) defeats ASLR by leaking kernel addresses → attacker pre-calculates ROP gadgets → reliable exploitation of secondary RCE vulnerabilities (CVE-2026-20876, CVE-2026-20934) with 90%+ success vs. traditional 5-10%.

Kill Chain:

text

Memory leak (DWM) → ASLR defeated → ROP gadgets calculated

→ SMB race condition exploited → SYSTEM privilege escalation

→ Persistence (Cobalt Strike, scheduled tasks) → Lateral movement

Real-World Impact: Federal agencies mandated patching by Feb 3, 2026.

>>Outpace Attackers With AI-Based Automated Penetration Testing

3. XML Injection for Pre-Auth RCE (CVE-2025-64155 – FortiSIEM)

Vulnerability: FortiSIEM phMonitor service (TCP 7900) lacks XML validation in storage configuration requests. User-controlled URL parameters concatenated into curl commands without sanitization.

Exploit Example:

xml

<connectivity_test_url>http://test.com; whoami > /tmp/pwn.txt #</connectivity_test_url>

Result: Unauthenticated RCE as root with full system access. Public PoC available—exploitation likelihood amplified 10-100x.

4. Arbitrary File Read + SSRF Chaining (Chainlit AI Framework)

CVE-2026-22218 (File Read): /project/element endpoint reads arbitrary files without validation.

json

{“type”: “file”, “path”: “/home/app/.env”} → extracts AWS credentials, API keys

CVE-2026-22219 (SSRF): Malicious URL parameter forces server to query AWS metadata service.

json

{“type”: “url”, “url”: “http://169.254.169.254/latest/meta-data/iam/security-credentials/”}

Multi-Stage Impact: File read + SSRF → Cloud account compromise → S3 bucket enumeration → Source code theft → CI/CD pipeline poisoning → Organizational takeover in minutes.

>>Outpace Attackers With AI-Based Automated Penetration Testing

CRITICAL CVEs (TIER 0 – ACTIVELY EXPLOITED)

CVE-2026-21858 “Ni8mare” – n8n Unauthenticated RCE

CVSS 10.0 | Incident Date: Jan 6–7 | Status: Actively exploited

Technical Breakdown: Webhook endpoint accepts HTTP requests without authentication. Content-Type confusion allows attacker to reference arbitrary files on disk instead of uploads. JWT secret extraction + admin session forgery + expression injection = full RCE.

CISO Actions:

Inventory all n8n deployments immediately
Update to 1.121.0+
Rotate ALL connected credentials (databases, cloud accounts, API keys, OAuth tokens)
Review execution logs Jan 6+ for unauthorized workflows containing process.mainModule.require, child_process, execSync

CVE-2025-20393 – Cisco AsyncOS Zero-Day (China APT – UAT-9686)

CVSS 10.0 | Incident Date: Nov 2025 (active) | Patch: Jan 16

Technical Breakdown: Unauthenticated command injection in Spam Quarantine feature (TCP/UDP exposed). Attacker sends malformed HTTP requests to /quarantine endpoint; unsanitized parameters concatenated into shell commands executed as root.

Observed Post-Exploitation:

AquaShell (Python backdoor) deployment
AquaTunnel/Chisel SSH tunneling
AquaPurge log obfuscation tool
45+ day dwell time before detection
Lateral movement to domain controllers

CISO Actions:

CRITICAL: Assume Cisco email gateways are breached until forensically cleared
Verify Spam Quarantine status; check AsyncOS version (15.0.2-007, 15.5.4-007, 16.0.4-010+ required)
Export syslog, email logs, and audit trails from Nov 1 onwards
Hunt for SSH keys, cron jobs, unexpected user accounts
Reset credentials for sensitive accounts (executives, finance, R&D)

>>Outpace Attackers With AI-Based Automated Penetration Testing

CVE-2026-20045 – Cisco Unified Communications Zero-Day

CVSS 8.2 (Critical) | Incident Date: Jan 21 | Status: Actively exploited

Technical Breakdown: Improper HTTP input validation in web management interface. Attacker injects shell metacharacters into configuration parameters; commands execute as root on affected UC systems.

Impact: Voice call interception, VoIP fraud, voicemail compromise, endpoint compromise, Webex Calling compromise.

CISO Actions:

Patch all UC products immediately
Check UC logs for HTTP requests containing special characters (;, |, &&, backticks) to /ucm/admin
Audit voicemail for sensitive disclosures
Analyze CDR records for anomalous outbound calls
Rotate UC admin and LDAP service account credentials
Restrict management interface to VPN/bastion hosts only

CVE-2025-64155 – FortiSIEM Unauthenticated RCE

CVSS 9.4 | Incident Date: Jan 14 | Status: PoC publicly available

Technical Breakdown: XML parser flaw in storage configuration endpoint (port 7900). URL parameters unsanitized; command injection via curl metacharacters. Runs as root.

Attack Stages:

text

Stage 1: XML payload with malicious connectivity_test_url

Stage 2: Shell command construction: curl [attacker_payload]

Stage 3: Arbitrary file write via shell redirection

Stage 4: Persistence: cron job installation

Stage 5: Reverse shell callback to attacker C2

CISO Actions:

If running ≤7.4.0: Assume compromise. Initiate incident response
Update to 7.4.1+ immediately
Export all logs pre-Jan 14 to external storage
Search logs for curl, bash, chmod, echo entries
Check /tmp/, /var/tmp/ for suspicious scripts
Review crontab for unauthorized entries
Restore from clean backups pre-Jan 1, 2026

>>Outpace Attackers With AI-Based Automated Penetration Testing

CVE-2026-24061 – GNU InetUtils telnetd Authentication Bypass

CVSS 9.8 | Incident Date: Jan 19–21 | Flaw Age: 11 years (since 2015)

Technical Breakdown: Telnetd passes USER environment variable directly to login(1) with -f flag, bypassing password authentication. Enables unauthenticated remote root access via TELNET protocol.

Exploitation:

text

telnet target.com 23

SET USER root -f

[immediately logged in as root without password]

Real-World Signals: 21+ unique IP addresses attempted exploitation within 24 hours of disclosure (Hong Kong, US, Japan, Netherlands, China, Germany, Singapore).

CISO Actions:

Identify systems running telnetd: dpkg -l | grep inetutils (Debian) or rpm -qa | grep inetutils (RHEL)
Check for telnetd process: ps aux | grep telnetd or netstat -tlnp | grep :23
Recommended: Remove entirely: apt remove telnet (Debian) or yum remove telnet (RHEL)
If must retain: Disable service and block TCP/23 at firewall
Search /var/log/auth.log for login attempts with “USER=” or “-f”
Check /root/.ssh/authorized_keys for unauthorized keys
Telnet should NEVER be internet-exposed

CVE-2026-22844 – Zoom MMR Command Injection

CVSS 9.9 | Incident Date: Jan 20

Technical Breakdown: Malicious display name parameter in meeting metadata injected into ffmpeg commands without sanitization. Allows meeting participants to execute arbitrary commands on Multimedia Router.

CISO Actions: Update all Zoom Node Multimedia Routers to 5.2.1716.0+. If using Zoom Hybrid or Meeting Connector, verify MMR versions are patched.

CVE-2026-22218 & CVE-2026-22219 – Chainlit AI Framework

Severity: High | Incident Date: Jan 19–20

Technical Breakdown:

CVE-2026-22218 (File Read): /project/element endpoint reads arbitrary files without validation
CVE-2026-22219 (SSRF): URL parameter forces server to query internal services (AWS metadata)

Multi-Stage Impact: Arbitrary file read + SSRF → AWS credential theft → S3 enumeration → Source code exfiltration → CI/CD pipeline compromise.

CISO Actions:

Update to Chainlit 2.9.4+ (released Dec 24, 2025)
Ensure Chainlit is internal-only (not internet-exposed)
Review logs for suspicious /project/element accesses with path parameters
Rotate all cloud credentials (AWS, GCP, Azure) used by Chainlit
Run in restricted containers with limited system call access

>>Outpace Attackers With AI-Based Automated Penetration Testing

DARKWEB INTELLIGENCE & THREAT ACTOR ACTIVITY

Zero-Day VPN Access Auctions

Asset Type	Reserve	Activity (Jan 13–19)
Cisco ASA/Firepower SSL-VPN zero-day	55–70 XMR (~$8.5k–$11k)	3 auctions, 1 completed
Fortinet FortiGate pre-auth RCE	60–80 XMR (~$9k–$12k)	2 auctions, 1 sold (72 XMR)
Palo Alto Networks GlobalProtect bypass	50–65 XMR (~$7.5k–$10k)	Listing observed Jan 16
SonicWall SMA VPN authentication bypass	40–50 XMR (~$6k–$7.5k)	1 auction Jan 18 (unsold)

Key Pattern: Prices spiked 15–20% following Patch Tuesday (Jan 13) due to elevated demand for bypasses before patches deploy.

Ransomware Group Activity – Everest

ASRock Rack (Jan 18)

Exfiltrated: 509 GB (server firmware, BIOS files, hardware design schematics, motherboard source code)
Risk: Supply chain compromise; vulnerabilities can be embedded in firmware updates to thousands of organizations

McDonald’s India (Jan 17–19)

Exfiltrated: 861 GB (employee records, financials, supplier data, transaction history, internal communications)

Nissan Motor (Jan 10–15)

Status: Extortion ongoing
Darkweb Evidence: Leaked /R&D/EV_Battery_Specifications.pdf

Operational Shift: Everest increasingly targeting Asia-Pacific; initial access via stolen VPN credentials. Exfiltration speed: 2–5 days post-compromise.

Darkweb Forum Recruitment

LockBit5, Qilin, DragonForce advertising 40–80% profit sharing for affiliate pentesters
Native English speaker recruitment: 5 BTC (~$150k) bounties for insider facilitation
IaaS offerings: Turnkey ransomware platforms bundled with DDoS, credential harvesting, and exfiltration infrastructure

IMMEDIATE CISO ACTIONS (Priority 1 – 24-48 Hours)

Cisco Equipment Audit:

List all Cisco Unified CM, AsyncOS, ISE, and ASA/Firepower instances
Apply emergency patches (CVE-2025-20393, CVE-2026-20045)
Check firewall logs for exploitation attempts

FortiSIEM Emergency Response:

Assume compromise if ≤7.4.0 deployed
Collect forensic evidence (syslog, API logs, filesystem artifacts)
Isolate from production network; restore from Jan 1, 2026 backups

n8n Infrastructure Assessment:

Enumerate all n8n deployments
Update to 1.121.0+
Rotate ALL connected credentials (databases, APIs, OAuth tokens, AWS keys)
Review execution logs Jan 6+ for unauthorized workflows

Windows Patch Management:

Deploy January 2026 Microsoft patches to all Windows devices:
- CVE-2026-20805 (DWM – actively exploited)
- CVE-2026-20876 (VBS privilege escalation)
- CVE-2026-21265 (Secure Boot – time-sensitive, June 2026 deadline)
- CVE-2026-20952, CVE-2026-20953 (Office RCE)

Telnet Elimination:

Inventory systems running telnetd (GNU InetUtils 1.9.3–2.7)
Completely remove: apt remove telnet or yum remove telnet
Block TCP/23 at network perimeter

Zoom Patching:

Update Zoom Node Meetings Hybrid MMR to 5.2.1716.0+

Chainlit Remediation:

Update to 2.9.4+ (Dec 24 release)
Ensure internal-only deployment
Rotate all cloud credentials
Run in restricted containers

>>Outpace Attackers With AI-Based Automated Penetration Testing

EMERGING ATTACK PATTERNS TO MONITOR

Multi-Stage Exploitation Chains: Memory disclosure → ASLR defeat → RCE → Persistence now standard attack sequence
Supply Chain Compromise via CI/CD: Threat actors maintaining persistence in legitimate software supply chains for 30+ days (Trust Wallet Chrome extension precedent)
Cloud Credential Theft via Container Escapes: Single web vulnerability (file read + SSRF) escalates to entire cloud account compromise due to embedded credentials/metadata access

CALL TO ACTION – FREE FIRECOMPASS ASSESSMENT

The threat landscape this week demonstrated a critical gap: Most organizations cannot identify vulnerable instances of n8n, Chainlit, Cisco equipment, and Fortinet in real-time. Manual inventory takes weeks; breaches happen in hours.

FireCompass Autonomous Penetration Testing Platform identifies these exposures automatically:

Automated asset discovery (all internet-exposed services)
Vulnerability correlation (which of YOUR systems are vulnerable to active CVEs)
Exploitation simulation (tests if vulnerabilities are actually exploitable)
Supply chain risk analysis (third-party software scanning for compromised versions)
Continuous monitoring (real-time alerts when new zero-days match your infrastructure)