Cyber Risk Brief: 15 June 2026

Disclaimer:This brief is governance commentary for leadership and risk teams, not incident notification, public attribution, legal advice, or quantitative risk analysis. Threat prioritization, framework mappings, attribution, and risk-zone groupings are informational only. Validate all technical claims against vendor advisories and internal telemetry before operational response.

Threat Intelligence Summary

This week is defined by the perimeter and remote-access layer under sustained attack, governed by CISA's newly issued Binding Operational Directive 26-04 and its 3-day patch clock. Check Point Remote Access VPN (T1), Ivanti Sentry (T2), Cisco Catalyst SD-WAN Manager (T3), Microsoft Exchange OWA (T4) and Google Chrome's V8 engine (T5) are all KEV-listed and actively exploited; LiteLLM (T6) marks the second KEV-listed flaw of 2026 in an AI gateway; and two high-blast-radius exposures close the register — an unauthenticated pre-auth RCE in Splunk Enterprise's SIEM platform (T7) and an active ShinyHunters / UNC6240 data-theft campaign against internet-facing Oracle PeopleSoft (T8). What connects them is governance, not a single CVE: edge and management-plane exposure, an emergency-patch SLA that BOD 26-04 now makes the de-facto bar, and the arrival of AI infrastructure on the same KEV catalog as the firewall.

Threat Register: 15/06/2026

Threat
T1
Check Point IKEv1 VPN Authentication Bypass (CVE-2026-50751)
Organizations running Check Point Remote Access VPN, Mobile Access, or Spark Firewall with the deprecated IKEv1 key exchange can have an unauthenticated attacker establish a fully working VPN session — no valid password required — placing the attacker inside the network perimeter. CVE-2026-50751 (CVSS 9.3) is a logic-flow weakness in IKEv1 certificate validation, exploitable only where Remote Access or Mobile Access is enabled, IKEv1 is in use, gateways accept legacy clients, and machine-certificate authentication is not required. Check Point reports exploitation in the wild since 7 May 2026, limited so far to a few dozen organizations, with one case tied to a Qilin ransomware affiliate. CISA added it to KEV on 8 June with an 11 June federal deadline.
9.313.73% CriticalImmediate
T2
Ivanti Sentry OS Command Injection + Auth Bypass (CVE-2026-10520, CVE-2026-10523)
Organizations running Ivanti Sentry (formerly MobileIron Sentry) — the gateway brokering traffic between managed mobile devices and back-end systems — face total appliance takeover: an unauthenticated attacker reaching the management interface executes arbitrary OS commands as root. CVE-2026-10520 (CVSS 10.0) is an OS command injection flaw; a companion auth-bypass, CVE-2026-10523 (CVSS 9.9), lets an unauthenticated attacker create rogue admin accounts. Shadowserver reported, a day after patches shipped, that exposed Sentry gateways were already being backdoored and that any unpatched internet-facing instance should be treated as compromised. CISA KEV-listed it on 11 June with a 14 June deadline under the new BOD 26-04.
10.042.70% CriticalImmediate
T3
Cisco Catalyst SD-WAN Manager Command Injection (CVE-2026-20245)
Organizations running Cisco Catalyst SD-WAN Manager (vManage), Controller (vSmart), or Validator (vBond) face a flaw where an authenticated attacker with netadmin privileges and local access executes arbitrary commands as root via a crafted file — turning a privileged management-plane foothold into root control of the SD-WAN control plane. CVE-2026-20245 (CVSS 7.8) is being actively exploited and, per CyberScoop, is the seventh exploited Cisco SD-WAN zero-day of 2026 with no patch yet available. CyberScoop reports limited cases where exploitation pushed configuration changes to edge devices. CISA KEV-listed it on 9 June with a 23 June deadline.
7.8< 1% HighPost-incident
T4
Microsoft Exchange Server OWA Cross-Site Scripting Zero-Day (CVE-2026-42897)
Organizations running on-premises Microsoft Exchange Server — 2016, 2019, or Subscription Edition — face a risk that any attacker who can email a user achieves arbitrary JavaScript execution in that user's Outlook Web Access session, enabling session hijacking, mailbox access, impersonation, and onward phishing from a trusted internal context. CVE-2026-42897 (CVSS 8.1) is an XSS flaw in OWA: the attacker sends a crafted email, and when the recipient opens it under certain conditions the script runs in their authenticated session. Microsoft deployed interim EEMS mitigations on 14 May; CISA KEV-listed it on 15 May with a 29 May deadline; the full patch shipped only on 9 June — a ~26-day exposure window.
8.17.86% HighImmediate
T5
Google Chrome V8 Out-of-Bounds Zero-Day (CVE-2026-11645)
Any organization whose workforce uses Google Chrome or a Chromium-based browser faces a risk that a user visiting a crafted web page exposes their browser process to arbitrary code execution. CVE-2026-11645 (CVSS 8.8) is an out-of-bounds read/write in V8 — Chrome's JavaScript/WebAssembly engine — letting an attacker run code inside the browser sandbox via a crafted HTML page; SecurityWeek notes attackers have likely chained it with a sandbox-escape flaw for full endpoint access. Google confirmed an exploit exists in the wild and shipped Chrome 149.0.7827.102/.103 on 9 June. It is the fifth actively exploited Chrome zero-day of 2026; CISA KEV-listed it on 9 June with a 23 June deadline.
8.85.89% HighImmediate
T6
LiteLLM MCP stdio Command Injection (CVE-2026-42271)
Organizations running LiteLLM as an AI gateway — proxying LLM API calls across providers like OpenAI and Anthropic — face remote code execution on the proxy host, which typically holds every backend model API key, the routing config, and inference traffic. CVE-2026-42271 (CVSS 8.7) is a command-injection flaw in two MCP server-preview endpoints that accept a full server config — command, args, env — and spawn it as a subprocess, gated only by a valid proxy API key with no role check. A separate medium-severity Starlette host-header bypass, CVE-2026-48710 (CVSS 6.5), can defeat that gate, and The Hacker News reports the two chained to reach unauthenticated RCE. CISA KEV-listed it on 8 June with a 22 June deadline.
8.760.78% HighImmediate
T7
Splunk Enterprise Unauthenticated PostgreSQL Sidecar RCE (CVE-2026-20253)
Organizations running Splunk Enterprise face an unauthenticated path to remote code execution via CVE-2026-20253 (CVSS 9.8) — a missing-authentication flaw (CWE-306) in the PostgreSQL sidecar's recovery API. An attacker reaching the /v1/postgres/recovery/backup and /v1/postgres/recovery/restore endpoints can create or truncate arbitrary files on the host, overwrite a Python script that Splunk's scheduler executes, and gain code execution with Splunk's privileges — no credentials required. Splunk has patched the flaw in Enterprise 10.0.7 and 10.2.4 (10.4.x was never affected); it is not KEV-listed and no active exploitation has been confirmed, but watchTowr Labs has published a working public proof-of-concept, raising the likelihood of opportunistic exploitation.
9.8< 1% CriticalImmediate
T8
Oracle PeopleSoft Data-Theft Campaign (CVE-2026-35273)
Organizations running internet-reachable Oracle PeopleSoft (Enterprise PeopleTools 8.61 or 8.62) face an unauthenticated takeover via CVE-2026-35273 (CVSS 9.8) — a missing-authentication flaw (CWE-306) in the Updates Environment Management component — and it is being actively exploited in a data-theft campaign. Google/Mandiant attributes the activity to ShinyHunters (tracked as UNC6240), running 27 May–9 June; Google notified more than 100 organizations (68% in higher education), and ShinyHunters claims roughly 300 PeopleSoft instances across 100 organizations. Oracle has released mitigations but no patch yet; CISA KEV-listed it on 12 June with a 15 June (3-day, BOD 26-04) deadline.
9.819.82% CriticalPost-incident
Select a row for narrative, affected systems, remediation, and sources.

Strategic context

BOD 26-04 compresses the patch clock to 3 days

  • Ivanti Sentry is the first CVE under the new 3-day deadline — a de-facto SLA Canadian regulated orgs will be measured against.
  • Check Point, Ivanti, Cisco, Exchange, Chrome: the common failure is exposure management and patch cadence on edge/management-plane assets, not awareness.
  • LiteLLM's second KEV listing this year puts AI gateways on the same catalog as firewalls — bring AI infrastructure into the same vuln-management and ISO 42001 AI register.

NIST: no static AI guardrail set holds — continuous monitoring required

  • NIST senior scientist Apostol Vassilev published a peer-reviewed mathematical proof (IEEE Security & Privacy, Gödel-incompleteness analog): no fixed set of AI guardrails can stay robust against adaptive jailbreak prompts — static hardening alone isn't enough.
  • Recommended model: continuous red-teaming, guardrail updates, and fast post-exploit recovery — not a one-time hardening exercise.
  • Maps to ISO 42001 continual-improvement controls and NIST CSF 2.0 DE.CM-09 — run AI-guardrail monitoring as an ongoing cycle, not an annual checkbox.

Export-control order pulls Fable 5 / Mythos 5 worldwide

  • US export-control order forced Anthropic to pull Claude Fable 5 / Mythos 5 worldwide, 3 days post-launch.
  • Trigger: a technique could unlock Mythos's cybersecurity capabilities via Fable 5's safeguards — order hit all foreign nationals, including Anthropic's own staff.
  • Action: if in your AI inventory, confirm removal from integrations and update the ISO 42001 A.6/A.10 register.

Threat Actor Profiling

Only two threats carry named attribution from a primary source: the Check Point VPN intrusions (a Qilin ransomware affiliate, one case, per Check Point) and the PeopleSoft campaign (ShinyHunters, tracked by Google/Mandiant as UNC6240). The remaining six are unattributed. MITRE technique codes are shown as hover-to-define abbreviations.

ThreatsActorSectorsMITRE tradecraftKill chain
T1Qilin ransomware affiliate (single observed case; Check Point assesses with medium confidence the actor is financially motivated and uses Qilin)Cross-sector — internet-facing Check Point VPN operatorsT1190T1133Recon for internet-exposed Check Point gateways running IKEv1 Remote Access with legacy clients and no machine certificate → exploit CVE-2026-50751 to stand up a VPN session without a password → post-compromise activity associated with a Qilin affiliate in one case.
T2Unattributed opportunistic threat actor(s)Cross-sector — MDM / mobile-gateway operatorsT1190T1136Find internet-exposed Sentry with reachable port 8443 (public PoC since 10 Jun) → unauthenticated OS command injection as root (CVE-2026-10520) → create rogue admin account via the companion auth-bypass (CVE-2026-10523); Shadowserver observed backdoored instances.
T3Unattributed threat actor(s)Cross-sector — Cisco Catalyst SD-WAN operatorsT1068T1565.001Authenticated attacker with netadmin privileges and local access supplies a crafted file to the CLI → exploits CVE-2026-20245 (command injection) → arbitrary commands as root on SD-WAN Manager → in limited cases, configuration changes pushed to edge devices.
T4Unattributed threat actor(s) — Microsoft and outlets state it is unclear who is behind the attacks or who the targets areCross-sector — on-premises Exchange operatorsT1566T1059.007Specially crafted email to a mailbox on a vulnerable Exchange server → victim opens it in OWA → CVE-2026-42897 triggers attacker JavaScript in the authenticated session → potential session capture / impersonation / onward phishing.
T5Unattributed threat actor(s) — Google reports an exploit exists in the wild; reporter credited anonymously as “303f06e3”Cross-sector — enterprise browser fleetsT1189T1203Crafted or compromised HTML page triggers the V8 out-of-bounds flaw (CVE-2026-11645) → code executes in the Chrome sandbox on visit → per SecurityWeek, likely chained with a sandbox escape for full endpoint access (specific flaw not confirmed).
T6Unattributed opportunistic threat actor(s)Cross-sector — AI-gateway / LLM-proxy operatorsT1190T1059T1552Find a reachable LiteLLM ≤1.83.6 → optionally bypass the API-key gate via the Starlette host-header trick (CVE-2026-48710, 'BadHost') → POST a malicious MCP config to spawn a subprocess via the primary flaw CVE-2026-42271 (MCP stdio command injection, RCE) → harvest backend LLM API keys from the proxy environment.
T7Unattributed (no exploitation observed; public PoC published)Cross-sector — Splunk Enterprise / SIEM operatorsT1190T1059.006Unauthenticated attacker reaches the PostgreSQL sidecar's recovery endpoints (/v1/postgres/recovery/backup, /v1/postgres/recovery/restore) → exploits CVE-2026-20253 (CWE-306, missing auth) to create/truncate arbitrary files on the Splunk host → overwrites a Python script Splunk's scheduler executes → attacker-controlled code runs with Splunk's privileges. Public PoC published by watchTowr Labs; no active exploitation confirmed.
T8ShinyHunters (Google/Mandiant: UNC6240) — financially motivated data theft + extortionHigher education (68% of notified organizations), Cross-sector — internet-facing PeopleSoft / ERP operatorsT1190T1041Unauthenticated exploit (CVE-2026-35273, CVSS 9.8) of the internet-exposed PeopleSoft Updates Environment Management endpoint (PSEMHUB/PSIGW) over HTTP (CWE-306) → environment compromise → data stolen and published on the ShinyHunters leak site (100+ orgs notified, ~300 instances claimed).
Table methodology & sourcing notes
  • CVSS and EPSS were re-verified field-by-field against NVD and FIRST. Where NVD shows no CNA score, the CISA-ADP base is used (e.g. Chrome). KEV due dates are read per CVE; only Check Point, Ivanti, Exchange and PeopleSoft have passed or imminent deadlines.

Control Deficiency & Framework Mapping

ThreatControl gapsISO 27001NIST CSF 2.0CIS ControlsPrivacy Act / PIPEDAITSG-33OSFI B-13ISO 42001
T1Check Point IKEv1 VPN Authentication Bypass (CVE-2026-50751)
  • Reliance on deprecated IKEv1 and legacy VPN clients in production, against crypto-hardening expectations for perimeter appliances.
  • No mandatory device-based (machine-certificate) authentication for remote access, leaving a password-only path the flaw bypasses.
  • Weak edge-device lifecycle management — four affected branches are End-of-Support yet still deployed.
  • Incomplete asset/exposure inventory for internet-facing VPN services, slowing identification after KEV listing.
  • Limited VPN monitoring / forensic readiness — vendor guidance requires retrospective log review to 7 May.
A.5.15, A.5.16, A.8.5, A.8.8, A.8.9, A.8.16, A.8.20ID.AM-01, ID.RA-01, PR.AA-03, PR.AA-05, DE.CM-01CIS 1, CIS 2, CIS 4, CIS 7, CIS 12IA-2, AC-17, RA-5, SI-2, SC-7, AU-6B-13 Governance, B-13 Patch Mgmt, B-13 Vulnerability Management, B-13 Access Control, B-13 Third-Party Risk
T2Ivanti Sentry OS Command Injection + Auth Bypass (CVE-2026-10520, CVE-2026-10523)
  • Internet-exposed management interface (port 8443) — should never be internet-reachable per Ivanti/CISA, yet exploitation hits exposed instances.
  • Absent emergency patch SLA — patch shipped ~9/10 Jun, backdooring observed 11 Jun; no sub-24h emergency patching for a KEV max-severity edge flaw.
  • Compensating controls not enforced — mTLS (EPMM) / restricted API (Neurons-for-MDM) were the only pre-patch mitigation.
  • Inadequate appliance forensic readiness — Shadowserver backdoor findings require retrospective review.
  • Repeat vendor-lifecycle exposure of Ivanti edge products — a systemic vendor-risk governance gap.
A.8.8, A.8.9, A.8.16, A.8.20, A.8.22ID.AM-01, ID.RA-01, PR.PS-01, PR.AA-05, DE.CM-01CIS 1, CIS 4, CIS 7, CIS 12, CIS 13SI-2, RA-5, CM-7, SC-7B-13 Patch Mgmt, B-13 Vulnerability Management, B-13 Governance
T3Cisco Catalyst SD-WAN Manager Command Injection (CVE-2026-20245)
  • SD-WAN management-plane access not sufficiently restricted/segmented to trusted admins.
  • Privileged (netadmin) access convertible to root — weak privilege separation on the management appliance.
  • No compensating control / workaround exists — weak resilience + discontinuation planning for unpatched KEV flaws.
  • Limited detection/forensic readiness for config changes pushed to edge devices.
  • Insufficient vendor-response / emergency-governance planning for KEV-listed, no-patch infrastructure flaws.
A.5.15, A.8.8, A.8.9, A.8.16, A.8.20ID.RA-01, PR.AA-03, PR.AA-05, PR.PS-01, DE.CM-01CIS 4, CIS 7, CIS 12, CIS 16SI-2, RA-5, CM-7, SC-7B-13 Patch Mgmt, B-13 Vulnerability Management, B-13 Governance
T4Microsoft Exchange Server OWA Cross-Site Scripting Zero-Day (CVE-2026-42897)
  • EEMS not universally enabled/monitored — the only control for the 26-day window; disabled/overridden EEMS = no compensating control.
  • No accelerated KEV-aligned patch schedule — deadline passed 29 May; full patch 9 June; still-unpatched servers overdue.
  • No lifecycle plan for End-of-Support Exchange (2016/2019, EoS Oct 2025).
  • Inadequate email content filtering / OWA CSP hardening against XSS-class flaws.
  • No documented emergency-patch SLA distinguishing KEV/active-exploit from routine monthly patching.
A.5.16, A.8.8, A.8.9, A.8.16, A.8.20ID.AM-01, ID.RA-01, PR.AA-03, PR.PS-01, DE.AE-02, DE.CM-01CIS 2, CIS 4, CIS 7, CIS 9, CIS 13RA-5, SI-2, CM-7, SC-7B-13 Governance, B-13 Patch Mgmt, B-13 Vulnerability Management
T5Google Chrome V8 Out-of-Bounds Zero-Day (CVE-2026-11645)
  • No centralized browser update management (Chrome Cloud Management / GPO / MDM) — can't guarantee rapid fleet-wide patching.
  • Browser updates excluded from the KEV-triggered emergency patch SLA.
  • Insufficient browser-version compliance monitoring across the endpoint estate.
  • No defence-in-depth against browser-side exploit delivery (web proxy / URL filtering / browser isolation).
A.8.8, A.8.9, A.8.16, A.8.20ID.AM-01, ID.RA-01, PR.PS-01, DE.CM-01CIS 2, CIS 4, CIS 7, CIS 9, CIS 13RA-5, SI-2, CM-7, SC-7B-13 Governance, B-13 Patch Mgmt, B-13 Vulnerability Management
T6LiteLLM MCP stdio Command Injection (CVE-2026-42271)
  • No role-based access control / input validation on the MCP preview endpoints — gated only by any valid API key, no role check (vendor-acknowledged).
  • AI-infrastructure components excluded from vulnerability-management / patch-SLA programmes — two KEV-listed LiteLLM flaws in ~30 days.
  • LLM API credentials stored unisolated in the gateway's execution environment — RCE directly harvests them.
  • Insufficient network segmentation for AI gateway services — exploited instances are internet-reachable.
  • No AI-governance / SDLC-assurance applied to AI-infrastructure procurement and lifecycle.
A.5.19, A.5.20, A.8.8, A.8.9, A.8.20, A.8.22, A.8.25GV.SC-01, ID.AM-01, ID.RA-01, PR.AA-03, PR.AA-05, PR.PS-01, DE.CM-01CIS 2, CIS 4, CIS 7, CIS 12, CIS 15, CIS 16RA-5, SI-2, CM-7, SC-7, SA-12B-13 Governance, B-13 Patch Mgmt, B-13 Vulnerability Management, B-13 Third-Party RiskA.10.3, A.6.2.6
T7Splunk Enterprise Unauthenticated PostgreSQL Sidecar RCE (CVE-2026-20253)
  • Unauthenticated administrative/recovery endpoints reachable on a tier-one logging and SIEM platform.
  • SIEM infrastructure not segmented from general network access; governed as ordinary application infrastructure rather than a security control point.
  • Patch lag on security tooling itself — the platform relied on for detection is also unpatched attack surface.
  • Insufficient monitoring of the SIEM platform's own host for anomalous file writes or script changes.
  • No internal exception/risk-acceptance process for non-KEV criticals with a public PoC.
A.5.15, A.8.8, A.8.9, A.8.16, A.8.20ID.RA-01, PR.AA-03, PR.AA-05, PR.PS-01, DE.CM-01, DE.CM-09CIS 2, CIS 4, CIS 7, CIS 12, CIS 13SI-2, RA-5, CM-7, SC-7, AU-6B-13 Governance, B-13 Patch Mgmt, B-13 Vulnerability Management
T8Oracle PeopleSoft Data-Theft Campaign (CVE-2026-35273)
  • Internet exposure of PeopleSoft management endpoints (PSEMHUB / PSIGW).
  • Insufficient endpoint restriction / no compensating control while no patch exists.
  • Weak emergency response to KEV-listed, no-patch ERP flaws.
  • Inadequate detection/logging for PeopleSoft access and bulk-data exfiltration.
  • Insufficient segregation of ERP administration from external-facing access; weak forensic readiness for active data-theft campaigns.
A.5.15, A.5.34, A.8.8, A.8.9, A.8.16, A.8.20, A.8.23ID.RA-01, PR.AA-01, PR.AA-05, PR.PS-01, DE.AE-02, DE.CM-01CIS 4, CIS 7, CIS 8, CIS 9, CIS 13SI-2, RA-5, CM-7, SC-7, AU-6B-13 Governance, B-13 Patch Mgmt, B-13 Vulnerability Management, B-13 Third-Party Risk

Privacy Act / PIPEDA & OSFI: No row asserts a PIPEDA obligation — the one confirmed breach this week (University of Nottingham, via the PeopleSoft-actor ShinyHunters) is UK-based and falls under the ICO / UK GDPR, not PIPEDA. A Canadian organization running internet-facing PeopleSoft, Exchange, or a compromised backup that holds personal data would carry direct PIPEDA breach-reporting exposure; OSFI B-13 patch, vulnerability, and third-party-risk expectations apply to federally regulated entities. Assess against your own data map and regulatory footprint.

Risk Triage

Threats are assigned to primary zones based on their dominant organizational risk characteristic. A threat may appear in a secondary zone when it presents a materially distinct compounding risk dimension.

Exposure Velocity

Active exploitation or weaponized capability with immediate organizational exposure if unaddressed.

  • T1Check Point IKEv1 VPN bypass — KEV deadline passed

    Exploited since 7 May, one case tied to a Qilin affiliate. Apply SK185033 or move Remote Access to IKEv2-only and require machine certificates now.

  • T2Ivanti Sentry root RCE — BOD 26-04 deadline passed

    Public PoC, exposed instances backdoored within a day of patch. Patch to R10.5.2/R10.6.2/R10.7.1 and treat any internet-facing instance as compromised.

  • T4Exchange OWA XSS zero-day — KEV deadline passed

    Actively exploited; full patch shipped 9 June after a ~26-day window. Install the June updates, keep EEMS enabled, review OWA logs from 14 May.

  • T5Chrome V8 zero-day — KEV due 23 June

    Fifth actively exploited Chrome zero-day of 2026; drive-by code execution via a crafted page. Push 149.0.7827.102/.103 fleet-wide and confirm compliance.

Incident Pressure

Confirmed campaign or large-scale exposure with direct impact on organizations or their data.

  • T8Oracle PeopleSoft data-theft campaign (ShinyHunters / UNC6240)

    Active exfiltration and public leakage; 100+ organizations notified, 68% higher education; no patch yet. Disable the Environment Management Hub or block /PSEMHUB/* and begin forensic triage.

  • T1Check Point VPN — ransomware staging (secondary)

    One intrusion is associated with a Qilin ransomware affiliate, giving the VPN bypass a credible path to business-disrupting encryption if not remediated.

Governance & Control Gaps

Structural control deficiencies revealed by the day's threats, independent of any single exploit.

  • T3Cisco SD-WAN Manager — no patch available

    A KEV-listed flaw with no patch or workaround forces an explicit risk decision: harden and monitor management-plane access, or discontinue the component.

  • T6LiteLLM — AI infrastructure outside vuln management

    Second KEV-listed LiteLLM flaw of 2026 reveals AI-gateway components excluded from patch-SLA, segmentation, and vendor-assurance rigour — and missing from the ISO 42001 AI register.

  • T7Splunk — SIEM plane governed as ordinary infrastructure

    A 9.8 unauthenticated RCE with a public PoC (no exploitation yet) exposes a structural gap: detection infrastructure not held to the same exposure-management and patch-SLA standard as the systems it monitors.

Strategic Posture

Cross-cutting pattern requiring board-level awareness and programme-level response.

  • T1 · T2 · T3 · T4 · T5BOD 26-04 compresses the perimeter patch clock to 3 days

    Five KEV-listed edge / management-plane exploits under a new 3-day federal deadline set the de-facto SLA bar regulated organizations will be measured against. The board question is whether emergency patch cadence and exposure management for internet-facing infrastructure can actually meet it.

  • T6AI infrastructure has joined the KEV catalog

    LiteLLM's second KEV listing of 2026 signals that AI gateways, proxies, and agent frameworks now carry the same exploited-in-the-wild risk as firewalls — and belong under the same vulnerability management, segmentation, and ISO 42001 AI-system governance.

Remediation Actions

Consolidated actions across all eight threats, organized by time horizon. T-badges indicate which threat each action addresses.

0 – 24 hours

Immediate response

  • T1Apply Check Point hotfix SK185033, or set Remote Access VPN to IKEv2-only, remove legacy clients, and require machine certificates.
  • T2Patch Ivanti Sentry to R10.5.2/R10.6.2/R10.7.1; block management port 8443 from the internet and enforce mTLS where unpatched.
  • T4Install the June 2026 Exchange Security Updates (SE/2019/2016) and confirm EEMS is enabled and not overridden.
  • T5Push Chrome 149.0.7827.102/.103 fleet-wide; force a relaunch for users who haven't restarted since 9 June.
  • T8Disable the PeopleSoft Environment Management Hub (or remove PSEMHUB), or block /PSEMHUB/* and /PSIGW/HttpListeningConnector at the perimeter.
  • T3No Cisco patch exists — restrict SD-WAN Manager management-plane access to trusted admins and audit netadmin accounts now.
  • T7Upgrade Splunk Enterprise to 10.0.7 or 10.2.4; until patched, restrict network access to the PostgreSQL sidecar's recovery endpoints to trusted admin hosts only.

7 days

Short-term hardening

  • T6Upgrade LiteLLM to v1.83.7 and Starlette to ≥1.0.1; rotate all backend LLM API keys (assume pre-patch harvest) and restrict MCP-preview endpoints to admin roles.
  • T1Review Check Point VPN logs back to 7 May for anomalous IKEv1 sessions and connections from the named attacker VPS providers / IPs.
  • T2Add SIEM detections for unauthenticated POSTs to the Sentry /mics .../handleMessage endpoint and for new admin-account creation; run forensics on exposed instances.
  • T8Review WebLogic / web-server logs for access to PSEMHUB and PSIGW endpoints; begin forensic triage and start the privacy breach-assessment clock if personal data is involved.
  • T5Run an endpoint compliance check for Chrome versions below the fix; escalate non-compliant devices before the 23 June KEV deadline.

14 – 30 days

Programme remediation

  • T1T2Plan decommissioning / migration of End-of-Support edge appliances (Check Point R80.20.X/R80.40/R81/R81.10; legacy Ivanti) to supported releases.
  • T4Accelerate migration off End-of-Support Exchange 2016/2019 to Subscription Edition or Exchange Online.
  • T3Decide continue-vs-discontinue for the unpatched Cisco SD-WAN Manager; redesign management-plane segmentation and privileged-access controls.
  • T7Audit network reachability to all Splunk management and PostgreSQL sidecar ports; remove any inadvertent internet exposure and add the instance to the standard vulnerability-management scan scope.
  • T5Deploy enterprise browser management (Chrome Cloud Management / GPO / MDM) for enforced updates and fleet version reporting.

Ongoing

Structural controls

  • T1T2T3T4T5Establish an emergency-patch SLA for KEV-listed edge / management-plane flaws aligned to the BOD 26-04 3-day clock, with fleet-wide completion before the KEV due date.
  • T6Bring AI-infrastructure (LLM gateways, proxies, agent frameworks) under vulnerability management, network segmentation, vendor-SDLC assurance, and the ISO 42001 AI system register.
  • T7Govern SIEM and other security tooling as critical control infrastructure: same vulnerability-management SLA, network segmentation, and host-integrity monitoring as the systems it protects.
  • T8Run continuous exposure management for internet-facing ERP and management endpoints, with alerting when a management interface becomes publicly reachable.

Provenance

Cadence

Published each weekday. Primary intelligence drawn from BleepingComputer, SecurityWeek, The Hacker News, The Record, KrebsOnSecurity, and researcher disclosures, supplemented by vendor advisories, the Canadian Centre for Cyber Security, CVE and NVD records, and MITRE ATT&CK frameworks. Use the Share button on any issue to join the distribution list.

PIPEDA already governs how your AI handles customer data.The next enterprise deal that asks “show us your AI governance program” won’t wait for a new law to land — and most teams can’t answer that question today.

Get Your AI Governance Roadmap →