Daily · 2026-06-25
🟠Cisco SD‑WAN zero‑day exposed, Ubiquiti/Lantronix KEV, Amadey/StealC takedown, Mistic RAT, macOS EDR bypass, 25‑year‑old curl bug
Cisco SD-WAN zero-day (CVE-2026-20245) exploited since March with root access; CISA adds 4 max-severity Ubiquiti/Lantronix flaws to KEV under active exploitation; Operation Endgame simultaneously disrupts Amadey and StealC malware networks recovering 27M credentials; Woodgnat IAB deploys new Mistic RAT linking to 6 ransomware families; macOS non-admin EDR bypass demonstrated against CrowdStrike and Kandji; 25-year-old curl vulnerability patched in 8.21.0; Chrome 149 patches 18 severe vulns including actively exploited CVE-2026-11645.
The seventh Cisco SD-WAN zero-day of 2026 is the day's defining story. Mandiant's forensics on CVE-2026-20245 show an unknown actor chaining an authentication bypass to a crafted CSV upload and creating rogue root accounts on vManage, vSmart, and vBond at a communications provider, complete with configuration backups, log clearing, and trace removal afterward. Cisco SD-WAN CVE-2026-20245 is the pattern Mandiant calls living off the edge; monitor for unauthorized peering connections and CSV uploads to the tenant CLI.
CISA added four exploited flaws to KEV: three chainable Ubiquiti UniFi OS bugs giving full RCE and the Lantronix EDS5000 root command injection, starting the BOD 26-04 clock. Google patched the fifth Chrome zero-day of 2026, an in-the-wild V8 out-of-bounds read/write. The 25-year-old curl flaw, CVE-2026-8932, shows AI-assisted auditing finding the oldest bug in a foundational library; connection reuse after certificate changes could leak credentials to the wrong endpoint.
Operation Endgame took down 326 servers and recovered 27 million credentials across Amadey and StealC in the first dual-malware RICO takedown. Operation Endgame The macOS EDR bypass is the strategic item: a standard user chaining legitimate OS behavior can unload CrowdStrike Falcon and deactivate Kandji MDM, so endpoint visibility claims deserve skepticism.
Watchlist: SD-WAN Manager patch status, UniFi OS and EDS5000 updates against the BOD 26-04 deadline, Chrome rollout, and macOS endpoint agent version verification.