Thursday, June 11, 2026
Daily digest
June 2026 Patch Tuesday was historic — Microsoft fixed a record 206 vulnerabilities including three actively exploited zero-days (two SYSTEM-privilege escalations and one BitLocker bypass). Pair that with an actively exploited max-severity Ivanti Sentry RCE and a new CISA patching directive, and this is a heavy patch week.
Microsoft Patches Record 206 Flaws, Including Three Zero-Days and Critical RCE Bugs
Microsoft's June 2026 Patch Tuesday addressed 206 CVEs — a record — including 39 rated Critical. Three zero-days were publicly known at release time, among them two privilege-escalation flaws (YellowKey, GreenPlasma) granting SYSTEM-level access on fully patched Windows systems and a third (MiniPlasma) that bypasses BitLocker-protected drive protections. An actively exploited Exchange Server XSS zero-day enabling arbitrary JavaScript execution in Outlook Web Access was also patched.
Why it matters: Your Intune-managed Windows 11 fleet and any on-prem Exchange infrastructure need immediate attention — the SYSTEM-priv zero-days are confirmed exploited in the wild, and the BitLocker bypass is a direct threat to your encryption-at-rest posture required under NIST 800-171 control 3.13.16. Validate that June CUs are deploying successfully via Intune compliance reporting given the separate known update-installation failure affecting Windows 11 24H2/25H2 upgrades.
Microsoft Patches YellowKey, GreenPlasma, MiniPlasma Zero-Days
The three zero-days patched in this month's update include YellowKey and GreenPlasma, both privilege-escalation vulnerabilities allowing attackers to achieve SYSTEM privileges on fully patched Windows systems, and MiniPlasma, which provides unauthorized access to BitLocker-protected drives. All three were publicly disclosed prior to patches being available.
Why it matters: MiniPlasma specifically undermines BitLocker — a control your environment relies on for CUI protection on endpoints. Prioritize this patch above the broader Patch Tuesday rollout and verify BitLocker recovery key escrow in Intune/Entra ID is intact after applying the fix.
Max Severity Ivanti Sentry Vulnerability Now Exploited in Attacks
Attackers are actively exploiting a recently patched maximum-severity (CVSS 10.0) vulnerability in Ivanti Sentry, the secure mobile gateway product. Successful exploitation allows unauthenticated remote code execution with root privileges on internet-exposed appliances. A second critical flaw rated 9.9 was also disclosed alongside the patch.
Why it matters: If Ivanti Sentry is part of your mobile device management boundary — common in DoD-adjacent environments managing GCC High access from mobile endpoints — this is an emergency patch. Unauthenticated root RCE on a perimeter gateway is a critical CUI exposure risk under NIST 800-171 3.13.x controls.
CISA Rewrites Federal Patching Requirements for AI Threat Era (BOD 26-04)
CISA issued Binding Operational Directive 26-04, overhauling how federal agencies must prioritize vulnerability remediation in response to AI-accelerated exploit development. Vulnerabilities meeting all four risk criteria — including active exploitation and critical CVSS scores — must be remediated within three days; less severe issues receive extended windows. The directive explicitly cites AI-powered tooling as the driver for tightening timelines.
Why it matters: BOD 26-04 applies directly to federal agencies, but CMMC Level 2 assessors routinely look to CISA directives as leading indicators of where NIST 800-171 enforcement expectations are heading — particularly around vulnerability management (3.11.2/3.11.3). A three-day remediation window for high-risk flaws is significantly tighter than most contractor patch SLAs; review your current patch cadence against this benchmark now.
Nightmare-Eclipse Drops Windows Defender Zero-Day 'RoguePlanet'
A disgruntled security researcher operating as 'Nightmare-Eclipse' publicly released a new proof-of-concept exploit called RoguePlanet targeting a Windows Defender vulnerability that allows full system takeover. This follows a prior public exploit drop from the same researcher, who is engaged in an ongoing public dispute with Microsoft over bug bounty handling. No patch has been released for the new PoC.
Why it matters: An unpatched, publicly available Defender exploit PoC is a direct risk to your Windows 11 fleet. Monitor Microsoft's security advisories closely and consider whether temporary Defender configuration mitigations or enhanced endpoint detection tuning are warranted while a patch is pending.
China-Linked JDY Botnet Expands to 1,500+ Devices, Now Targeting U.S. Military Networks
Researchers at Lumen identified a significant expansion of the JDY botnet, a China-nexus network of over 1,500 compromised SOHO and IoT devices used for high-speed reconnaissance scanning of exposed services. The botnet is associated with state-sponsored threat actors including Volt Typhoon and has expanded its targeting to include U.S. military networks. JDY functions as a centralized scanning and fingerprinting platform rather than a traditional malware distribution network.
Why it matters: DIB contractors operating in the same network space as U.S. military infrastructure are a logical reconnaissance target for Volt Typhoon-affiliated activity. Review your internet-exposed service inventory and ensure SOHO/IoT devices on or adjacent to your network are segmented and updated — these are the botnet's building blocks.
Ivanti, Fortinet, and SAP Release Patches for Multiple Critical Vulnerabilities
Fortinet patched CVE-2026-25089 (CVSS 9.1), a command injection vulnerability in FortiSandbox and its cloud/PaaS variants. Ivanti released patches for the two Sentry critical flaws (CVSS 10.0 and 9.9). SAP also issued fixes for multiple critical vulnerabilities in its product portfolio as part of a coordinated release.
Why it matters: If FortiSandbox is in your security stack for email or file detonation, the 9.1-severity command injection flaw warrants immediate patching — web UI exposure is the attack vector, so verify whether your management interface is accessible from untrusted networks.
CISA Adds Cisco, Chrome, and Arista Flaws to KEV Catalog
CISA added three actively exploited vulnerabilities to its Known Exploited Vulnerabilities catalog: CVE-2026-20245 (CVSS 7.8) in Cisco Catalyst SD-WAN Manager involving improper output encoding, plus flaws in Google Chrome and Arista network equipment. All three have confirmed in-the-wild exploitation.
Why it matters: If Cisco SD-WAN Manager is part of your network fabric, CVE-2026-20245 is now CISA-confirmed exploited and falls under BOD 22-01 remediation requirements. Verify patching status immediately and check for indicators of compromise on the management plane.
GitHub to Disable npm Install Scripts by Default in npm v12
GitHub announced that npm version 12, expected next month, will disable install scripts by default as a breaking change to combat software supply chain attacks. The change targets npm lifecycle hooks (pre/post install scripts) that attackers have abused — most recently via the Shai-Hulud worm — to execute malicious code automatically during package installation. Developers will need to explicitly opt in to allow install scripts for packages that require them.
Why it matters: If your Ansible automation pipelines or developer workstations use npm as part of any CI/CD or toolchain workflow, the npm v12 upgrade will be a breaking change requiring pipeline testing before rollout. This is also directly relevant to your supply-chain risk management obligations under NIST 800-171 3.14.x.
Unpatched Langflow Path Traversal Flaw CVE-2026-5027 Exploited in the Wild
Attackers are actively exploiting CVE-2026-5027 (CVSS 8.8), a path traversal vulnerability in Langflow, an open-source low-code platform for building AI applications, to write arbitrary files to exposed servers. The flaw remains unpatched at time of reporting. VulnCheck confirmed active exploitation via a POST endpoint that allows unauthenticated file writes.
Why it matters: If your self-hosted AI stack includes Langflow for workflow orchestration or AI application development, this unpatched RCE-equivalent vulnerability requires immediate attention — either isolate the instance behind strict network controls or take it offline until a patch is available.
Oracle PeopleSoft Servers Targeted by ShinyHunters in Active Data Theft Campaign
The ShinyHunters extortion group is conducting ongoing attacks against Oracle PeopleSoft servers, claiming data theft from over 100 organizations. The same group claimed credit for the University of Nottingham breach, where 40 GB of data and 455,000 email addresses were reportedly stolen. Attack vectors and specific CVEs exploited in the PeopleSoft campaign have not been fully disclosed.
Ansible Automation Platform 2.7: Visual Execution Environment Builder and Content Discovery
Red Hat released Ansible Automation Platform 2.7, introducing a visual execution environment builder and unified content discovery experience within the automation portal. The update aims to reduce time spent manually identifying dependencies, tracking collections across repositories, and configuring execution environments. The changes are designed for platform engineers managing large-scale automation deployments.
Why it matters: If you're running Ansible Automation Platform in your environment for configuration management and compliance automation, AAP 2.7's EE builder directly reduces the overhead of maintaining consistent, auditable execution environments — relevant to repeatable CMMC configuration baselines.