Table of Contents
Weekly Summary: The final week of January 2026 brought a storm of vulnerabilities. Fortinet issued a critical warning regarding a bypass in its Cloud SSO mechanism; Microsoft released an out-of-band patch for an Office security bypass currently being exploited; and Ivanti faces yet another round of pre-auth RCE exploits. Meanwhile, Nike is investigating a massive 1.4TB data breach claim.
🔴 Critical Vulnerabilities
1. Fortinet FortiCloud SSO Authentication Bypass (CVE-2026-24858)
- Severity: Critical
- Disclosed: Jan 28, 2026
- Details:
A severe vulnerability affecting FortiOS, FortiManager, and FortiAnalyzer.
- Mechanism: Attackers can leverage an “alternate path or channel” to bypass FortiCloud Single Sign-On (SSO) and access devices linked to a target’s account.
- Active Exploitation: Fortinet confirmed that at least two malicious accounts actively exploited this flaw in the wild on January 22.
- Action Required: Upgrade firmware immediately. Fortinet temporarily disabled SSO on some unpatched devices to mitigate risks.
2. Microsoft Office Security Feature Bypass (CVE-2026-21509)
- Severity: High (CVSS 7.8) - Added to CISA KEV
- Disclosed: Jan 26, 2026
- Details:
Microsoft released an Out-of-Band update for this flaw. It allows attackers to bypass OLE (Object Linking and Embedding) security mitigations via specially crafted Office files.
- Risk: Although it requires user interaction, it is being actively exploited to deliver payloads via phishing, effectively neutralizing Office’s built-in defenses.
3. Ivanti EPMM Remote Code Execution (CVE-2026-1281 & CVE-2026-1340)
- Severity: Critical
- Disclosed: Jan 30, 2026
- Details:
Ivanti Endpoint Manager Mobile (EPMM) is suffering from new Pre-Authentication Remote Code Execution vulnerabilities.
- Status: Security firm watchTowr reports that APT groups are actively weaponizing these flaws. Given EPMM’s edge-facing nature, this poses a severe threat to enterprise networks.
4. n8n Platform Sandbox Escape (CVE-2026-1470)
- Severity: Critical (CVSS 9.9)
- Details: The popular workflow automation tool n8n has a critical JavaScript injection vulnerability. It allows authenticated users to escape the execution sandbox and run arbitrary code on the host server, a nightmare scenario for automated AI pipelines.
🌍 Global Threats
🚨 Nike Investigates 1.4TB Data Breach
- Incident: On Jan 30, 2026, threat actors claimed to have breached Nike’s internal network, stealing 1.4TB of data.
- Impact: The leak allegedly includes business operations data, internal communications, and potential customer information. An internal investigation is underway.
🕵️♂️ “RedKitten” Campaign Targets NGOs
- Incident: On Jan 31, HarfangLab exposed RedKitten, a new cyber espionage campaign.
- Attribution: Suspected Iran-linked threat actor.
- Tactic: Uses GitHub and Google Drive for payload hosting and Telegram for C2 communications, primarily targeting Human Rights NGOs.
🛠️ Trending Tools
This week we highlight a new cloud audit tool from Mandiant:
1. AuraInspector
- Developer: Google Cloud / Mandiant
- Overview: An open-source tool released this week for auditing Salesforce Experience Cloud applications.
- Features:
- Focuses on the Aura framework to identify data access path vulnerabilities.
- Crucial for detecting misconfigurations that could expose community data.
2. OpenAEV
- Overview: Open-source Adversarial Exposure Validation platform.
- Use Case: Enables security teams to plan and run cyber adversary simulations, bridging the gap between technical red teaming and operational response.
About Lingtian Lab
We are dedicated to providing the latest cybersecurity intelligence and automated solutions. Standing with you against the threats of the AI era.
Sources: US-CERT, The Hacker News, GitHub Trending (Security).