Table of Contents
💡 TL;DR Weekly Snapshot
This week (February 23–28, 2026) saw critical updates around core infrastructure attacks, including an actively exploited Cisco SD-WAN zero-day vulnerability, Roundcube Webmail RCE and XSS flaws added to the CISA Known Exploited Vulnerabilities catalog, and notable malware activity such as the Golang-based Moonrise malware. Old protocols like WebDAV continue to be abused in multi-stage campaigns, underscoring the importance of patching and defensive controls.
🔴 Critical Vulnerability Alerts
Cisco Catalyst SD-WAN Active Zero-Day (CVE-2026-20127)
- Severity: Critical
- A zero-day in Cisco Catalyst SD-WAN was actively exploited, prompting urgent guidance from Five Eyes cybersecurity agencies. The vulnerability allows unauthenticated remote access and command execution, placing SD-WAN controllers at risk. Immediate remediation and access restrictions are advised.
Roundcube Webmail RCE & XSS Exploits
- CISA added remote code execution and cross-site scripting vulnerabilities affecting Roundcube Webmail to its Known Exploited Vulnerabilities catalog, indicating active abuse in the wild. Administrators should update systems and apply input validation and WAF protections.
🌍 Threat Landscape & Malware Activity
Moonrise Malware Operations
- Moonrise, a Golang-based Windows malware using unencrypted WebSocket command-and-control, has been observed in new threat reports. It enables persistent live surveillance and remote control capabilities, making it a notable threat for credential theft and operational compromise.
Ongoing Threat Activity
- Agent Tesla continues phishing-led data exfiltration campaigns via process injection.
- Developer-targeting campaigns using trojanised Next.js repositories attempt to compromise build workflows.
- Legacy protocols and misconfigurations like WebDAV are still exploited for multi-stage malware delivery.
🧠 Laboratory Insight
- Active zero-day exploitation on core network appliances emphasizes the need for rapid patching and strict access control.
- Continued abuse of outdated protocols like WebDAV highlights attack vectors still leveraged in 2026.
- Persistent threats such as Moonrise and Agent Tesla exhibit both credential theft and control persistence tactics, necessitating layered defenses.
🛡️ Defense & Remediation Recommendations
- Apply vendor patches and emergency mitigations for all critical exploitable vulnerabilities.
- Deploy or update web application firewalls and intrusion detection signatures to mitigate RCE and Web vulnerabilities.
- Audit exposed endpoints and disable deprecated protocols where feasible.
- Employ behavior-based detection and sandboxing to counter advanced malware families.