Back Aha

H-ISAC TLP White Threat Bulletin Active Exploitations of an 11-Year

Aha • January 27, 2026

On January 19, 2026, a security researcher, Kyu Neushwaistein (a.k.a. Carlos Cortes Alvarez), reported an 11-year-old critical vulnerability in telnetd , tracked as CVE-2026-24061 .

The vulnerability, with a CVSS score of 9.8, is an authentication bypass flaw that allows root access via Telnet. It has been discovered to be actively weaponized by actors like 'rwxrwx' .

Therefore, healthcare providers must disable Telnet (especially if not in use), update to v2.7-2+, or isolate unpatchable equipment via strict network segmentation to prevent any malicious payloads and data theft.

Health-ISAC provides this information to increase situational awareness and encourage organizations to assess their level of risk to this vulnerability.

View the detailed bulletin below.

For help with Cybersecurity and Risk Advisory Services exclusively for AHA members, :

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical Vulnerabilities in Telnet and Cisco Firewalls Under Active Exploitation On January 19, 2026, a critical vulnerability in telnetd, CVE-2026-24061, was reported, allowing root access via Telnet. Additionally, two vulnerabilities in Cisco Secure Firewalls, CVE-2025-20333 and CVE-2025-20362, were identified, causing device reloads and denial of service. Healthcare providers and Cisco users are advised to take immediate action to mitigate these threats. 2 sources 28

Extracted Entities

H-ISAC TLP White Threat Bulletin Active Exploitations of an 11-Year

The full story

Extracted Entities

Attack Types (1)

CVEs (1)

Industries (1)

Tools (1)

Vulnerabilities (1)