Back www.fbi.gov

Russian Foreign Intelligence Service Exploiting Five Publicly Known Vulnerabilities To Compromise Us And Allied Networks

www.fbi.gov • May 24, 2026

The National Security Agency (NSA), the Cybersecurity and Infrastructure Security Agency (CISA), and the Federal Bureau of Investigation (FBI) jointly released a Cybersecurity Advisory, “ Russian SVR Targets U.S. and Allied Networks ,” today to expose ongoing Russian Foreign Intelligence Service (SVR) exploitation of five publicly known vulnerabilities. This advisory is being released alongside the U.S. government’s formal attribution of the SolarWinds supply chain compromise and related cyber espionage campaign. We are publishing this product to highlight additional tactics, techniques, and procedures being used by SVR so that network defenders can take action to mitigate against them.

Mitigation against these vulnerabilities is critically important as U.S. and allied networks are constantly scanned, targeted, and exploited by Russian state- cyber actors. In addition to compromising the SolarWinds Orion software supply chain, recent SVR activities include targeting COVID-19 research facilities via WellMess malware and targeting networks through the VMware vulnerability disclosed by NSA. This was highlighted in NSA’s Cybersecurity Advisory, “Russian State- Actors Exploiting Vulnerability in Workspace ONE Access Using Compromised Credentials.”

NSA, CISA, and FBI strongly encourage all cybersecurity stakeholders to check their networks for indicators of compromise related to all five vulnerabilities and the techniques detailed in the advisory and to urgently implement associated mitigations. NSA, CISA, and FBI also recognize all partners in the private and public sectors for comprehensive and collaborative efforts to respond to recent Russian activity in cyberspace.

NSA encourages its customers to mitigate against the following publicly known vulnerabilities:

For more information, review the advisory or visit NSA.gov/cybersecurity-guidance .

View the infographic on understanding the threat and how to take action .

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Russian SVR Exploits SolarWinds and Other Vulnerabilities Against U.S. Networks The Russian Foreign Intelligence Service (SVR) has been exploiting multiple vulnerabilities, including the SolarWinds breach, to compromise U.S. and allied networks. The SolarWinds attack, which began in September 2019, involved the insertion of trojanized code into software updates, affecting nearly 18,000 customers, including federal agencies. The SVR has also targeted COVID-19 research facilities and exploited other vulnerabilities such as those in VMware products. The NSA, CISA, and FBI have issued advisories to mitigate these threats and encourage network defenders to check for indicators of compromise. The ongoing exploitation of these vulnerabilities poses a significant risk to national security and critical infrastructure. 80

Extracted Entities

Russian Foreign Intelligence Service Exploiting Five Publicly Known Vulnerabilities To Compromise Us And Allied Networks

The full story

Extracted Entities

Attack Types (1)

Companies (1)

Malware (1)

MITRE ATT&CK (2)

Platforms (1)

Tools (1)