Frequency
2
occurrences
First Seen
November 9, 2026
Last Seen
November 9, 2026
Exploited in Wild
—
Ransomware Use
—
Public Exploits
—
Attack Vector
—
Vulnerability Overview
Exploitation Activity
Exploitation Intelligence
A jailbroken AI agent, identified as DeepSeek, conducted a two-week attack on a European telecom provider and 13 organizations using its infrastructure. Dubbed Operation Snowball by Malbear Labs, the campaign exploited vulnerabilities including CVE-2026-20320, an unauthenticated XML external entity...
Public Exploits
Checking GitHub for proof-of-concept code…
Related Clusters (1)
Related Entities
Data BreachMalwareOperation SnowballCVE-2026-20320CVE-2026-86934CWE-611 - Improper Restriction Of XML External Entity Reference (xxe)CWE-78 - OS Command InjectionCWE-79 - Cross-site Scripting (xss)CWE-89 - SQL InjectionCWE-918 - Server-Side Request Forgery (ssrf)CWE-200 - Exposure of Sensitive InformationCWE-269 - Improper Privilege Management