T1203 - Exploitation for Client Execution - MITRE ATT&CK

Related Threat Clusters

• APT28 Exploits MSHTML Zero-Day Vulnerability in Windows

  APT28 has actively exploited a zero-day vulnerability in MSHTML affecting all Windows versions, which has a CVSS score of 8.8. The vulnerability allows for security bypass and poses significant risks to users. A patch…

  4 articles · Updated March 2, 2026
• Critical Exploitation of Cisco CM and Samsung KNOX Vulnerabilities

  Active exploitation of two critical vulnerabilities has been reported: CVE-2026-20230 in Cisco Unified CM and CVE-2026-20971 in Samsung KNOX. The Cisco flaw, a server-side request forgery (SSRF), poses an immediate…

  4 articles · Updated June 23, 2026
• Critical OpenSSL Vulnerability CVE-2025-15467 Patched

  OpenSSL has patched a high-severity stack buffer overflow vulnerability, tracked as CVE-2025-15467. This flaw allows unauthenticated attackers to trigger denial-of-service conditions and potentially execute remote code…

  5 articles · Updated January 29, 2026
• APT28 Exploits Zimbra Vulnerability in Ongoing Attacks Against Ukraine

  Russian state-backed hackers from APT28 are actively exploiting a high-severity stored cross-site scripting vulnerability (CVE-2025-66376) in the Zimbra Collaboration Suite (ZCS) to target Ukrainian government entities.…

  8 articles · Updated March 19, 2026
• Critical Remote Code Execution Vulnerability Exploited by China-Nexus Actor

  On April 3, 2025, Ivanti disclosed CVE-2025-22457, a critical buffer overflow vulnerability affecting Ivanti Connect Secure and other products. The vulnerability allows unauthenticated remote code execution, and…

  2 articles · Updated June 17, 2026
• Urgent CISA Directive: Patch Critical Ivanti EPMM Vulnerability CVE-2026-1340 by April 11

  The Cybersecurity and Infrastructure Security Agency (CISA) has mandated that U.S. federal agencies patch a critical vulnerability in Ivanti Endpoint Manager Mobile (EPMM), tracked as CVE-2026-1340, by April 11, 2026.…

  23 articles · Updated April 8, 2026
• Advanced Threat Actor Exploits Cisco and Citrix Zero-Day Vulnerabilities

  An advanced persistent threat actor exploited zero-day vulnerabilities in Cisco Identity Service Engine and Citrix NetScaler products. The attacks utilized custom malware and were detected by Amazon's MadPot honeypot…

  8 articles · Updated November 12, 2025
• FortiWeb WAF Vulnerability Enables Full Admin Control Exploitation

  A critical vulnerability in FortiWeb Web Application Firewall (WAF) has been actively exploited, allowing attackers to gain full administrative access to affected systems. Organizations using FortiWeb are at risk of…

  100 articles · Updated November 15, 2025
• Critical RCE Vulnerability in PTC Windchill and FlexPLM Under Active Exploitation

  Hackers are exploiting a critical vulnerability in PTC Windchill and FlexPLM, tracked as CVE-2026-12569, which allows remote code execution due to an unsafe deserialization flaw. This vulnerability affects product…

  2 articles · Updated June 29, 2026
• Critical Stored XSS Vulnerability in SiYuan Enables Remote Code Execution

  SiYuan, an open-source personal knowledge management system, has disclosed a critical stored cross-site scripting (XSS) vulnerability that can escalate to remote code execution (RCE) in its Electron desktop client. The…

  7 articles · Updated June 25, 2026

Recent Intelligence Reports

• Zero-Day Initiative (ZDI) discovered and reported the vulnerability — www.zerodayinitiative.com · July 17, 2026
• Critical 7-Zip Vulnerability Fixed in Version 26.02 found — Guru3D · July 17, 2026
• 7 — Cybersecuritynews · July 17, 2026
• Researcher poisons open-weight AI model for under $100 — Theregister · July 16, 2026
• Windows Exploitation 2014 — www.welivesecurity.com · July 16, 2026
• Cisco Smart Install vulnerability — nvd.nist.gov · July 14, 2026
• The July 2026 Security Update Review — Thezdi · July 14, 2026
• Cursor IDE Auto — Darkreading · July 14, 2026

Related Entities