HIGH
CVSS 7.8 HIGH · EPSS N/A · Microsoft Active Directory Federation Services
ThreatPodium
Detection Playbook: Process Injection (T1055)
Process injection (T1055) is a technique where adversaries insert and execute arbitrary code within the address space of a running, legitimate process. By hi…
Threat Intelligence Report — July 13, 2026 | 7 New KEVs · 221 Victims
Report Date: 2026-07-13
New KEVs: 7 ▲ +6 vs last weekRansomware Victims: 221 ▲ +29 vs last week
7 vulnerabilities were added to the CISA Known Exploited Vulnerabilities catalog this period. Langflow products show the strongest concentration of risk signals this week. Ransomware activity is moderate with 221 new victims posted to leak sites over the last 7 days, with Deadlock posting the most victims.
Detection Playbook: Token Impersonation/Theft (T1134.001)
Token Impersonation/Theft (T1134.001) is a Windows privilege escalation technique in which an adversary duplicates an existing access token belonging to anot…
Threat Intelligence Report — July 12, 2026 | 6 New KEVs · 219 Victims
Report Date: 2026-07-12
New KEVs: 6 ▲ +4 vs last weekRansomware Victims: 219 ▲ +31 vs last week
6 vulnerabilities were added to the CISA Known Exploited Vulnerabilities catalog this period. Joomshaper products show the strongest concentration of risk signals this week. Threat intelligence sources this period reference ALPHV / BlackCat and Qilin. Ransomware activity is moderate with 219 new victims posted to leak sites over the last 7 days, with Deadlock posting the most victims.
Detection Playbook: DNS (T1071.004)
DNS tunneling (T1071.004) is a command-and-control technique where adversaries embed data — including commands and exfiltrated output — inside DNS query and …
Threat Intelligence Report — July 11, 2026 | 6 New KEVs · 222 Victims
Report Date: 2026-07-11
New KEVs: 6 ▲ +4 vs last weekRansomware Victims: 222 ▲ +20 vs last week
6 vulnerabilities were added to the CISA Known Exploited Vulnerabilities catalog this period. Icagenda products show the strongest concentration of risk signals this week. Threat intelligence sources this period reference ALPHV / BlackCat and Qilin. Ransomware activity is moderate with 222 new victims posted to leak sites over the last 7 days, with Deadlock posting the most victims.
Detection Playbook: Web Protocols (T1071.001)
Web Protocols (T1071.001) describes adversaries using HTTP, HTTPS, and WebSocket as the transport layer for command-and-control (C2) communication. Rather th…
Threat Intelligence Report — July 10, 2026 | 6 New KEVs · 197 Victims
Report Date: 2026-07-10
New KEVs: 6 ▲ +4 vs last weekRansomware Victims: 197 ▼ -2 vs last week
6 vulnerabilities were added to the CISA Known Exploited Vulnerabilities catalog this period. Langflow products show the strongest concentration of risk signals this week. Threat intelligence sources this period reference ALPHV / BlackCat and Qilin. Ransomware activity is moderate with 197 new victims posted to leak sites over the last 7 days, with Deadlock posting the most victims.