More CVEs, Same Playbook: 2026 Vulnerability Exploitation in the Wild

MITRE Techniques

• [T1566.001] Spearphishing Attachment – Threat actors delivered weaponized RTF attachments in targeted email campaigns to gain initial access (‘targeted spear-phishing campaigns delivering weaponized document attachments’).
• [T1203] Exploitation for Client Execution – Malicious Office documents exploited CVE-2026-21509 to execute code when opened by the victim (‘weaponized RTF files’, ‘initial code execution’).
• [T1059] Command and Scripting Interpreter – The infection chains culminated in execution of implants and payloads through scripted or interpreted execution paths (‘culminating in the NotDoor Outlook backdoor and Covenant Grunt implants’).
• [T1105] Ingress Tool Transfer – Secondary payloads were downloaded via WebDAV and cloud services as part of the infection chain (‘WebDAV connection to download secondary LNK files’, ‘Cloud storage services… serve as C2 infrastructure’).
• [T1021.002] Remote Services: SMB/Windows Admin Shares – WebDAV-based retrieval of secondary files resembles remote file access used to stage payloads (‘initiated a WebDAV connection to download secondary LNK files’).
• [T1204.002] Malicious File – LNK – LNK files embedded in RTF attachments were used to trigger further execution and bypass controls (‘the OLE objects embedded in the RTF attachments were LNK files’).
• [T1133] External Remote Services – Attackers targeted exposed management interfaces and remote access systems on the internet (‘exploitation attempts against exposed SD-WAN management interfaces’, ‘remote access management systems’).
• [T1190] Exploit Public-Facing Application – Public-facing cPanel, Exchange, SD-WAN, PAN-OS, and other internet-exposed services were targeted after disclosure (‘automated scanning traffic targeting cPanel instances’, ‘exposed SD-WAN management interfaces’).
• [T1211] Exploitation for Defense Evasion – CVE-2026-21510 was used to bypass Windows Shell security controls before DLL execution (‘invoke CVE-2026-21510 to bypass Windows Shell security controls’).
• [T1547.001] Boot or Logon Autostart Execution: Registry Run Keys/Startup Folder – Microsoft registry hardening guidance is referenced in the context of Office/Windows exploitation and persistence risk (‘Apply Microsoft’s registry hardening guidance alongside patches’).
• [T1071.001] Application Layer Protocol: Web Protocols – Cloud storage and WebDAV were used to blend malicious traffic with normal enterprise activity (‘Cloud storage services… blend malicious traffic with normal enterprise activity’).
• [T1584.008] Server – Compromise of Infrastructure – Threat actors used compromised websites and infrastructure such as cPanel and web inject chains to reach victims (‘compromising legitimate websites via web inject’).