Weekly threat intelligence digest: March 23-29, 2026

Executive summary

This week represents one of the most severe threat landscapes in recent months, dominated by critical remote code execution vulnerabilities across enterprise infrastructure, industrial control systems, and development tooling. Seven critical vulnerabilities demand immediate patching, while supply chain attacks targeting security tools and package repositories signal a shift in adversary focus toward infrastructure commonly trusted by defenders. Threat actors are actively exploiting disclosed vulnerabilities within days of public disclosure, leaving organizations with minimal response windows.

Critical & high priority

Quest KACE SMA exploitation campaign (CVE-2025-32975)

Threat actors are actively exploiting CVE-2025-32975 against internet-exposed instances of Quest KACE Systems Management Appliance. KACE SMA is mainstream enterprise IT infrastructure management software used for patch management, asset tracking, and compliance reporting—making it a high-value target for lateral movement within corporate networks.

Affected organizations: Any company running KACE SMA 12.x or earlier that hasn't patched should assume compromise is possible if the instance is internet-accessible.

Action: Immediately verify KACE SMA instances are not exposed to the internet. If exposed, take them offline pending patch deployment. Check firewall logs and authentication records for suspicious access patterns. Apply Quest's security updates without delay.

Schneider Electric critical flaws in Plant iT/Brewmaxx and Foxboro DCS

Schneider disclosed four critical vulnerabilities (CVSS 9.9) in Plant iT/Brewmaxx versions 9.60+ enabling privilege escalation to RCE, plus a separate critical untrusted deserialization flaw in EcoStruxure Foxboro DCS workstations. These vulnerabilities affect core industrial process control infrastructure in manufacturing, brewing, and chemical facilities.

Affected organizations: Organizations operating Schneider Electric brewing management or distributed control systems managing critical manufacturing processes.

Action: Immediately inventory affected systems. Prioritize patching Brewmaxx systems (high availability impact but patching possible). For Foxboro DCS, coordinate with engineering and operations teams on maintenance windows—do not patch runtime components, only engineering workstations. Verify network segmentation isolates DCS environments from corporate networks.

PTC Windchill/FlexPLM RCE (CVE-2026-4681)

PTC disclosed remote code execution affecting Windchill versions 11.0 through 13.1.3.0 and related FlexPLM platforms. These product lifecycle management systems manage intellectual property, design data, and supply chain workflows for manufacturing, aerospace, and defence contractors.

Affected organizations: Any organization using PTC Windchill for product lifecycle management, particularly in regulated sectors.

Action: Treat as supply chain compromise risk if instances are exposed or accessible from untrusted networks. Patch to version 13.1.4.0 or later immediately. Audit change logs and document access patterns from the last 30 days for forensic review. Assume any design or IP data modified in this period may have been exfiltrated.

Trivy supply chain compromise (CVE-2026-33634)

Threat actors used compromised credentials to inject malware into Aqua Security's Trivy vulnerability scanner and related GitHub Actions repositories. Trivy is a security scanning tool used by thousands of organizations in CI/CD pipelines—making this a supply chain attack on the defenders' toolchain itself.

Affected organizations: Any organization using Trivy v0.69.4-0.69.6 or the Trivy GitHub Action in CI/CD workflows.

Action: Immediately audit any CI/CD systems that executed compromised versions. Rotate all credentials, tokens, and secrets that may have been exposed during builds. Rebuild container images using patched Trivy versions (0.69.7+). Review git commit histories and build logs for suspicious activity during the affected timeframe. Consider this a potential supply chain compromise vector for any artifacts built with affected versions.

Pharos Mosaic Show Controller unauthenticated RCE (CVE-2026-2417)

Pharos Mosaic Show Controller firmware 2.15.3 contains unauthenticated remote code execution allowing arbitrary command execution with root privileges. This equipment manages lighting, projection, and stage automation for live events—affecting venues, studios, and broadcast infrastructure.

Affected organizations: Concert venues, theatres, broadcast studios, and event production facilities using Pharos Mosaic controllers.

Action: Immediately update firmware to patched versions. Until patched, implement network access controls restricting access to Mosaic controllers to physically secured networks only. Verify controller IP addresses are not exposed on public-facing networks. If controllers are internet-accessible, take them offline until firmware update is possible.

Langflow active exploitation (CVE-2026-33017)

CISA has confirmed active exploitation of CVE-2026-33017 in Langflow, a framework for building AI agent workflows. Attackers hijacking Langflow pipelines can poison AI outputs or exfiltrate training data integrated into these systems, affecting downstream applications.

Affected organizations: Organizations deploying Langflow-based AI agents or data processing workflows.

Action: Patch Langflow to the latest version immediately. Audit logs for suspicious workflow modifications or data access. Review any AI outputs generated by Langflow instances since the vulnerability was disclosed—outputs may have been poisoned. Implement read-only access controls for non-admin users on workflows containing sensitive data.

LangChain/LangGraph framework vulnerabilities

Three vulnerabilities in LangChain and LangGraph frameworks allow attackers to read filesystem data, extract environment variables containing secrets, and access conversation histories. These widely-adopted LLM frameworks affect thousands of applications using them as dependencies.

Affected organizations: Any application using LangChain or LangGraph in production, particularly those handling sensitive data or credentials via environment variables.

Action: Update to patched versions immediately. Audit environment variable usage—assume all secrets and credentials stored in environment variables have been compromised. Rotate API keys, database credentials, and authentication tokens. Implement least-privilege environment variable access and consider secret management tools instead of environment variables.

Convict configuration library prototype pollution (CVE-2026-33863, CVE-2026-33864)

Node-convict allows remote attackers to pollute Object.prototype through untrusted JSON/schema data, potentially enabling authentication bypass, RCE, or data exfiltration in applications relying on it for configuration validation.

Affected organizations: Applications using node-convict 6.2.4 or earlier for environment configuration, particularly in Node.js applications.

Action: Update convict to the patched version. Audit application deployments for configuration injection points—if configuration comes from untrusted sources (environment variables, files, API responses), assume prototype pollution may have occurred. Test for unexpected object properties appearing in runtime objects.

F5 BIG-IP RCE added to KEV catalog (CVE-2025-53521)

CISA has added CVE-2025-53521 to its Known Exploited Vulnerabilities catalog following active exploitation evidence. BIG-IP load balancers manage traffic for critical infrastructure, federal systems, and enterprise applications.

Affected organizations: Organizations deploying F5 BIG-IP for load balancing, application delivery, or traffic management.

Action: Treat as immediately exploitable given KEV designation. Patch BIG-IP instances to versions 16.1.4.3, 17.1.1.1, or 18.1.0 or later depending on your version track. If patching is not immediately possible, implement network segmentation and access controls restricting BIG-IP management interfaces to bastion hosts only.

OpenClaw gateway privilege escalation (multiple flaws)

OpenClaw gateway contains multiple privilege escalation vulnerabilities including insufficient scope validation in device pairing (allowing operators to approve requests with elevated scopes they don't possess) and implicit auth reconnect enabling silent escalation from operator.read to operator.admin, culminating in node RCE.

Affected organizations: Organizations deploying OpenClaw gateway for device management and orchestration.

Action: Update OpenClaw to the latest patched version. Audit operator access logs for unexpected permission escalations or unapproved device pairings. Review device approval workflows and restrict approvers to minimal necessary personnel. Implement explicit re-authentication requirements for operator scope changes.

VoidStealer malware targeting Chrome encryption

VoidStealer malware has developed techniques to bypass Chrome's Application-Bound Encryption by leveraging debugger access to extract the browser's master encryption key. This enables attackers to decrypt sensitive stored passwords and payment information without user interaction.

Affected organizations: Organizations with users running Chrome on Windows systems exposed to malware infection.

Action: Implement endpoint detection and response (EDR) controls to monitor for suspicious debugger activity and Chrome process interaction. Deploy malware prevention controls. Advise users to reset Chrome passwords and payment information if any suspicious activity is detected on their systems. Consider blocking debugger.exe and similar tools at the endpoint if your threat model allows.

WAGO industrial switches CLI escape (CVE-2026-3587)

WAGO industrial managed switches contain a hidden function allowing unauthenticated remote attackers to escape the restricted CLI and achieve complete device compromise. This affects critical supply chain risk for industrial control systems in manufacturing, utilities, and infrastructure.

Affected organizations: Organizations running WAGO managed switches (CoDeSys-based) in industrial control environments.

Action: Apply the security patch immediately—this is unauthenticated network RCE affecting core network infrastructure. Verify network segmentation isolates industrial control networks from corporate networks. Consider temporary workarounds restricting network access to switches until patching is complete.

Zebra blockchain node DoS (CVE-2026-34202)

A logic flaw in Zebra's transaction processing allows unauthenticated remote attackers to crash blockchain nodes by sending crafted V5 transactions. This DoS attack targets blockchain infrastructure directly.

Affected organizations: Organizations operating Zebra nodes for Zcash or similar blockchain applications.

Action: Upgrade Zebra to patch versions immediately. Implement rate limiting and transaction validation on your node. Consider deploying behind reverse proxies that can drop malformed transactions before they reach the node.

TeamPCP PyPI supply chain attack via Telnyx compromise

TeamPCP compromised the legitimate Telnyx package on PyPI and uploaded malware that extracts credential-stealing code from embedded WAV files. This represents direct compromise of Python's package supply chain.

Affected organizations: Any organization that installed compromised Telnyx versions from PyPI in the last 30 days.

Action: Immediately check Python dependency logs and container registries for affected Telnyx versions. Assume all secrets, credentials, and environment variables from affected systems have been compromised. Rotate all API keys, database credentials, SSH keys, and authentication tokens used on development and CI/CD systems. Rebuild all container images and deployment artifacts using patched Telnyx versions.

Notable developments

RedLine infostealer administrator arrested

Hambardzum Minasyan, allegedly responsible for administering the RedLine infostealer malware-as-a-service operation, has been extradited to the United States. RedLine has compromised thousands of organizations globally. This enforcement action signals continued law enforcement capability against malware infrastructure, though replacement services typically emerge quickly.

WebRTC payment skimming circumventing CSP

Attackers deployed payment skimmers using WebRTC data channels to receive malicious payloads and exfiltrate stolen card data, successfully bypassing Content Security Policy controls. This demonstrates evasion of defensive mechanisms commonly deployed on e-commerce platforms.

Defender action: Review Content Security Policy implementations on e-commerce platforms. WebRTC APIs should be explicitly restricted if not required for functionality. Monitor for suspicious WebRTC connections from injected scripts.

Coruna iOS exploit kit reusing Operation Triangulation code

Coruna, a new iOS exploit kit, reuses kernel exploits originally deployed in Operation Triangulation three years ago. This indicates sophisticated threat actors are recycling proven attack code rather than developing entirely new exploits—a cost optimization strategy suggesting maturity in the threat landscape.

Google's 2029 PQC migration deadline

Google has committed to migrating its infrastructure to post-quantum cryptography by 2029, signalling that the window for defending against cryptographically-relevant quantum computers is closing faster than many organizations anticipated. This accelerates industry pressure to inventory and remediate legacy systems.

Defender action: Begin auditing cryptographic implementations in your organization. Create inventory of systems using traditional RSA, ECDSA, and symmetric encryption. Prioritize migration planning for systems handling long-lived sensitive data (secrets, private keys, medical records, financial data).

EU Commission AWS compromise

A threat actor obtained unauthorized access to the European Commission's Amazon Web Services environment. This highlights how even well-resourced government bodies remain vulnerable to cloud misconfigurations and identity compromise despite security investments.

Dutch National Police phishing breach

Dutch National Police experienced a successful phishing attack leading to limited-scope breach with no citizen data impact. This demonstrates that credential-harvesting campaigns remain effective against high-value targets despite security awareness programmes.

GitHub Discussion malware distribution

Attackers are posting fake VS Code security alerts in GitHub project Discussions to trick developers into downloading malware. This weaponizes GitHub's collaboration features and developer trust in tooling vendors.

Defender action: Educate development teams to verify security alerts through official channels. Alert fatigue remains a significant vulnerability in threat awareness.

Vulnerability landscape

This week saw 342 new CVEs tracked, with a concerning severity distribution: 19 critical, 262 high, and 61 unclassified. The critical vulnerabilities concentrated in infrastructure management, industrial control, product lifecycle management, and development tooling demonstrates that adversaries continue targeting the trust layers that support enterprise operations.

Mozilla remains the top affected vendor (18 CVEs), followed by Schneider Electric (4 CVEs—all critical or high), HCLTech (4 CVEs), and WeCodex (4 CVEs). The concentration of critical vulnerabilities in industrial control (Schneider, WAGO) and enterprise infrastructure (PTC, Quest, F5) indicates systematic targeting of organizations with high switching costs and complex deployment challenges that slow patching cycles.

Recommended actions

1. Immediate (today): Audit whether your organization runs Quest KACE SMA, Schneider Electric Brewmaxx/Foxboro, PTC Windchill, F5 BIG-IP, WAGO switches, Pharos controllers, or OpenClaw gateways. Document inventory and accessibility. Begin patch procurement and scheduling.

2. This week: Rotate all secrets and credentials from systems that may have executed compromised Trivy versions or TeamPCP malware. Audit CI/CD logs and container registries for evidence of compromise. Patch all critical vulnerabilities listed above according to your change control process.

3. This week: Update all development dependencies on Langflow, LangChain, LangGraph, node-convict, and Zebra. These libraries are widely used and compromise may not be immediately obvious in runtime behavior.

4. Next week: Begin post-quantum cryptography inventory and migration planning. Google's 2029 deadline signals industry shift—start now for systems handling long-lived sensitive data.

5. Ongoing: Implement configuration management practices that prevent secrets from environment variables. Adopt secret management tools and least-privilege access controls across infrastructure and application layers.

Looking ahead

Next week watch for:

• Patch Tuesday response patterns. Organizations patch on predictable schedules; attackers exploit the gap between disclosure and patch deployment. Expect exploitation attempts to peak Wednesday-Friday as organizations lag behind updates.
• Industrial control system patch availability. Schneider, WAGO, and Pharos updates may have supply constraints or compatibility issues. Track vendor patch channels for delays or staged rollouts.
• Blockchain network stability. Zebra DoS vulnerabilities may trigger network instability if nodes are not patched uniformly. Monitor network health metrics for distributed denial-of-service indicators.
• PTC supply chain incident scope expansion. Windchill compromises often indicate lateral movement to design data repositories. Expect incident notifications from organizations who discover unauthorized design IP access during forensic review.
• Post-quantum cryptography vendor announcements. Dell and HP's early adoption signals market momentum. Expect more infrastructure and tooling vendors to announce PQC roadmaps this quarter.