Cyber Threat Intel - Monday | February 23, 2026
Critical CVEs Threatening Client Environments & An Evolving RAT Campaign
A critical OS command injection flaw in Fortinet FortiSIEM, a heap-overflow in VMware vCenter, a Microsoft Office security bypass with publicly available exploit code, and a sophisticated new Python RAT campaign leveraging browser hijacking. Here's what your security team needs to know this week.
This week's briefing covers three critical CVEs directly relevant to technologies many of our clients run in production - Fortinet FortiSIEM, VMware vCenter Server, and Microsoft Office - alongside an active malware campaign deploying a Python-based remote access trojan through poisoned browser extension listings.
The common thread: attackers are targeting the tools organizations rely on to manage security and infrastructure. Whether it's a SIEM platform being weaponized against the SOC itself, virtualization infrastructure being taken over, or productivity software turned into an attack vector, defenders need to prioritize rapid patching and behavioral monitoring this week.
CVEs Affecting Client Assets
The following vulnerabilities directly affect technologies deployed across our client base. Immediate review and patching is recommended.
CVE-2025-64155 - Fortinet FortiSIEM Remote Code Execution
What It Is
Security researchers disclosed CVE-2025-64155, a critical OS Command Injection vulnerability in Fortinet FortiSIEM with a CVSS score of 9.8. The flaw exists because FortiSIEM fails to properly sanitize user-controlled input before passing it to the underlying operating system - allowing an unauthenticated remote attacker to inject and execute arbitrary OS commands without any authentication required.
Why It's Especially Dangerous
FortiSIEM sits at the heart of most organizations' security monitoring stack. A successful exploit doesn't just compromise a server - it hands an attacker control of the system responsible for detecting other attacks. With access to the SIEM, a threat actor could suppress alerts, delete logs, pivot laterally, and move through the network completely undetected. This is an attacker's ideal beachhead: compromise the watchtower first, then operate freely inside the walls.
Affected Versions
Required Actions
- Apply the Fortinet security patch immediately - check FortiGuard PSIRT for the latest advisory
- If patching is not immediately possible, restrict network access to the FortiSIEM management interface
- Review FortiSIEM logs for anomalous command execution or unexpected outbound connections
- Verify SIEM alert integrity - confirm no suppression rules or log purges were made by unauthorized accounts
CVE-2024-37079 - VMware vCenter Server Heap Overflow
What It Is
CVE-2024-37079 is a critical heap-overflow vulnerability in VMware vCenter Server, found in how vCenter processes network communication over the DCERPC protocol. An attacker who sends a specially crafted network packet can cause the server to write data beyond the boundaries of allocated memory - a classic out-of-bounds write condition that can be leveraged to take full control of the system.
Why It Matters
vCenter Server is the management plane for VMware virtualized environments. Compromise here means an attacker can gain administrative control over every virtual machine in the environment - including the ability to spin up machines, capture snapshots, alter network configurations, and pivot to any guest VM on the host. An attacker who owns vCenter effectively owns the entire virtualized infrastructure without ever touching individual endpoints.
Still a Live Threat in 2026
Although this CVE was originally disclosed in 2024, a significant number of organizations are still running unpatched vCenter instances. Threat intelligence feeds continue to show active scanning and exploitation attempts targeting this vulnerability. If your environment includes VMware vSphere or vCenter and you have not confirmed patching, treat this as an emergency requiring immediate action.
Required Actions
- Patch vCenter Server to the latest available release - consult the VMware Security Advisory
- Restrict DCERPC and management plane access to trusted internal IP ranges via firewall rules
- Audit vCenter access logs for unexpected authentication attempts or unusual API calls
- Prioritize any internet-exposed vCenter instances - these must be patched or taken offline immediately
CVE-2026-21509 - Microsoft Office Security Feature Bypass
What It Is
CVE-2026-21509 is a critical security feature bypass in Microsoft Office. By manipulating data passed into Office applications, an attacker can trick the software into making flawed trust decisions - granting unauthorized access or code execution without triggering standard security warnings, Protected View restrictions, or Mark-of-the-Web (MOTW) controls that users depend on to block malicious files.
Elevated Risk - Public Exploit Code & Active Exploitation
Proof-of-concept exploit code for CVE-2026-21509 is publicly available on GitHub, significantly lowering the technical barrier for exploitation. This vulnerability is also listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, confirming it is actively being exploited in the wild - not just theoretically possible. Social media activity has surpassed 200 mentions, indicating heightened threat actor interest and the potential for widespread campaigns in the near term.
Public
PoC on GitHub
CISA KEV
Active exploitation confirmed
200+
Social media mentions
Required Actions
- Apply the latest Microsoft Office security updates immediately - do not wait for the next patch cycle
- Enable Attack Surface Reduction (ASR) rules to block Office from creating child processes
- Ensure all endpoints running Office are covered by EDR with behavioral detection enabled
- Monitor SIEM for unusual process chains spawned from Office applications (winword.exe, excel.exe, etc.)
- No known IOCs have been identified yet - prioritize behavioral detection over signature-based controls
Active Threats & Campaigns
Campaigns currently in-flight that can be detected using existing detection rule sets.
CrashFix - Python RAT Delivered via Fake Browser Extension
What Happened
Microsoft Defender Experts uncovered CrashFix, a new and more sophisticated evolution of the ClickFix social engineering framework. Where classic ClickFix tricks users into copying and pasting malicious commands, CrashFix deliberately crashes the victim's browser to manufacture urgency - then exploits that disruption to convince users to execute attacker-controlled code under the guise of a browser "fix." The campaign ultimately deploys ModeloRAT, a Python-based remote access trojan, representing a significant escalation in attack sophistication.
Attack Chain
Victim searches for ad-blocking software and encounters malicious paid advertisements in search results
Ad redirects to a convincing Chrome Web Store listing impersonating the legitimate uBlock Origin Lite extension
The installed extension deliberately crashes or disrupts the browser, creating a sense of urgency and legitimacy
User is shown a fake recovery page instructing them to run a command in order to "fix" their browser
The command downloads and executes ModeloRAT - a Python-based remote access trojan
Attacker establishes persistent remote access, using living-off-the-land binaries (LOLBins) to evade detection
ModeloRAT - What It Does
ModeloRAT is a Python-based remote access trojan that establishes a persistent command-and-control channel from the victim's machine back to the attacker. It integrates three techniques that make detection particularly challenging:
- Browser-based manipulation to establish initial access through trusted extension infrastructure
- Living-off-the-land binary (LOLBin) abuse - uses legitimate Windows tools like mshta.exe and wscript.exe to avoid triggering EDR signatures
- Python payload delivery - Python is commonly whitelisted in enterprise environments, making it a reliable vehicle for malicious execution
Detection & Mitigation
- Block Python script execution from user-writable directories (AppData, Temp) via application control policies
- Alert on mshta.exe, wscript.exe, or cscript.exe spawning Python processes - a reliable LOLBin abuse indicator
- Restrict browser extension installation to an approved organizational allow-list - deny unsigned or side-loaded extensions
- Configure web filtering to block advertisement-served redirects to browser extension stores
- Review SOCRadar for detailed IOCs and YARA rules associated with ModeloRAT - full mitigation guidance is available in their portal
Additional Intelligence
2025 CWE Top 25 Most Dangerous Software Weaknesses
Updated List AvailableMITRE has released the updated 2025 CWE Top 25 Most Dangerous Software Weaknesses - a data-driven ranking of the most critical software vulnerability classes based on real-world CVE data. This list represents the root causes behind a significant percentage of all known vulnerabilities, and it provides a roadmap for where defenders should focus detection engineering and patching efforts.
Notable entries from the top of the 2025 list include:
It's worth noting that OS Command Injection (CWE-78) - the exact weakness class behind CVE-2025-64155 - and Out-of-Bounds Write (CWE-787) - the class behind CVE-2024-37079 - both appear prominently in this list. This isn't coincidence; these weakness classes have been persistently exploitable across the industry for years, and this week's CVEs are a direct example of why they remain at the top.
SOClogix's detection engineering team will be building LimaCharlie detection rules mapped to the updated CWE Top 25 over the coming weeks. Organizations enrolled in our managed SOC will receive these detections automatically as they are deployed.
View the Full 2025 CWE Top 25 ListFrom Intelligence to Action
Three critical CVEs targeting the security and infrastructure tools your organization depends on, an active Python RAT campaign spreading through poisoned browser extensions, and a refreshed vulnerability weakness framework to guide detection priorities. This week demands proactive patching, behavioral detection tuning, and browser control enforcement.
Your Week-Ahead Checklist
- Patch Fortinet FortiSIEM immediately if running any affected version (6.7.x through 7.4.0) - check FortiGuard PSIRT for the advisory
- Patch VMware vCenter Server if not already done - audit for any unauthorized API calls or authentication anomalies since disclosure
- Apply the latest Microsoft Office security updates - enable ASR rules blocking Office from spawning child processes
- Audit browser extension allow-lists across all managed endpoints - block unsigned or user-installed extensions not on the approved list
- Review Python execution policies - alert on Python launching from user-writable paths or being spawned by browser processes
- Confirm EDR behavioral detection is active on all endpoints - signature-only controls will miss both CVE-2026-21509 and ModeloRAT
- Review the 2025 CWE Top 25 list and assess your environment for exposure to the top-ranked weakness classes
Related from SOClogix
About SOClogix
SOClogix specializes in providing cyber threat intelligence, 24/7 monitoring, and managed detection and response (MDR) tailored for SMBs and mid-market organizations. Our mission is to help businesses stay ahead of evolving threats with actionable intel, proactive defense, and rapid incident response.
If your organization needs help assessing cyber risks, responding to threats, or enhancing your security posture, the experts at SOClogix are here to help. Contact us today for tailored threat intelligence, managed security services, and proactive protection that keeps your business secure.
