# Threat Intel Brief — June 5, 2026

TL;DR

  • Cisco SD-WAN zero-day (CVE-2026-20245) under active exploitation for root privilege escalation; no patch available.
  • Everest Forms Pro WordPress plugin (CVE-2026-3300) actively exploited for remote code execution; approximately 4,000 sites at risk.
  • FIFA World Cup 2026 fraud campaign leveraging thousands of lookalike domains, banking malware, and credential phishing ahead of June 11 kickoff.
  • PCPJack threat actor hijacked 230+ cloud servers across AWS, Google Cloud, and Azure to establish covert SMTP relay network.
  • Critical vulnerabilities in Gladinet Triofox and Cisco Unified Communications Manager require immediate patching per CERT.BE advisories.

Critical Threats

Cisco SD-WAN Manager Zero-Day Under Active Exploit

What happened: Cisco disclosed CVE-2026-20245, a high-severity zero-day vulnerability in Cisco Catalyst SD-WAN Manager that is being actively exploited to achieve root privilege escalation. No patch is currently available, and specific vulnerable versions have not been disclosed.

Impact: Root access on SD-WAN Manager enables attackers to manipulate routing policies, intercept network traffic, pivot to connected branch sites, and compromise entire SD-WAN fabrics. Organizations relying on Cisco SD-WAN for wide-area network connectivity face potential network-wide compromise. The absence of a patch significantly extends the exposure window.

Recommendations:

  • Review Cisco's security advisory for CVE-2026-20245 and implement any interim mitigations or workarounds immediately.
  • Restrict network access to SD-WAN Manager to trusted management networks only; disable internet-facing access where possible.
  • Enable enhanced logging and monitor for unusual administrative activity, privilege escalation attempts, and unauthorized configuration changes.
  • Review access logs for indicators of compromise, focusing on unexpected root-level commands or sessions.
  • Prepare emergency patch deployment procedures and test in lab environments once Cisco releases a fix.

Everest Forms Pro WordPress Plugin RCE

What happened: Threat actors are actively exploiting CVE-2026-3300, a critical remote code execution vulnerability (CVSS 9.8) in the Everest Forms Pro WordPress plugin affecting versions up to 1.9.12. Approximately 4,000 active installations are at risk.

Impact: The vulnerability enables unauthenticated remote code execution, allowing attackers to achieve complete site compromise. Potential consequences include data theft, malware deployment, site defacement, and use of compromised infrastructure for further attacks. The low attack complexity and lack of required privileges make this an attractive target for mass exploitation.

Recommendations:

  • Update Everest Forms Pro to version 1.9.13 or later immediately if available.
  • If no patch is available, disable or uninstall the plugin until a security update is released.
  • Audit WordPress sites for indicators of compromise: unexpected admin accounts, modified core files, suspicious scheduled tasks, and webshells.
  • Review web server access logs for unusual POST requests to wp-admin/admin-ajax.php or plugin endpoints.
  • Implement web application firewall (WAF) rules to block exploitation attempts targeting Everest Forms Pro endpoints.

Gladinet Triofox Critical Vulnerabilities

What happened: CERT.BE issued a critical warning regarding vulnerabilities in Gladinet Triofox file sharing and collaboration platform, urging immediate patching. Specific CVE identifiers and affected versions have not been publicly disclosed.

Impact: Triofox provides cloud file server and secure remote access capabilities, often exposing corporate file shares to external users. Critical vulnerabilities in this platform could enable unauthorized access to corporate file systems, data exfiltration, or lateral movement within enterprise networks.

Recommendations:

  • Identify all Gladinet Triofox instances in your environment, including production and test systems.
  • Contact Gladinet support or check the vendor portal for latest security patches and affected version information.
  • Apply vendor-provided patches immediately to all Triofox installations per CERT.BE guidance.
  • Review Triofox access logs for suspicious authentication attempts or unusual file access patterns.
  • Consider temporarily restricting external access to Triofox systems until patching is complete if immediate remediation is not feasible.

Threat Actor Activity

PCPJack Cloud Infrastructure Hijacking

PCPJack has compromised approximately 230 servers across AWS, Google Cloud, and Microsoft Azure to establish a covert SMTP email relay network. Compromised business servers in the United States, Europe, and Asia were converted into SMTP proxies that synchronize with downstream consumers every five minutes. The operation demonstrates sophisticated command-and-control infrastructure designed for resilience and obfuscation of malicious email traffic, likely supporting spam distribution, phishing campaigns, or business email compromise operations.

Defensive measures:

  • Implement strict egress filtering to monitor and restrict outbound SMTP traffic from cloud instances.
  • Deploy cloud workload protection platforms to detect unauthorized service installations and configuration changes.
  • Enable comprehensive logging for cloud infrastructure and monitor for suspicious authentication patterns and resource modifications.
  • Conduct regular vulnerability assessments and patch management for cloud-hosted servers.

FIFA World Cup 2026 Fraud Campaign

Security researchers and the FBI are warning of an active fraud campaign exploiting the FIFA World Cup 2026 tournament. The campaign involves thousands of lookalike domains, banking malware distributed through pirate streaming applications, and phishing attacks targeting FIFA login credentials ahead of the June 11 kickoff. The multi-vector approach targets sports and entertainment consumers, financial services customers, and streaming service users through credential theft and direct malware infection.

Defensive measures:

  • Implement domain monitoring to identify and block FIFA-themed lookalike domains and typosquatting variants.
  • Deploy email security controls to detect and quarantine phishing messages containing FIFA, World Cup, or ticketing keywords.
  • Educate users to download streaming applications only from official app stores and verify publisher authenticity.
  • Monitor for banking malware indicators including keylogging behavior and web session cookie theft.
  • Enforce multi-factor authentication on FIFA accounts, ticketing platforms, and financial services.

Geopolitical Context

CERT.BE's advisories on Gladinet Triofox and Cisco Unified Communications Manager reflect Belgium's strategic position as host to EU and NATO headquarters, where telecommunications and collaboration infrastructure resilience is critical to both economic continuity and alliance coordination. The Cisco Unified Communications Manager vulnerability, with publicly available proof-of-concept exploit code, represents significant risk to enterprise and telecommunications infrastructure across NATO member states and EU institutions.

The PCPJack campaign's targeting of cloud infrastructure across the United States, Europe, and Asia underscores persistent vulnerabilities in cloud security postures and the ongoing challenge of securing multi-tenant environments against resource hijacking. The global distribution complicates jurisdictional response and takedown efforts, requiring coordinated action across multiple legal frameworks.

Recommended Actions

Immediate (0-24 hours)

  • Apply interim mitigations for Cisco SD-WAN Manager CVE-2026-20245; restrict management access to trusted networks.
  • Update or disable Everest Forms Pro WordPress plugin to address CVE-2026-3300.
  • Identify and patch all Gladinet Triofox instances per CERT.BE advisory.
  • Review cloud infrastructure for unauthorized SMTP proxy configurations related to PCPJack activity.

Short-term (24-72 hours)

  • Audit WordPress sites for indicators of compromise related to Everest Forms Pro exploitation.
  • Implement enhanced logging and monitoring for Cisco SD-WAN Manager and Unified Communications Manager.
  • Deploy email security controls and user awareness training for FIFA World Cup 2026 fraud campaign.
  • Review cloud egress filtering rules and implement SMTP traffic restrictions.

This week

  • Conduct vulnerability assessments of cloud-hosted servers and internet-facing services.
  • Review and update incident response procedures for zero-day vulnerabilities and cloud infrastructure compromise.
  • Implement web application firewall rules for WordPress sites and other web-facing applications.
  • Coordinate with cloud service providers on anomaly detection for resource abuse.

Watch List

  • Cisco SD-WAN Manager patch release: Monitor Cisco security advisories for CVE-2026-20245 patch availability and deploy within 24 hours of release.
  • Cisco Unified Communications Manager: CVE identifier and patch details expected; public PoC increases exploitation risk.
  • Gladinet Triofox: Monitor vendor communications for CVE assignments and technical details of critical vulnerabilities.
  • PCPJack infrastructure expansion: Monitor for additional compromised cloud instances and SMTP relay activity.
  • FIFA World Cup fraud campaign evolution: Track new lookalike domains and malware variants as tournament approaches.

Sources

  • BleepingComputer: [Cisco warns of unpatched SD-WAN zero-day exploited in attacks](https://www.bleepingcomputer.com/news/security/new-cisco-sd-wan-flaw-exploited-in-zero-day-attacks-to-gain-root/)
  • The Hacker News: [Hackers Exploit Critical Everest Forms Pro WordPress Plugin Flaw to Take Over Sites](https://thehackernews.com/2026/06/hackers-exploit-critical-everest-forms.html)
  • The Hacker News: [FIFA World Cup 2026 Scams Are Already Live: Fake Sites, Banking Malware, and Stolen Logins](https://thehackernews.com/2026/06/fifa-world-cup-2026-scams-are-already.html)
  • The Hacker News: [PCPJack Hijacks 230 AWS, Google Cloud, and Azure Servers for Covert SMTP Relay Network](https://thehackernews.com/2026/06/pcpjack-hijacks-230-aws-google-cloud.html)
  • CERT.BE: [Warning: Critical vulnerabilities in Gladinet Triofox, patch immediately!](https://ccb.belgium.be/advisories/warning-critical-vulnerabilities-gladinet-triofox-patch-immediately)
  • CERT.BE: [Warning: High severity vulnerability in Cisco Unified Communications Manager with exploit PoC available, patch immediately!](https://ccb.belgium.be/advisories/warning-high-severity-vulnerability-cisco-unified-communications-manager-exploit-poc)