CISA stopped reliably sending KEV alerts.
We didn't.
CyberComply monitors the CISA Known Exploited Vulnerabilities catalog 24/7 and alerts you the moment a new KEV drops — before the deadline clock starts ticking without you knowing.
KEV Intelligence Brief: Special Edition — AA26-293A (SafePay)
Audience: Federal Contractors · DevOps & Platform Teams · Security Operations Leaders Classification: TLP:CLEAR Reporting Period: October 20, 2026
The FBI, CISA, the U.S. Secret Service, and partners in Germany and the UK released a joint #StopRansomware advisory today on SafePay, a group that has hit at least 600 victims across multiple critical infrastructure sectors since August 2024 and ranks among the most active ransomware operations of 2026. The advisory names five CVEs. CISA added none of them to KEV today, because all five were already there. The newest is from 2024. For the second time this month, a joint advisory shows the same lesson: attackers are succeeding on vulnerabilities defenders already had deadlines for.
How SafePay Gets In: Old CVEs Plus Stolen Logins
The advisory describes two access paths, and the distinction matters for how you defend.
Phished credentials against Cisco VPNs. SafePay operators connect from Mullvad VPN IP addresses and use phished account profiles to exploit two Cisco ASA and Firepower Threat Defense flaws:
- CVE-2020-3259: an information disclosure in the web services interface that can leak memory contents, including credentials and session data.
- CVE-2023-20269: an authentication bypass in the remote access VPN feature that enables brute-forcing of VPN logins.
This is not blind exploitation. The attacker arrives with a stolen username and password and uses the vulnerability to get past what should have stopped them. Patching closes the bug, but an organization with unpatched ASA appliances and no MFA on remote access is exposed on both fronts at once.
Automated scanning of internet-exposed systems. Separately, SafePay runs scripts that hit three more flaws:
- CVE-2023-27532 (Veeam Backup & Replication): missing authentication on a critical function, which lets an unauthenticated attacker pull credentials stored in the backup configuration database.
- CVE-2024-40711 (Veeam Backup & Replication): deserialization of untrusted data leading to remote code execution.
- CVE-2024-40766 (SonicWall SonicOS): improper access control in management and SSL VPN access.
Operational guidance: Inventory every Cisco ASA/FTD, SonicWall, and Veeam Backup & Replication instance, internet-facing ones first, and confirm each is on a build that fixes these CVEs. Enforce MFA on every remote access path, including legacy VPN profiles and local accounts that may bypass your identity provider. Alert on VPN authentication from Mullvad and other commercial VPN ranges, and treat a burst of failed VPN logins followed by a success as an incident, not noise. For SonicWall, also reset local SSL VPN account passwords, since credentials may have been harvested before the patch.
The Backup Problem, at Veeam Scale
Two of the five CVEs are in Veeam Backup & Replication, and that is not incidental. One exposes stored credentials; the other gives code execution. Together they give an attacker both the keys to your environment and control of the system you would use to recover from it.
The advisory confirms where this leads. Before encrypting, SafePay halts the Volume Shadow Copy Service and resets network-attached storage devices holding backup data to factory settings. The goal is not just to lock your files. It is to make sure you have nothing to restore from.
Readers of last week's briefs will recognize the pattern from the AhsayCBS chain. The difference is reach: Veeam is far more widely deployed, which makes this the bigger exposure for most organizations.
Operational guidance: Treat backup servers as tier-zero assets, on par with domain controllers. Remove Veeam management interfaces from internet exposure entirely, and segment backup infrastructure from the production domain so a domain admin compromise does not hand over the backups too. Keep at least one copy immutable or offline, where a factory reset of a NAS cannot touch it, and test restores from that copy. If a Veeam server ran a vulnerable build while reachable from untrusted networks, assume its stored credentials are exposed and rotate them.
After the Breach: What to Hunt For
SafePay leans on legitimate tools, which makes detection a matter of context rather than signatures.
- Lateral movement and execution through PsExec, WinRM, RDP, and remote monitoring and management software
- Share enumeration with
ShareFinder.ps1andSharpShares.exeto locate valuable files - New or modified admin accounts, and in some cases changed user passwords that lock legitimate users out
- UAC bypass through elevated COM objects, and token impersonation
- Security tooling disabled ahead of lateral movement
- Staging and exfiltration with 7-Zip, WinRAR, FileZilla, WinSCP, RClone, and OneDrive, with AnyDesk or TeamViewer installed to move payloads
- Recovery sabotage: Volume Shadow Copy Service stopped, NAS backup devices reset
- Encryption with a
.SafePayextension, followed in some cases by the binary deleting itself
SafePay also runs double extortion with a twist: a representative calls victims by phone to push for payment, and unpaid victims' data goes to a leak site.
Operational guidance: Restrict PsExec, WinRM, and RMM tools to named administrators and alert on use outside that group. Flag any RClone or WinSCP execution on servers, and any new AnyDesk or TeamViewer installation that did not come through IT. Load the advisory's STIX indicator files into your SIEM. Prepare staff for the phone call: anyone who might answer it should know to route it to incident response, not negotiate.
Summary Deadline Status
| CVE | Vendor / Product | Access Path | KEV Status | |---|---|---|---| | CVE-2020-3259 | Cisco ASA / FTD | Phished credentials + VPN | Overdue | | CVE-2023-20269 | Cisco ASA / FTD | Phished credentials + VPN | Overdue | | CVE-2023-27532 | Veeam Backup & Replication | Automated scanning | Overdue | | CVE-2024-40711 | Veeam Backup & Replication | Automated scanning | Overdue | | CVE-2024-40766 | SonicWall SonicOS | Automated scanning | Overdue |
All five have been in the KEV catalog since 2023 or 2024, so every BOD 26-04 deadline here passed long ago. An affected federal or contractor asset is not a late patch; it is a long-standing compliance finding that should be escalated and treated as a candidate for compromise assessment, given how many organizations SafePay has already reached through exactly these doors.
Sources: CISA Advisory AA26-293A: #StopRansomware: SafePay Ransomware · CISA KEV Catalog · StopRansomware.gov · Cisco Security Advisories · Veeam KB4424: CVE-2023-27532 · Veeam KB4649: CVE-2024-40711 · SonicWall SNWLID-2024-0015: CVE-2024-40766 · CISA Edge Device Security
Free KEV Alerts
- Real-time notification the moment a KEV drops
- Vendor and product details
- BOD 26-04 remediation deadline included
Pro Alerts Coming Soon
- Real-time notification the moment a KEV drops
- Filtered to your specific vendor watchlist
- Urgency scoring (Critical / Urgent / Standard)
- Direct patch links included
Stay ahead of CISA.
Search the KEV Catalog by Vendor or Product
Search for CVEs by vendor or product to identify known exploited vulnerabilities in your environment
Upcoming Patch Due Dates
via Binding Operational Directive 26-04
BOD 26-04 is CISA's current vulnerability remediation directive for Federal Civilian Executive Branch (FCEB) agencies, updating the KEV-driven framework introduced under BOD 22-01 with a more risk-based approach to prioritization. While binding only on FCEB agencies, its framework increasingly influences contractor expectations through procurement requirements, FedRAMP programs, and agency security clauses.
Loading...
Cyber Security News
You may have missed...
Hacking Editorial Brief — October 21, 2026
SafePay Ransomware Campaign Destroys Backup Systems Across 600+ Organizations
CISA issued a warning that SafePay ransomware actors have compromised at least 600 organizations across multiple critical infrastructure sectors since August 2024. The campaign's distinguishing characteristic is the deliberate destruction of backup systems, reducing victim recovery options and increasing pressure for ransom payment. The advisory follows established patterns of ransomware operators targeting backup infrastructure, though the scale of confirmed victims and cross-sector impact mark this as a significant active threat. CISA's public warning indicates ongoing exploitation activity against critical infrastructure targets.
Active Exploitation of Plex Media Server and SiteGuard WAF Vulnerabilities
Attackers are actively exploiting unpatched Plex Media Server installations to deploy Plex2Shell malware for cryptocurrency mining. The campaign targets devices running versions prior to the August 2024 security update. Separately, threat actors are exploiting CVE-2026-106931, an OS command injection flaw in SiteGuard Server Edition web application firewall, allowing command execution with root or SYSTEM privileges on affected servers. Both campaigns demonstrate opportunistic exploitation of known vulnerabilities in widely deployed software, with the SiteGuard vulnerability representing a particularly high-impact flaw given the privileged execution context.
Certificate Authority Compromise and State Police Agency Breach
Researchers disclosed that eMudhra Certificate Authority issued eight intermediate certificates with weak private keys that could be extracted from public certificate data, fundamentally compromising the trust chain for any certificates signed by those intermediates. The incident represents a significant cryptographic failure affecting certificate validation across potentially thousands of downstream certificates. Separately, South Korea's National Police Agency confirmed its spam-filtering server was infected with malware on May 28, 2026, part of a broader trend showing hacking attempts against police servers quadrupled year-over-year. A hacker group operating as "Siriusim" claims access to 380,000 State Bank of India customer records, though the claim remains unconfirmed.
Sources: GBHackers · Bleeping Computer · PCWorld · GBHackers · Asia E · Times of India
*
Inside a cyberattack: How hackers steal data
The truth about cybersecurity is that it's almost impossible to keep hackers outside of an organization, particularly as the cybercrime industry ...
Hackers Steal AI for Cheap Attacks - WSJ
Plus: Anthropic discloses its own cyber risks; Ahold Delhaize supermarket tech restored; billions and billions of attempted hacks.
Hackers steal children's data after company used 'Password1' to protect old account - BBC
The data watchdog reprimanded Ogi Networks Limited and Data Cymru after the 2024 ransomware attack.
Trump's Department of Homeland Security Secretly Ordered Cybersecurity Operatives to ... - Futurism
Under Donald Trump, the Cybersecurity and Infrastructure Security Agency was ordered to acquire and hack a voting machine.
Cyber Security experts say AI has made cyber threat landscape worse than it's ever been
In the 21st century, cyber security has been a constantly evolving arms race, and with the rise of artificial intelligence, the battle has reached ...
When Restrictive Cybersecurity Policies Backfire - Harvard Business Review
Restrictive cybersecurity policies can backfire by making employees less likely to believe that digital threats are serious.
Qilin and INC Ransomware Groups Exploit Palo Alto Networks Flaw to Bypass MFA
Qilin and INC ransomware actors continue exploiting a patched Palo Alto Networks flaw (CVE-2026-0257) to gain network access, bypass MFA, and establis...
Secret Broadcom Wi-Fi Chip Flaw Lets Nearby Hackers Take Over Millions of Routers
A 16-year-old Broadcom Wi-Fi chip vulnerability allows attackers in close proximity to compromise millions of routers without knowing passwords.
Critical FortiSIEM Flaw Gets Public Exploit PoC for Unauthenticated Remote Code Execution
Cybersecurity researchers have released a proof-of-concept (PoC) exploit for a recently patched critical security flaw impacting Fortinet ...
Updated daily