CISO Daily Brief: Critical Vulnerabilities, Nation-State Threats, and Identity-Based Attacks – April 22, 2026

Today’s security landscape continues to evolve rapidly, with several high-impact vulnerabilities and targeted attacks surfacing across enterprise environments. CISOs must remain vigilant, prioritizing critical patches, monitoring for identity-based threats, and preparing for sophisticated nation-state campaigns. This brief distills the most urgent developments and provides actionable steps for executive and board-level engagement.

Top Items CISOs Should Care About (Priority)

No Exploit Needed: How Attackers Walk Through the Front Door via Identity-Based Attacks

What happened: Attackers are increasingly bypassing traditional exploit-based approaches and leveraging identity-based attacks to gain unauthorized access to enterprise systems. These attacks exploit weak authentication, credential reuse, and misconfigured identity providers. Recent campaigns have demonstrated the ability to move laterally and escalate privileges without triggering conventional security controls. The trend highlights a shift toward social engineering, phishing, and abuse of legitimate access mechanisms. As organizations expand their use of cloud and SaaS platforms, the attack surface for identity-based threats grows. Security teams are reporting a rise in successful account takeovers and business email compromise incidents. The sophistication of these attacks is increasing, with adversaries often blending in with normal user activity.

Why it matters: Identity-based attacks can bypass many traditional security controls, making detection and response more challenging. They represent a critical risk to enterprise data, intellectual property, and business operations. The growing reliance on cloud and remote work amplifies the potential impact. Proactive identity security is now essential for organizational resilience.

What to verify internally:
• Effectiveness of multi-factor authentication (MFA) across all critical systems
• Monitoring and alerting for suspicious authentication and access patterns
• Review of privileged account usage and access rights
• Employee training on phishing and social engineering

Exec questions to prepare for:
• How are we protecting against credential-based attacks?
• What is our coverage for MFA and identity monitoring?
• How quickly can we detect and respond to account compromise?
• What recent incidents have we observed?

Board level questions to prepare for:
• Are our identity controls keeping pace with evolving threats?
• What is our exposure to identity-based attacks?
• How do we benchmark against peers in identity security?

Sample CISO response: "We are prioritizing identity security by expanding MFA coverage, enhancing monitoring for suspicious access, and conducting regular reviews of privileged accounts. Our incident response processes are being updated to address identity-based threats, and we are increasing employee awareness through targeted training."

Microsoft Patches Critical ASP.NET Core CVE-2026-40372 Privilege Escalation Bug & Emergency Patch Release

What happened: Microsoft has released emergency patches for a critical privilege escalation vulnerability (CVE-2026-40372) in ASP.NET Core. This flaw allows attackers to gain elevated privileges on affected systems, potentially leading to full compromise of enterprise applications and data. The vulnerability is present in widely deployed versions of ASP.NET Core, making it a significant risk for organizations running Microsoft web applications. Security researchers have warned of the ease of exploitation and the potential for automated attacks. Microsoft’s rapid response underscores the severity of the issue. Enterprises are urged to apply the patches immediately to prevent exploitation.

Why it matters: Privilege escalation vulnerabilities in core application frameworks can lead to widespread compromise if left unpatched. The ubiquity of ASP.NET Core in enterprise environments amplifies the risk. Attackers may exploit this flaw to move laterally, access sensitive data, or disrupt business operations. Timely patching is critical to maintaining security posture.

What to verify internally:
• Inventory of all systems running ASP.NET Core
• Status of patch deployment across environments
• Monitoring for signs of exploitation attempts
• Review of application logs for unusual activity

Exec questions to prepare for:
• Have we applied the latest Microsoft patches?
• What is our exposure to this vulnerability?
• How are we monitoring for exploitation attempts?

Board level questions to prepare for:
• What is our patch management process for critical vulnerabilities?
• How do we ensure timely remediation of high-risk flaws?
• Are we at risk of business disruption from this issue?

Sample CISO response: "We have identified all affected systems and prioritized patch deployment for the ASP.NET Core vulnerability. Our teams are monitoring for exploitation attempts and reviewing application logs for any signs of compromise. We are confident in our ability to respond rapidly to critical vulnerabilities."

CISA Flags New SD-WAN Flaw as Actively Exploited in Attacks

What happened: The Cybersecurity and Infrastructure Security Agency (CISA) has issued an alert regarding a newly discovered SD-WAN vulnerability that is being actively exploited in the wild. Attackers are leveraging this flaw to gain unauthorized access to network infrastructure, potentially allowing lateral movement and data exfiltration. SD-WAN solutions are widely used to manage and secure enterprise networks, making this vulnerability particularly concerning. Reports indicate that exploitation attempts are increasing, with some organizations already experiencing network disruptions. The flaw affects multiple SD-WAN vendors and configurations, requiring urgent review and remediation. CISA’s involvement highlights the national security implications of the issue.

Why it matters: Active exploitation of SD-WAN vulnerabilities can undermine the integrity of enterprise networks and expose sensitive data. The widespread use of SD-WAN amplifies the potential impact. Prompt action is required to prevent unauthorized access and maintain business continuity. Regulatory scrutiny may increase for organizations affected by this flaw.

What to verify internally:
• Inventory of all SD-WAN deployments and versions
• Status of vendor patches and updates
• Network monitoring for suspicious activity
• Review of remote access configurations

Exec questions to prepare for:
• Are our SD-WAN systems patched and up to date?
• What is our exposure to this vulnerability?
• How are we monitoring for exploitation attempts?

Board level questions to prepare for:
• How do we manage security for critical network infrastructure?
• What is our incident response plan for network breaches?
• Are we aligned with regulatory expectations for network security?

Sample CISO response: "We have conducted a comprehensive review of our SD-WAN deployments and are applying vendor patches as a priority. Enhanced monitoring is in place to detect any exploitation attempts, and we are reviewing remote access configurations to minimize risk. Our incident response team is prepared to act if needed."

Cohere AI Terrarium Sandbox Flaw Enables Root Code Execution, Container Escape

What happened: A critical vulnerability has been identified in the Cohere AI Terrarium sandbox environment, allowing attackers to achieve root code execution and escape containerized workloads. This flaw exposes underlying cloud infrastructure to compromise, with potential impact on data confidentiality and service availability. Security researchers demonstrated proof-of-concept exploits, raising concerns about the security of AI and ML workloads in production. The vulnerability affects organizations leveraging Cohere AI’s sandbox for development and deployment. Immediate patching and configuration reviews are recommended to mitigate risk. The incident underscores the importance of securing AI infrastructure as adoption accelerates.

Why it matters: Container escape and root code execution in AI environments can lead to full cloud infrastructure compromise. As AI workloads become more integral to business operations, their security is paramount. This flaw highlights the need for robust isolation and monitoring in AI deployments. Regulatory and reputational risks may arise if sensitive data is exposed.

What to verify internally:
• Deployment of latest patches for Cohere AI Terrarium
• Review of container security configurations
• Monitoring for unusual activity in AI workloads
• Assessment of data exposure risk

Exec questions to prepare for:
• Are our AI environments patched and secure?
• What controls are in place to prevent container escape?
• How do we monitor for compromise in AI workloads?

Board level questions to prepare for:
• What is our strategy for securing AI and ML infrastructure?
• How do we assess and mitigate risks in emerging technologies?
• Are we exposed to regulatory scrutiny due to AI vulnerabilities?

Sample CISO response: "We are working closely with our AI engineering teams to ensure all sandbox environments are patched and securely configured. Enhanced monitoring has been implemented for AI workloads, and we are reviewing our container security posture to prevent future risks."

Mustang Panda’s New LOTUSLITE Variant Targets India Banks, South Korea Policy Circles

What happened: The Mustang Panda APT group has deployed a new variant of its LOTUSLITE malware, targeting financial institutions in India and policy organizations in South Korea. The campaign leverages spear-phishing and custom malware to infiltrate high-value targets, with the goal of intelligence gathering and potential disruption. Security researchers have observed advanced evasion techniques and persistent access methods. The targeting of both financial and policy sectors suggests a coordinated, geopolitically motivated operation. The campaign is ongoing, with new indicators of compromise emerging. Organizations in the targeted regions are advised to increase vigilance and update threat intelligence feeds.

Why it matters: Nation-state APT activity targeting critical sectors poses significant operational, reputational, and regulatory risks. The sophistication of the campaign increases the likelihood of successful compromise. Financial and policy organizations are attractive targets for espionage and disruption. Proactive threat intelligence and response are essential.

What to verify internally:
• Review of email security and spear-phishing defenses
• Monitoring for indicators of compromise related to LOTUSLITE
• Assessment of exposure in financial and policy-related business units
• Update of threat intelligence sources

Exec questions to prepare for:
• Are we a potential target of this campaign?
• How are we defending against spear-phishing and APT threats?
• What is our incident response capability for nation-state attacks?

Board level questions to prepare for:
• How do we assess our risk from nation-state actors?
• What partnerships do we have for threat intelligence sharing?
• Are we prepared for regulatory scrutiny following a targeted attack?

Sample CISO response: "We are closely monitoring for indicators of compromise associated with Mustang Panda and have strengthened our spear-phishing defenses. Our incident response team is prepared to act on any suspicious activity, and we are collaborating with external partners for timely threat intelligence."

Notable Items

• Ransomware Negotiator Pleads Guilty to Aiding BlackCat Attacks in 2023: Law enforcement action disrupts ransomware negotiation ecosystem.
• NGate Campaign Targets Brazil, Trojanizes HandyPay to Steal NFC Data and PINs: Financial fraud risk from targeted mobile malware.
• Ransomware Negotiator Pleads Guilty to BlackCat Scheme: Legal developments highlight ongoing disruption of threat actor networks.
• Former DigitalMint ransomware negotiator pleads guilty to extortion scheme: Progress in law enforcement efforts against ransomware facilitators.

CISO Action Checklist Today

• Ensure immediate patching of ASP.NET Core and SD-WAN vulnerabilities across all environments.
• Review and enhance identity security controls, including MFA and privileged access management.
• Monitor for indicators of compromise related to Mustang Panda and LOTUSLITE campaigns.
• Apply latest updates to Cohere AI Terrarium and review container security configurations.
• Audit cloud and AI workloads for signs of compromise or misconfiguration.
• Update threat intelligence feeds and share relevant indicators with key stakeholders.
• Review incident response plans for ransomware, nation-state, and identity-based attacks.
• Communicate current risk posture and remediation actions to executive leadership and the board.
• Reinforce employee training on phishing, social engineering, and credential security.
• Engage with vendors and partners to validate supply chain security measures.