Cyber Threat Intel - February 23, 2026

Critical CVEs Threatening Client Environments & An Evolving RAT Campaign

This week's briefing covers three critical CVEs directly relevant to technologies many of our clients run in production - Fortinet FortiSIEM, VMware vCenter Server, and Microsoft Office - alongside an active malware campaign deploying a Python-based remote access trojan through poisoned browser extension listings.

CVEs Affecting Client Assets

Immediate review and patching is recommended.

  1. CVE-2025-64155 - Fortinet FortiSIEM Remote Code Execution
    What It Is
    Security researchers disclosed CVE-2025-64155, a critical OS Command Injection vulnerability in Fortinet FortiSIEM with a CVSS score of 9.8. The flaw exists because FortiSIEM fails to properly sanitize user-controlled input before passing it to the underlying operating system - allowing an unauthenticated remote attacker to inject and execute arbitrary OS commands.

    Why It's Especially Dangerous
    A successful exploit compromises the server, allowing control of the system responsible for detecting other attacks, enabling attackers to suppress alerts, delete logs, and move through the network undetected.

    Affected Versions

    • FortiSIEM 7.4.0
    • FortiSIEM 7.3.0 – 7.3.4
    • FortiSIEM 7.1.0 – 7.1.8
    • FortiSIEM 7.0.0 – 7.0.4
    • FortiSIEM 6.7.0 – 6.7.10

    Required Actions

    • Apply the Fortinet security patch immediately.
    • If patching is not immediately possible, restrict network access to the FortiSIEM management interface.
    • Review FortiSIEM logs for anomalous command execution.

  2. CVE-2024-37079 - VMware vCenter Server Heap Overflow
    What It Is
    CVE-2024-37079 is a critical heap-overflow vulnerability in VMware vCenter Server that can be leveraged to take full control of the system.

    Why It Matters
    Compromise here means an attacker can gain administrative control over every virtual machine, including the ability to spin up machines and alter network configurations.

    Still a Live Threat in 2026
    Many organizations are still running unpatched vCenter instances.

    Required Actions

    • Patch vCenter Server to the latest available release.
    • Restrict DCERPC and management plane access to trusted internal IP ranges.

  3. CVE-2026-21509 - Microsoft Office Security Feature Bypass
    What It Is
    CVE-2026-21509 is a critical security feature bypass that can trick the software into making flawed trust decisions.

    Elevated Risk - Public Exploit Code & Active Exploitation
    Proof-of-concept exploit code is publicly available, and this vulnerability is active and being exploited in the wild.

    Required Actions

    • Apply the latest Microsoft Office security updates immediately.
    • Ensure all endpoints running Office are covered by EDR with behavioral detection enabled.

Active Threats & Campaigns

CrashFix - Python RAT Delivered via Fake Browser Extension

What Happened
Microsoft Defender Experts uncovered CrashFix, an evolution of the ClickFix framework that exploits browser crashes to convince users to execute attacker-controlled code.

Attack Chain

  1. Victim searches for ad-blocking software and encounters malicious ads.
  2. Ad redirects to a convincing Chrome Web Store listing.
  3. The installed extension disrupts the browser.
  4. User is shown a fake recovery page to run a command.
  5. The command downloads and executes ModeloRAT.

ModeloRAT - What It Does
ModeloRAT is a Python-based remote access trojan that establishes a persistent command-and-control channel.

Detection & Mitigation

  • Block Python script execution from user-writable directories.
  • Alert on processes like mshta.exe pertaining to Python execution.

Additional Intelligence

2025 CWE Top 25 Most Dangerous Software Weaknesses

MITRE has released the updated 2025 CWE Top 25 Most Dangerous Software Weaknesses, which provides a roadmap for where defenders should focus detection engineering and patching efforts.

From Intelligence to Action

  1. Patch Fortinet FortiSIEM immediately.
  2. Patch VMware vCenter Server if not already done.
  3. Apply the latest Microsoft Office security updates.
  4. Audit browser extension allow-lists across all managed endpoints.
  5. Review Python execution policies.

About SOClogix

SOClogix specializes in providing cyber threat intelligence. If your organization needs help assessing cyber risks, the experts at SOClogix are here to help.