Iranian-Affiliated Cyber Actors Exploit Programmable Logic Controllers Across US Critical Infrastructure is the top review-now item: exploit status active with 1 KQL hunt(s).

Review Now

These items have confirmed active exploitation, KEV/ransomware evidence, or trusted advisory evidence. Treat as immediate triage.

• Iranian-Affiliated Cyber Actors Exploit Programmable Logic Controllers Across US Critical Infrastructure — score 47 — exploit status active — KQL: MDE edge/service exploitation telemetry triage. Evidence: Iranian-Affiliated Cyber Actors Exploit Programmable Logic Controllers Across US Critical Infrastructure.

Monitor

These are notable but currently lack active-exploitation evidence in configured sources.

• SANS Stormcast Thursday, June 11th, 2026: Framing Protections; npm improvements; Adobe Patches; New Defender 0-day — score 40 — exploit status active — flags: no_primary_source, active_claim_without_evidence. Evidence: SANS Stormcast Thursday, June 11th, 2026: Framing Protections; npm improvements; Adobe Patches; New Defender 0-day.

• Authorities dismantle ‘AudiA6’ ransomware crypto-laundering service — score 35 — exploit status none — flags: no_primary_source, no_exploitation_signal. Evidence: Authorities dismantle ‘AudiA6’ ransomware crypto-laundering service.

• Who Runs the Ransomware Group ‘The Gentlemen?’ — score 35 — exploit status none — flags: no_primary_source, no_exploitation_signal — KQL: Sentinel identity/M365 suspicious admin and consent activity. Evidence: Who Runs the Ransomware Group ‘The Gentlemen?’.

• RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-b… — score 25 — exploit status none — CVE CVE-2026-45039 — flags: no_exploitation_signal — KQL: MDE exposure: devices with CVE-2026-45039. Evidence: nvd.

• Why AI-driven threats are exposing the limits of MSP security stacks — score 25 — exploit status none — flags: no_primary_source, no_exploitation_signal. Evidence: Why AI-driven threats are exposing the limits of MSP security stacks.

Background

• DeepCode through commit c991dc2 contains a path traversal vulnerability in th… — score 30 — exploit status none — CVE CVE-2026-32847 — flags: no_exploitation_signal — KQL: MDE exposure: devices with CVE-2026-32847. Evidence: nvd.

• **vllm-project/vllm version 0.14.1 contains a vulnerability where the trust_re...** — score 30 — exploit status none— CVECVE-2026-4944— flags:no_exploitation_signal` — KQL: MDE exposure: devices with CVE-2026-4944. Evidence: nvd.

• Ubuntu Linux 6.8 contains AppArmor SAUCE patches which fail to acquire a lock… — score 30 — exploit status none — CVE CVE-2026-47331 — flags: no_exploitation_signal — KQL: MDE exposure: devices with CVE-2026-47331. Evidence: nvd.

• Automad is a flat-file content management system and template engine. From 2…. — score 25 — exploit status none — CVE CVE-2026-45332 — flags: no_exploitation_signal — KQL: MDE exposure: devices with CVE-2026-45332. Evidence: nvd.

• RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-b… — score 23 — exploit status none — CVE CVE-2026-45044 — flags: no_exploitation_signal — KQL: MDE exposure: devices with CVE-2026-45044; MDE edge/service exploitation telemetry triage. Evidence: nvd.