🔴 Actively Exploited

• Google Chrome (Skia & V8) — CVE-2026-3909, CVE-2026-3910
  Out-of-bounds write in Skia graphics library and unspecified flaw in Chromium V8 engine. Added to CISA KEV March 13; exploits confirmed in the wild. High-severity browser risks enabling arbitrary code execution. Federal remediation deadline: March 27. Patch via Chrome Stable channel (146.0.7680.75+).
• n8n Workflow Automation — CVE-2025-68613
  A critical improper control of dynamically managed code resources vulnerability with a CVSS score of 10.0. Added to CISA KEV on March 11 and confirmed exploited in the wild. The issue poses significant risk to organizations operating self-hosted n8n instances. Federal remediation deadline: March 25.
• Broadcom VMware Aria Operations — CVE-2026-22719
  A command injection vulnerability in support-assisted migration workflows. Added to KEV on March 3 and actively exploited. Patch or mitigation action is required before the federal deadline of March 24.
• Qualcomm Multiple Chipsets — CVE-2026-21385
  A graphics component memory corruption flaw affecting 234 chipsets. Added to KEV on March 3 and confirmed in targeted attacks involving mobile and embedded devices. Also reflected in the Android Security Bulletin.
• Apple Ecosystem — CVE-2023-41974, CVE-2021-30952, CVE-2023-43000
  These vulnerabilities include use-after-free and integer overflow issues impacting iOS, iPadOS, macOS, Safari, tvOS, and watchOS. Added to KEV on March 5. Successful exploitation could enable kernel-level arbitrary code execution. Federal remediation deadline: March 26.
• Rockwell Automation Multiple Products — CVE-2021-22681
  An insufficiently protected credentials issue in Studio 5000 Logix Designer. Added to KEV on March 5. The flaw creates industrial control system risk and may allow unauthorized controller access.
• Hikvision Multiple Products — CVE-2017-7921
  An improper authentication vulnerability that can lead to privilege escalation. Added to KEV on March 5. Exposure remains significant where internet-facing surveillance infrastructure is still in use.

Trend: Edge appliances, ICS/OT environments, automation platforms, legacy embedded systems, and now browser engines (Chrome/Skia/V8) remain high-value initial access targets, especially for ransomware crews and fast lateral movement.

🟠 Emerging Threats to Watch

• Geopolitical Cyber Activity
  Iran-linked tensions continue to sustain hacktivist operations involving DDoS attacks, defacements, credential leaks, and propaganda activity targeting U.S. financial services, telecom, and critical infrastructure. While degraded connectivity may limit large-scale state-directed operations, the risk of persistent low-level disruption remains.
• AI-Accelerated Attacks
  AI-enabled adversary activity continues to rise, with increased use of prompt injection, AI-assisted impersonation, and rapid exploit proof-of-concept generation. These capabilities are reducing the time between disclosure, weaponization, and operational abuse.
• Credential Abuse Remains Dominant
  Malware-free intrusions continue to rely heavily on stolen credentials, hijacked sessions, access tokens, and AiTM phishing. Identity remains the most pressured layer of the enterprise attack surface.

🟢 Patch & Mitigation Priorities

1. March CISA KEV Entries
   The highest urgency this week remains the latest KEV additions, especially n8n, Google Chrome (CVE-2026-3909/3910), VMware Aria, and Qualcomm-related exposure. Organizations should validate whether affected assets are internet-facing, externally reachable, or tied to privileged workflows. Federal deadlines: March 24–27.
2. Microsoft March 2026 Patch Tuesday
   This month’s Patch Tuesday deserves increased attention. Microsoft addressed more than 80 vulnerabilities, making it a critical parallel patching priority alongside KEV remediation. Security teams should prioritize internet-facing systems, privilege escalation paths, and widely deployed enterprise components such as SQL and .NET, especially where delayed patching could amplify existing risk.
3. Phishing-Resistant MFA
   Enforce FIDO2 or WebAuthn-based phishing-resistant MFA wherever possible. Traditional MFA remains vulnerable to AiTM interception and session theft, while stronger identity controls directly reduce exposure to replay-based compromise.
4. Identity and Perimeter Hunting
   Focus hunting and review efforts on:
   • new ASN or geolocation changes immediately after MFA
   • impossible travel or simultaneous distant logins
   • exposed automation platforms such as n8n or Ollama
   • legacy edge appliances, file transfer systems, cameras, and ICS assets
   • suspicious session behavior and token reuse patterns
   • browser telemetry for anomalous rendering/engine behavior (Chrome updates)

📡 Notable Scanning Activity

• Observed scanning and probing remain concentrated around newly highlighted attack surfaces. Defenders should expect increased reconnaissance against:
• • exposed n8n instances
• • VMware Aria environments
• • perimeter automation and edge systems
• • unmanaged AI or LLM endpoints
• • legacy file transfer and webmail appliances
• • Chrome endpoints (post-March 13 KEV addition)
• Reconnaissance pressure tied to hacktivist-aligned activity and opportunistic botnet behavior also remains elevated.

⚠️ Infrastructure Exposure Trends

• • ransomware groups are increasingly shifting toward pure data extortion models without encryption
• • unmanaged AI and automation endpoints are creating fresh exposure to prompt injection and remote code execution
• • cloud identity misconfigurations and aging internet-facing services continue to widen the attack surface
• • legacy embedded systems remain difficult to patch and attractive to attackers
• • browser-based vectors (Chrome/Skia/V8) gaining traction in targeted chains

🎯 What Teams Should Prioritize This Week

1. Patch the newest KEV entries immediately, with n8n, Google Chrome (CVE-2026-3909/3910), and VMware Aria at the top of the list.
2. Apply Microsoft March Patch Tuesday updates, especially for internet-facing and privilege-sensitive systems.
3. Enforce phishing-resistant MFA across all feasible environments.
4. Audit exposed services, including automation tools, legacy authentication systems, edge appliances, cameras.
5. Hunt for anomalous authentication patterns, browser telemetry anomalies, and prepare detections for faster AI-assisted exploitation cycles.

Weekly Pulse

Exploitation velocity remains high, and patching windows are tightening. Geopolitical hacktivism continues to add persistent disruption risk, while AI acceleration is compressing the timeline from discovery to operational abuse. Fresh browser KEV additions (Chrome) underscore the speed of exploitation in client-side vectors. There are no major structural shifts in the last 48 hours, but the combination of active exploitation, exposed automation, identity-driven intrusion patterns, and now browser risks keeps pressure on defenders.

Bottom line: Patch aggressively (including Chrome updates), harden identity, and maintain continuous visibility across internet-facing systems, authentication telemetry, and browser environments.