CRITICAL 2 min read 21 Mar 2026

Oracle Identity Manager, Trivy-Action, and APT28: Critical Threats Impacting UK/EU Security Infrastructure

Rapid exploitation of Oracle Identity Manager RCE, a high-profile supply chain hijack of Trivy-Action, and exposure of NATO military victims by APT28 highlight an urgent security crisis for UK and EU organisations. These critical threats demand immediate action to protect sensitive environments and allies' defence networks.

Key findings
01
Oracle Identity Manager RCE Demands Vigilance
HIGH
[High] On 20 March 2026, Oracle released an emergency Out-of-Band (OOB) patch addressing CVE-2026-21992, a severe unauthenticated Remote Code Execution vulnerability in Oracle Identity Manager widely deployed across UK and EU financial and government sectors.
CVE-2026-21992
02
High-Risk Supply Chain Hijack via Trivy-Action
HIGH
[High] A sophisticated supply chain attack has compromised the popular GitHub Action , affecting 75 historical tags. Attackers injected malicious code designed to exfiltrate CI/CD environment secrets, a threat especially pressing for UK/EU DevOps teams relying on Trivy for container scanning within GitHub workflows.
03
APT28 NATO Military Victim Exposure
HIGH
[High] The notorious Russian threat actor APT28 (Fancy Bear) has suffered a significant operational security failure with detailed exposure of their command-and-control infrastructure at zhblz[.]com.
APT28
04
FBI PSA on Signal and WhatsApp Targeting
HIGH
[High] A focused public service announcement by the FBI warns of successful Russian intelligence operations targeting thousands of Signal and WhatsApp accounts using highly targeted social engineering to hijack session tokens.
05
Langflow RCE Weaponised in Under 20 Hours
CRITICAL
[High] The AI-agent framework Langflow suffers from a CVSS 10.0 Remote Code Execution vulnerability (CVE-2026-33017), exploited successfully within less than 20 hours of disclosure.
CVE-2026-33017
06
Cisco FMC Patch Deadline and Interlock Ransomware Threat
HIGH
[High] CISA mandates the patching of the critical Cisco FMC vulnerability (CVE-2026-20131) by 22 March 2026. This flaw has been actively exploited by the Interlock ransomware group since January.
CVE-2026-20131

Oracle Identity Manager, Trivy-Action, and APT28: Critical Threats Impacting UK/EU Security Infrastructure

Oracle Identity Manager RCE Demands Vigilance

Confidence: High

On 20 March 2026, Oracle released an emergency Out-of-Band (OOB) patch addressing CVE-2026-21992, a severe unauthenticated Remote Code Execution vulnerability in Oracle Identity Manager widely deployed across UK and EU financial and government sectors. The vulnerability's immediacy and breadth require all operators to apply the OOB patch without delay.

High-Risk Supply Chain Hijack via Trivy-Action

Confidence: High

A sophisticated supply chain attack has compromised the popular GitHub Action , affecting 75 historical tags. Attackers injected malicious code designed to exfiltrate CI/CD environment secrets, a threat especially pressing for UK/EU DevOps teams relying on Trivy for container scanning within GitHub workflows. Immediate rotation of secrets and pinning of action references to immutable SHAs is imperative.

APT28 NATO Military Victim Exposure

Confidence: High

The notorious Russian threat actor APT28 (Fancy Bear) has suffered a significant operational security failure with detailed exposure of their command-and-control infrastructure at zhblz[.]com. Analysis reveals over 244 confirmed victims, including Romanian and Greek military departments, part of NATO's defence network. This leak includes 2,800+ exfiltrated emails and silent monitoring configurations, posing a continued espionage risk to UK/EU military allies.

FBI PSA on Signal and WhatsApp Targeting

Confidence: High

A focused public service announcement by the FBI warns of successful Russian intelligence operations targeting thousands of Signal and WhatsApp accounts using highly targeted social engineering to hijack session tokens. UK/EU government officials and sensitive communications users must reassess their encrypted messaging security, especially active session and device management.

Langflow RCE Weaponised in Under 20 Hours

Confidence: High

The AI-agent framework Langflow suffers from a CVSS 10.0 Remote Code Execution vulnerability (CVE-2026-33017), exploited successfully within less than 20 hours of disclosure. This flaw allows unauthenticated execution of arbitrary Python code and poses a direct threat to UK/EU tech firms deploying AI agents rapidly in production, necessitating urgent upgrades to version 1.0.20 or higher.

Cisco FMC Patch Deadline and Interlock Ransomware Threat

Confidence: High

CISA mandates the patching of the critical Cisco FMC vulnerability (CVE-2026-20131) by 22 March 2026. This flaw has been actively exploited by the Interlock ransomware group since January. UK/EU organisations using Cisco FMC must prioritise forensic reviews and patching ahead of the deadline to contain ongoing exploitation.

Why This Matters

These overlapping incidents expose the accelerating pace at which critical vulnerabilities are weaponised, leaving UK and EU organisations especially vulnerable due to their reliance on Oracle Identity Manager, container security tools like Trivy, and strategic NATO infrastructure. The APT28 leak compromises allied military communications, underpinning the geopolitical stakes of cyber espionage. The FBI alert on encrypted messaging highlights the enduring threat to sensitive communications. Lastly, the Langflow and Cisco vulnerabilities underscore an expanding attack surface in AI and network management tools.

  • Recommended Actions
  • Immediate deployment of Oracle Identity Manager OOB patch (CVE-2026-21992).
  • Rotate secrets in CI/CD pipelines using and pin action tags to commit SHAs.
  • Conduct thorough forensic assessment and patch Cisco FMC (CVE-2026-20131) before the 22 March CISA deadline.
  • Upgrade Langflow deployments to version 1.0.20+ to mitigate RCE risks.
  • Brief all personnel using Signal and WhatsApp on session security best practices.
  • Monitor NATO military digital environments closely in light of APT28 operational exposure.

All findings grounded in A13E intelligence sweeps through 07:00 UTC 21 March 2026.

apt28cve-2026-20131cve-2026-21992cve-2026-33017langflowsupplychainsecuritytrivyaction

Act on this brief

Map detection coverage gaps for the techniques above, or generate Sigma rules from the named CVEs.

Try DCV Try CloudSigma ← Back to feed