Three Criticals in a Week: The New Normal in Patch Velocity

THREE TRUST BOUNDARIES, THREE ACTIVE EXPLOITS

Three critical vulnerabilities hit active exploitation status this week. Each one breaks a different trust boundary. Together, they expose a pattern that should concern every security team: the attack surface is growing faster than remediation.

CVE-2026-0257 (PAN-OS GlobalProtect) - authentication bypass, actively exploited since May 17. Hits your VPN perimeter.

CVE-2026-41089 (Windows Netlogon) - RCE in domain controllers, all Windows Server versions, network-accessible. No user interaction required.

CVE-2026-3300 (Everest Forms Pro) - WordPress plugin RCE via eval() injection. 4,000+ active installations. First exploitation reports June 6.

What they share: no user interaction required. All three are infrastructure-touching. All three are currently being weaponized.

WHAT THIS MEANS FOR YOUR ENVIRONMENT

If you run Palo Alto Networks firewalls in gateway or portal mode, PAN-OS CVE-2026-0257 is now critical - treat it as actively in scope for your environment until proven otherwise.

If you're domain-joined - and you are - Netlogon CVE-2026-41089 is network-facing RCE against every domain controller. That's not a peripheral risk. That's your core identity infrastructure.

If you host WordPress, pull your plugin inventory today and verify Everest Forms Pro versions. Four thousand installations sounds like a small number until you realize one of them is yours.

THE COMPRESSION PROBLEM

Palo Alto Networks identified active exploitation on May 17. Microsoft released patches for Netlogon on June 4. By June 6, WordPress sites were being compromised via Everest Forms Pro. The window from "patch released" to "attack in the wild" is now measured in hours, not weeks.

AI is the acceleration vector. Unit 42's 2026 Incident Response Report is direct: "AI has become a force multiplier for threat actors. It compresses the attack lifecycle." Attackers are using LLMs for payload generation, exploit automation, and targeting reconnaissance. The barrier to entry for sophisticated attacks is collapsing.

CERT-In flagged the same trend with an operationally blunt recommendation: 12-hour patch cycles for critical systems. That's not aspirational guidance - it's what the current threat tempo demands.

THE PATCH PRIORITY LIST

1. Inventory Palo Alto Networks appliances. If you run GlobalProtect for VPN or remote access, patch or isolate immediately. Check logs from May 17 forward.
2. Pull your domain controller patch status. Netlogon has no safe workaround - the fix is the patch.
3. Audit WordPress plugin inventory. Everest Forms Pro needs immediate version verification. If you can't verify, deactivate until you can.
4. Review your patch cadence. If you're still operating on a monthly cycle for critical infrastructure, you were already behind before this week.

WHAT ANNUAL ASSESSMENTS DON'T CATCH

A pen test completed in January didn't account for CVE-2026-0257 (May), CVE-2026-41089 (June), or CVE-2026-3300 (June). Point-in-time assessments validate a snapshot. The threat environment doesn't hold still.

Continuous offensive security validation means when a critical drops, you know within days whether your specific environment is exposed - not when the next scheduled assessment rolls around.

WORK WITH UMERCS

uMercs runs offensive security engagements - pen testing, red team operations, and AI-assisted continuous testing - that find exposures before attackers do. The three vulnerabilities above are on our active test list this week. Reach out at umercs.com or info@umercs.com.