Obsidian Security researchers disclosed a three-CVE privilege escalation and remote code execution chain in LiteLLM on June 15, 2026. The first vulnerability, CVE-2026-47101, is an authorization bypass in the key management endpoints. When a low-privilege user generates a virtual API key, LiteLLM writes the caller-supplied allowed_routes field to the database without validating it against the user’s actual role. A non-admin can therefore mint a key with allowed_routes set to a wildcard pattern that grants access to all routes including admin-only ones.

The second, CVE-2026-47102, is a privilege escalation that follows from the first. With a key that reaches the user management API, the attacker calls the endpoint to modify their own account role to proxy_admin. LiteLLM accepts the change because the request carries a valid key with the necessary route permissions, even though those permissions were obtained via the bypass.

The third, CVE-2026-40217, turns admin access into server-side code execution. The Custom Code Guardrail feature allows admins to supply Python code that LiteLLM compiles and runs via exec(). In production, the call provides no meaningful sandbox: exec() receives an empty globals dict, Python silently injects the full builtins module, and a call to os.system is enough to spawn a reverse shell. The combined chain receives a CVSS of 9.9. BerriAI, the maintainer, fixed all three in LiteLLM v1.83.14-stable, released May 2, 2026. CVE-2026-42271, a separately disclosed MCP command injection flaw already in CISA KEV with a June 22 deadline, is fixed from version 1.83.7 onward.

Google’s Threat Intelligence Group published a report on June 15, 2026 attributing a sustained espionage campaign to UNC6508, a China-linked threat cluster. The campaign targeted academic, medical, and military research institutions in the United States and Canada between September 2023 and November 2025, collecting data on defence intelligence, military strategy in the Indo-Pacific region, artificial intelligence, unmanned vehicles, cyber warfare programmes, and medical research.

UNC6508 gained initial access by exploiting vulnerabilities in REDCap, a widely used web application for managing clinical and research data, to steal login credentials from targeted institutions. Using those credentials, the group established persistent access and configured email forwarding rules on compromised accounts to automatically forward messages containing any of approximately 150 targeted keywords to a Gmail account under attacker control. The forwarding rules functioned as a passive, persistent exfiltration channel requiring no ongoing attacker activity.

Google did not name the compromised organisations but stated they collectively employ thousands of people with a combined research budget in the billions of dollars. The company identified the activity, notified affected institutions, and published the attribution report today. Beijing denies carrying out hacking activity of this nature.

Varonis Threat Labs disclosed SearchLeak on June 15, 2026, a one-click attack chain against Microsoft 365 Copilot Enterprise Search. Researchers chained three vulnerabilities to construct a malicious link hosted on a legitimate microsoft.com domain that, when clicked by a Copilot Enterprise user, would exfiltrate that user’s emails, calendar details, indexed SharePoint and OneDrive files, and MFA verification codes. No additional user interaction beyond the single click was required, and no password prompt was displayed.

Because the link used a genuine Microsoft domain, traditional anti-phishing controls and URL filtering tools would not have flagged it as suspicious. Microsoft assigned CVE-2026-42824 to the vulnerability, described it as critical, and mitigated it through a server-side fix applied to the M365 backend. No customer-side action is required. Varonis presented a proof-of-concept but has not observed the attack used in the wild.