Microsoft Exchange Zero-Day Under Attack, No Patch Available

A broad set of active and emerging threats reported across enterprise, cloud, supply-chain and OT environments: an unpatched Microsoft Exchange OWA XSS zero-day (CVE-2026-42897) is being exploited in the wild; a CVSS 10.0 Cisco SD‑WAN vulnerability is likewise under active exploitation; the public release of Shai‑Hulud worm source and follow-on npm/package infections are expanding supply‑chain risk; AI agents and LLMs are being weaponized for exploit development, automated attacks, and bespoke malware; OpenClaw agent-framework flaws (now patched) allowed credential theft, privilege escalation,