Zero-click vulnerabilities: the new primary vector for initial access

Zero-click vulnerabilities: the new primary initial access vector

In the first quarter of 2026, cyberattacks reached a new threshold of efficiency, with exploited vulnerabilities surpassing social engineering as the primary initial access vector (IAV), accounting for 38% of total attacks. This epochal shift reveals a concerning trend: 50% of exploited vulnerabilities were zero-click, requiring no authentication or user interaction, offering attackers quick paths to exposed systems and edge infrastructures.

The acceleration of vulnerability escalation

A critical element that emerged is the correlation between exploitation activity and peaks of public discussion on forums, blogs, and social media. This dynamic demonstrates how threat actors can rapidly operationalize public information as soon as vulnerabilities gain visibility. Zero-click vulnerabilities, in particular, are becoming the preferred vector for their low operational profile and high effectiveness.

Geopolitics and cybercrime operations

Geopolitical tension continued to shape the cybersecurity landscape, especially in the Middle East, where cyber warfare operations synchronized with military escalation. Groups aligned with Iran targeted government infrastructures, financial services, and industrial systems, while Russian and Chinese campaigns focused on intelligence gathering, telecommunications infrastructures, and persistent access operations.

The impact of counter operations

Law enforcement counter operations, including the seizure of ransomware platforms like RAMP and LeakBase, created operational pressures for criminal groups. This pushed threat actors towards smaller and more decentralized communities, increasing internal distrust and complicating their operations.

The evolution of ransomware: towards pure extortion

The report highlights a significant evolution in ransomware operations, with a growing shift towards "pure extortion" tactics. These attacks focus on the quick theft of sensitive data without deploying ransomware payloads, reducing operational risk and visibility for attackers. This approach exploits zero-click vulnerabilities to gain initial access and exfiltrate data, applying pressure on victims without leaving obvious traces.

The need for proactive security

The results of the first quarter of 2026 clearly indicate that organizations can no longer rely on periodic assessments and reactive workflows. Security teams need continuous visibility into their attack surface, better prioritization of exploitable risks, and the ability to keep pace with modern attackers to prevent small exposures from becoming large-scale incidents.

Critical vulnerabilities and case studies

Among the critical vulnerabilities that emerged, the CVE-2026-20182 stands out, an authentication bypass in the Cisco Catalyst SD-WAN Controller, which has been resolved. This type of vulnerability underscores how network controllers can become a critical weak point, offering attackers privileged access to entire networks.

New threats and stealth variants

Research has also uncovered campaigns like ModeloRAT, which exploit IT support platforms to gain access to domains, and new variants of BPFDoor, demonstrating how threats are becoming increasingly sophisticated and difficult to detect.

Implications for security strategies

At this point, it is evident that organizations must adopt a more proactive approach to cybersecurity. This includes implementing continuous monitoring solutions, adopting defense-in-depth techniques, and investing in threat intelligence to anticipate attacker tactics.

The challenge of geopolitics and criminal operations

The synchronization between military escalation and cyber warfare operations in the Middle East underscores the need for international cooperation to counter these threats. Organizations must be prepared not only for immediate disruptions but also for persistent access operations that can remain undetected for long periods.

The importance of operational resilience

Law enforcement counter operations, although effective in the short term, create a more volatile environment for criminal groups. This increases the need for cybersecurity strategies that are flexible and adaptable, capable of responding to a rapidly evolving threat landscape.

Towards a safer future

Finally, the first-quarter report of 2026 serves as a warning for organizations of all sizes. Cybersecurity is no longer an option but a critical necessity. Investing in advanced technologies, staff training, and strategic collaborations will be fundamental to successfully navigating this new threat landscape.