Namibia recorded 506,143 cybersecurity vulnerability detections and 163,053 cyber events during the third quarter of 2026, as exposed network services and poorly secured systems continued to pose risks to organisations and digital infrastructure.
According to the Namibia Cyber Security Incident Response Team (NAM-CSIRT) Cybersecurity Constituent Newsletter for July to September 2026, vulnerability detections declined by 1.5% from 513,921 in the previous quarter, while cyber events increased by 0.93% from 161,547.
Communications Regulatory Authority of Namibia (CRAN) Executive for Communication and Consumer Relations, Mufaro Nesongano, warned that organisations remained exposed to cyberattacks through outdated software, insecure network configurations and internet-facing management systems.
“Organisations must remain vigilant and take proactive steps to protect their systems. Timely security updates, secure configurations, strong access controls and continuous monitoring are essential to reducing exposure to cyber threats,” Nesongano said.
The report identified Open CWMP as the most frequently detected vulnerability, accounting for 320,664 detections during the quarter, followed by NTP Version Report with 50,103 detections.
Accessible Telnet detections increased from 42,941 in the second quarter to 49,533 in the third quarter, while Open SNMP detections rose from 22,989 to 24,008.
Detections involving accessible Remote Desktop Protocol (RDP) services also increased from 6,763 to 7,537.
NAM-CSIRT warned that exposed remote-management services could provide attackers with opportunities to gain unauthorised access to organisational networks.
It advised organisations to disable unnecessary services, install security updates, strengthen access controls and restrict direct internet access to sensitive management systems.
Meanwhile, cyber events were largely driven by sinkhole-related activity, with Sinkhole HTTP events increasing from 109,593 to 115,063, while non-HTTP events rose from 39,593 to 45,552.
The activity indicates continued attempts by potentially compromised or suspicious systems to communicate with infrastructure associated with malicious cyber operations.
Although distributed denial-of-service (DDoS) activity declined during the quarter, the report found that scanning and probing of internet-facing systems continued.
The newsletter also identified emerging ransomware and data-extortion groups, including Emperador, n0n and EndZone, which use various methods to steal sensitive information and threaten to publish it unless victims comply with their demands.
According to NAM-CSIRT, the n0n group had already targeted an information technology services and document-processing company in Mali, while EndZone had been associated with attacks involving trusted contractors and service providers.
The report further highlighted critical security vulnerabilities affecting Microsoft SharePoint Server and VMware vCenter environments.
A SharePoint vulnerability identified as CVE-2026-50522 could allow attackers to execute malicious code remotely on vulnerable systems.
Meanwhile, VMware vCenter vulnerabilities CVE-2026-59309 and CVE-2026-59310 could enable unauthorised access and remote code execution.
Organisations operating affected systems were urged to install relevant security updates and restrict access to management interfaces.
The quarterly newsletter also examined cybersecurity incidents involving the Ministry of Defence and Veterans Affairs and the RelyComply anti-money laundering platform, highlighting risks associated with sensitive government information and third-party service providers.
NAM-CSIRT called on organisations to strengthen incident-response procedures, maintain secure backups, implement multi-factor authentication and improve network segmentation and third-party risk management.
As part of efforts to strengthen cybersecurity awareness, CRAN and NAM-CSIRT hosted a media engagement in Windhoek on 4 August 2026, focusing on cyber threats, incident response, simulations and crisis management.
Nesongano urged government institutions, businesses and members of the public to adopt stronger cybersecurity practices and remain alert to emerging threats.
Consumers were advised to exercise caution when opening unexpected email attachments, verify suspicious communications, update software regularly and report suspected phishing attempts.
The report also encouraged organisations responsible for digital platforms to conduct regular vulnerability assessments and strengthen application security to address threats such as SQL injection.
