CYBER THREATCAST

Cisco Unified Communications Manager tops a day dominated by active exploitation and identity-driven intrusion. Attackers are abusing CVE-2026-20230 to deploy webshells and reach remote code execution on underlying servers, while Storm-2603 is hitting unpatched on-premises Microsoft SharePoint flaws with ransomware and custom backdoors. At the same time, phishing and access-broker activity is leaning on legitimate platforms and trust signals: EvilTokens abuses Microsoft 365 device-code flows, Edgecution starts with Microsoft Teams lures and a fake Outlook update portal, and FortiBleed reportedly harvested credentials from more than 430,000 FortiGate firewalls.

The Cisco case stands out because the chain is already moving past initial access into deeper compromise. Reporting says attackers are using public exploit code, automated Tor-routed scans, and multi-stage webshells against internet-facing Unified CM, and one service provider victim saw escalation from a compromised admin account to root. Cisco administrators have a short list of immediate options in the reporting: upgrade or disable WebDialer.

Identity and administration paths keep resurfacing as the pressure points. SharePoint attackers combined CVE-2025-49706 and CVE-2025-49704 with ransomware, custom backdoors, and bring-your-own-vulnerable-driver tactics; EvilTokens is stealing valid Microsoft 365 access tokens through legitimate authentication; and FortiBleed shows how post-access traffic capture can turn edge infrastructure into a credential collection point. The common lesson is blunt: exposed collaboration, identity, and management systems are still giving attackers both entry and leverage.