CYBER THREATCAST

Patch Cisco Catalyst SD-WAN Manager for CVE-2026-20245 immediately and tightly review who can upload files or otherwise authenticate to the management plane. Mandiant reconstructed an intrusion in which a malicious CSV upload was used to gain root access in a service-provider environment, and CISA has added a related Cisco SD-WAN issue to KEV, underscoring live exploitation risk. Organizations running Cisco Catalyst SD-WAN Manager or related controllers should treat any recent unauthorized peering activity, suspicious file uploads, or certificate misuse as potential signs of compromise and validate the integrity of management-plane systems.

Update Lantronix EDS5000-series device servers for CVE-2025-67038 on an emergency basis and isolate exposed units until patching is complete. CISA warned the critical unauthenticated command-injection flaw is being actively exploited, and Forescout saw honeypot activity suggesting attackers may already be working from patch analysis. Because compromise can hand attackers a foothold for broader intrusion and lateral movement, organizations using EDS5000 devices should verify internet exposure, restrict management access, and inspect these systems for signs of unauthorized command execution.

Remediate Check Point Remote Access VPN exposure to CVE-2026-50751 now and hunt for post-compromise activity tied to Rclone and Tox. Reports say the 9.3-severity authentication bypass was exploited starting in early May, before CISA’s emergency directive, and alleged Qilin-linked activity hit dozens of organizations worldwide. Any organization running affected Check Point VPN infrastructure should assume opportunistic scanning and exploitation are already underway, prioritize patching and access review, and investigate for signs of data theft or attacker-controlled remote access.

Rotate credentials and secrets that traverse FortiGate devices, review FortiOS sniffer use, and investigate exposed perimeter firewalls for unauthorized packet-capture activity. Researchers say the FortiBleed campaign abused built-in FortiOS sniffer functionality to intercept credentials and secrets in transit at scale, with more than 430,000 devices reportedly compromised and nearly 73,932 credentials exposed across more than 21,000 organizations. Any organization using FortiGate firewalls should treat the issue as a credential-compromise event, not just a device incident, and revalidate trust for accounts and systems whose secrets may have crossed those appliances.

Patch UniFi OS across Cloud Gateways, Dream Machines, routers, video recorders, and UniFi OS Server deployments without delay, then check for botnet activity on exposed devices. Reports say multiple critical UniFi OS vulnerabilities are under active exploitation, CISA added the issues to KEV, and observed activity included Mirai-linked malware delivery. Organizations running UniFi gear should prioritize externally reachable systems first, verify all device classes are covered in patch plans, and look for signs that compromised appliances have already been pulled into botnet operations.