CYBER THREATCAST

Patch Citrix NetScaler ADC and Gateway immediately, prioritizing 14.1 systems before 14.1-72.61 and 13.1 systems before 13.1-63.18, and investigate appliances configured as SAML identity providers. CVE-2026-8451 is being exploited within 24 hours of disclosure, and Lupovis observed coordinated scanning and exploitation. Separately, Anubis ransomware affiliates are exploiting CVE-2025-5777 against NetScaler environments for initial access, then using valid VPN credentials, RMM tools, RDP/SMB lateral movement, PsExec, exfiltration tooling, and wipe-mode ransomware capabilities. Healthcare, business services, manufacturing, technology, and financial services organizations should treat exposed NetScaler systems as high-risk until patched and reviewed.

Upgrade Cisco Unified Communications Manager to fixed releases or disable WebDialer as a temporary mitigation. Cisco confirmed active exploitation of CVE-2026-20230, an unauthenticated SSRF vulnerability in Unified CM patched in early June. Organizations running Cisco Unified CM should verify internet exposure, apply Cisco’s fixed versions, and review logs for suspicious WebDialer-related activity because Cisco has confirmed in-the-wild exploitation of the platform.

Identify and upgrade affected on-premises Microsoft SharePoint Server deployments, including SharePoint Server 2016, SharePoint Server 2019, and SharePoint Server Subscription Edition. CISA added CVE-2026-45659 to the Known Exploited Vulnerabilities catalog after evidence of active exploitation, and the Canadian Centre for Cyber Security warns the deserialization flaw can enable remote code execution by a low-privileged remote attacker. Because attackers may pair the flaw with stolen credentials or phishing to obtain required access, review SharePoint authentication events and account activity alongside patch status.

Take exposed Langflow instances offline until patched and checked for compromise, then rotate credentials reachable from the host. Threat actors exploited CVE-2026-33017 for unauthenticated RCE against exposed AI application endpoints and deployed a Monero miner that disables security controls, kills rival miners, persists via cron, and may spread through reused SSH keys. Sysdig also reported JADEPUFFER exploiting CVE-2025-3248 in Langflow to gain code execution, steal credentials, pivot into Nacos and MySQL, encrypt 1,342 Nacos configuration items, and demand Bitcoin. Langflow operators should inspect connected Nacos, MySQL, MinIO, Google Cloud credentials, SSH keys, and API secrets, not just the Langflow server.

Apply Oracle’s May 2026 Critical Patch Update to Oracle E-Business Suite and reduce external exposure of EBS instances wherever possible. Shadowserver identified about 950 internet-facing Oracle E-Business Suite instances, while real-world exploitation attempts tied to CVE-2026-46817 were observed. Shadowserver’s scan indicates external reachability rather than confirmed vulnerability, so EBS owners should verify exact version and patch level instead of assuming exposure equals compromise or safety.