CYBER THREATCAST

Patch and harden on-premises Microsoft SharePoint Server Subscription Edition, 2019, and 2016 immediately, and investigate exposed servers for remote code execution, IIS machine-key theft, malware persistence, and unauthorized access. CISA says multiple SharePoint flaws are being exploited, including critical CVE-2026-58644 with unauthenticated network RCE and CVSS 9.8; Microsoft-related zero-days CVE-2026-56164 in SharePoint Server and CVE-2026-56155 in AD FS were also actively exploited. Organizations running affected SharePoint or AD FS should treat internet-facing systems as potential intrusion points, validate Microsoft Defender coverage, and prioritize incident response where patching lagged.

Upgrade SonicWall SMA1000 appliances to the fixed 12.4.3 or 12.5.0 hotfix releases and examine appliances for signs of targeted compromise. CVE-2026-15409 is a critical SSRF flaw in the WorkPlace /wsproxy interface that can reach internal-only services, while CVE-2026-15410 affects the Appliance Management Console and rollback/hotfix workflow with code execution as root. CISA added both flaws to the Known Exploited Vulnerabilities catalog after exploitation before patches, so remote access appliances should be handled as high-risk edge systems.

Apply Fortinet FortiSandbox fixes for CVE-2026-39808 and CVE-2026-25089 without delay and review FortiSandbox logs for unauthenticated command-execution attempts. CISA ordered immediate remediation after confirmed exploitation and KEV listing, and Fortinet issued advisory FG-IR-26-141 for affected FortiSandbox products. CVE-2026-25089 permits unauthenticated command execution through crafted HTTP requests, and the paired Fortinet flaws are critical command-injection issues that can enable unauthenticated remote code execution.

Harden internet-facing routers and network devices now, especially Cisco devices, Cisco Smart Install exposures, and SNMP configurations. The joint warning names Russian FSB Center 16/Berserk Bear as actively targeting critical infrastructure routers and edge devices through weak or default passwords and unpatched Cisco vulnerabilities. Energy, finance, communications, defense, government, and other critical infrastructure operators should remove weak credentials, restrict management exposure, remediate vulnerable devices, and apply the advisory’s mitigation and remediation steps immediately.

Update Amelia Booking WordPress plugin installations to version 9.2 or later and audit recent customer-level account activity for unauthorized password changes. Wordfence reports Amelia Booking versions 8.3 through 9.1.2 contain an authenticated customer-level IDOR that allows arbitrary user password changes and may enable administrator account takeover. Sites using the plugin should treat successful exploitation as a possible full WordPress compromise, reset affected credentials, and review administrator accounts and recent changes.