CYBER THREATCAST

SonicWall SMA1000 operators should immediately assess every internet-facing SMA1000 appliance for exposure to CVE-2026-15409 and CVE-2026-15410, then hunt for compromise indicators tied to credential, session, and TOTP MFA seed theft. CVE-2026-15409 is a critical SSRF reachable through /wsproxy that can tunnel to localhost-only services, and the paired remove_hotfix issue is described as a high-severity privilege escalation/code execution path in an actively exploited zero-day chain affecting remote access appliances.

Oracle E-Business Suite administrators should apply Oracle’s updates for the critical Oracle Payments File Transmission flaw immediately and verify the component is no longer exposed in an unpatched state. CISA added the actively exploited vulnerability to its KEV catalog and ordered U.S. federal agencies to patch by Saturday, while Oracle urged immediate patching after exploitation was observed.

Microsoft SharePoint Server teams should patch on-premises SharePoint Server 2016, 2019, and Subscription Edition deployments, apply Microsoft mitigations, harden per CISA guidance, and hunt for indicators of compromise. CVE-2026-45659 and CVE-2026-32201 are being used in the wild for RCE and spoofing, while CVE-2026-56164 and CVE-2026-56155 were actively exploited zero-days; if compromise is suspected, rotate SharePoint machine keys because exploitation can include IIS machine-key theft, malware persistence, and possible full server compromise.

Critical infrastructure operators should review exposed routers and networking devices now, remove weak or default passwords, disable Cisco Smart Install where present, upgrade SNMP v1/v2 to SNMPv3, and remediate unpatched Cisco device vulnerabilities. The joint advisory says Russian FSB Center 16-linked hackers are actively exploiting vulnerable networking devices worldwide, especially routers, to target communications, defense, energy, finance, and other critical infrastructure sectors.

Cisco IOS device owners should identify systems still exposed to CVE-2007-4816, apply available fixes, replace unsupported equipment, or disable the exposed functionality. CISA added the 2007 IKEv1 vulnerability to the Known Exploited Vulnerabilities catalog after confirming active exploitation in the wild, so legacy routers and network devices should be treated as an immediate remediation target rather than deferred as technical debt.