CYBER THREATCAST

Identify KNX building automation devices using Connection Authorization Option 1 and treat CVE-2023-4346 exposure as an immediate operational-risk issue. CISA added the flaw to its Known Exploited Vulnerabilities catalog after attacks against KNX deployments reportedly let attackers wipe and password-lock devices, permanently bricking systems that control lighting, shutters, HVAC, and motion detection. Facilities, OT, and smart-building teams should prioritize exposed KNX environments for remediation, isolation, and recovery planning.

Patch on-premises Microsoft SharePoint Server 2016, 2019, and Subscription Edition immediately and hunt for compromise tied to CVE-2026-58644 and the July 2026 SharePoint attack chain. CISA and Microsoft confirmed in-the-wild exploitation that can bypass authentication, achieve remote code execution, deploy spinstall0.aspx web shells, steal IIS machineKey material from web.config, maintain persistence, and potentially lead to domain compromise. SharePoint administrators should validate fixes, search for web shells, and investigate machineKey exposure.

Apply SonicWall’s fixes for SMA 1000 CVE-2026-15409 and CVE-2026-15410 and examine appliances for post-exploitation artifacts. Volexity reported that UTA0533 exploited the zero-days before disclosure to gain root access, deploy an ELF backdoor, Python tooling, a custom Java web shell, and persistence changes; one compromised device was also used to monitor LDAP traffic and steal credentials. VPN administrators should treat vulnerable SMA 1000 appliances as high-value intrusion points and investigate related LDAP credential exposure.

Upgrade affected WordPress Core installations to 6.8.6, 6.9.5, or 7.0.2, depending on branch, and prioritize internet-facing sites on versions 6.9.0–6.9.4 and 7.0.0–7.0.1. CyCognito described a wp2shell chain combining REST API route confusion and WP_Query SQL injection; CVE-2026-63030 and CVE-2026-60137 can be chained without plugins, credentials, or user interaction, and a working proof of concept is public. WordPress operators should not wait for plugin exposure checks because the reported chain affects default installs.

Remediate Fortinet FortiSandbox CVE-2026-25089 and CVE-2026-39808 on an emergency timeline and verify whether any FortiSandbox systems were exposed during active exploitation. CISA added both critical OS command injection issues to its high-priority remediation list, along with SharePoint CVE-2026-58644, and ordered federal agencies to patch by July 19, 2026. Organizations running FortiSandbox should align remediation with that urgency because these are already exploited flaws in a security appliance.