CYBER THREATCAST

Apply Cisco Secure Firewall Management Center Software hotfixes immediately and treat any exposed or internet-reachable Cisco FMC instance as a potential incident until reviewed. Cisco disclosed active exploitation of CVE-2026-20316, a static-credentials flaw that can let a remote unauthenticated attacker bypass security restrictions and disclose sensitive information, and CISA added the vulnerability to its Known Exploited Vulnerabilities catalog.

Prioritize on-premises Microsoft Exchange Outlook Web Access and Zimbra webmail remediation, then hunt for mailbox access, credential theft, and browser implant activity. Proofpoint reported TA488/Laundry Bear exploitation of CVE-2026-42897 in Exchange Server OWA and CVE-2025-66376 in Zimbra using half-click email attacks; the activity deployed the OWAReaper browser implant and targeted government, aerospace, financial, hospitality, telecom, defense, and scientific organizations in the U.S., Europe, and Ukraine. Exchange Online is not affected by the OWA issue.

Remove direct internet access from PLCs and other OT devices, validate PLC project files, and alert OT service providers to review remote access paths. More than 30 Minnesota community water systems were hit in a coordinated attack affecting operational technology, and a government advisory warns Iranian-affiliated actors are targeting internet-connected OT devices and PLCs across U.S. critical infrastructure, including water, energy, government services, and municipalities, with activity disrupting PLCs and manipulating HMI/SCADA displays.

Install Check Point Jumbo Hotfixes for CVE-2026-16232 and review administrative access to SmartConsole, Security Management Server, and Multi-Domain Security Management Server. The reported zero-day affects Check Point SmartConsole and related management products, is already exploited in the wild, and can give unauthenticated attackers full administrative access by abusing SIC-based authentication and management services.

Identify and remove FastJson 1.2.68 through 1.2.83 from Java and Spring Boot fat-JAR deployments, or isolate affected applications until the dependency is replaced. SOCRadar reports active exploitation of CVE-2026-16723, an unauthenticated remote code execution flaw mainly targeting U.S.-based organizations, and the FastJson 1.x line is unmaintained with no official patch.