CYBER THREATCAST

Remediate Arista VeloCloud Orchestrator CVE-2026-16812 immediately in on-premises SD-WAN management environments, especially any VCO web interface reachable by untrusted networks. CISA has added the unauthenticated remote command-injection flaw to KEV after confirmed exploitation, and successful compromise can expose SD-WAN management data, credentials, cryptographic keys, and control over connected edge devices.

Patch security-management consoles before routine IT systems: apply Cisco Secure Firewall Management Center hot fixes for the actively exploited static-credential issue CVE-2026-20316 and address the critical FMC authentication bypass CVE-2026-20079; apply Check Point Jumbo Hotfixes for SmartConsole CVE-2026-16232. These systems sit at the center of firewall and policy administration, and the reported flaws can enable sensitive information disclosure or full administrative access without valid credentials.

Upgrade WordPress sites to the patched core releases—6.8.6, 6.9.5, or 7.0.2—and verify that automatic updates completed successfully. Wordfence reports more than 11 million exploit attempts against the WP2Shell vulnerability chain, which can let unauthenticated attackers create administrator accounts and then execute code through normal admin actions such as plugin uploads.

Hunt for webmail compromise in on-premises Microsoft Exchange Outlook Web Access and Zimbra environments, prioritizing users in government, defense-industrial, scientific, aerospace, financial, and hospitality organizations. Laundry Bear/Void Blizzard is exploiting OWA CVE-2026-42897 to deploy OWAReaper for mailbox access, credential theft, and persistence, while TA488 exploited Zimbra CVE-2025-66376 through malicious email preview or opening to steal emails and credentials and maintain persistence.

Treat internet-connected PLC, HMI, and SCADA exposure as an emergency risk in water and critical infrastructure environments, and inspect Rockwell Automation, Schneider Electric, and Siemens deployments for malicious project-file interactions, manipulated HMI/SCADA displays, and unauthorized reusable code-module changes. Iran-linked activity allegedly disrupted more than 30 Minnesota water and wastewater systems using Rockwell Automation Logix PLC weaknesses, and the CISA-linked advisory warns Iranian-affiliated actors continue targeting internet-connected PLCs in U.S. critical infrastructure and water utilities.