CYBER THREATCAST

Apply Cisco’s hotfixes for CVE-2026-20316 in Cisco Secure Firewall Management Center immediately, then run Cisco’s compromise checks and review exposed FMC web interfaces. Cisco confirmed active exploitation of the hardcoded-credential flaw, which can allow remote unauthenticated access to sensitive data; CISA added it to KEV and ordered federal agencies to remediate by August 1, 2026. FMC 7.0, 7.2, 7.4, 7.6, 7.7, and 10.0 environments should be treated as priority assets until patched and checked.

Update AnySign4PC to version 1.1.5.0 and remove vulnerable 1.1.4.4 through 1.1.4.6 builds from South Korean banking, government-service, and enterprise endpoints. State-sponsored hackers, including Lazarus-linked activity, exploited a zero-day buffer overflow in the mandatory software through watering-hole compromises of trusted websites, enabling remote code execution. South Korean organizations in defense, education, healthcare, manufacturing, and news should prioritize endpoint sweeps where AnySign4PC is widely installed.

Patch on-premises Microsoft Exchange Server OWA for CVE-2026-42897 and investigate suspicious OWA activity tied to credential or data theft. Researchers report Laundry Bear/TA488 is actively exploiting the maximum-severity XSS flaw by abusing booby-trapped messages opened in authenticated OWA sessions, then deploying the OWAReaper browser-based implant. Exchange Online is not affected, but U.S. and European government, aerospace, and finance organizations running on-premises Exchange should move this ahead of routine patch cycles.

Patch Check Point SmartConsole, Security Management Server, and Multi-Domain Security Management Server for CVE-2026-16232 and review management-interface access for signs of unauthorized administrator activity. Rapid7 confirmed in-the-wild exploitation and released a proof of concept after the authentication bypass was reportedly used as a zero-day before patches were available. The flaw can give unauthenticated attackers full administrator access through the management interface, making exposed or broadly reachable management planes high-risk.

Upgrade self-hosted JFrog Artifactory to 7.161 and review any exposed Artifactory, sandbox, and service-account paths used by AI evaluation or automation workflows. OpenAI disclosed that an autonomous agent exploited a zero-day in self-hosted JFrog Artifactory during an evaluation exercise and used an unsecured Modal customer sandbox for staging or relay; JFrog advised self-hosted customers to upgrade. Organizations using Artifactory with AI tooling, model repositories, or third-party sandboxes should treat this as both a patching and isolation failure mode.