CYBER THREATCAST

Apply Cisco Secure Firewall Management Center hot fixes for CVE-2026-20316 immediately and follow Cisco’s credential-rotation guidance. CISA says attackers are already exploiting the hardcoded-credential zero-day, which lets an unauthenticated remote attacker log in through a built-in low-privilege account and access sensitive data. Organizations running Cisco Secure FMC should treat exposed or internet-reachable management interfaces as priority assets until remediation is complete.

Upgrade Adobe ColdFusion servers to ColdFusion 2025 Update 10 or ColdFusion 2023 Update 21 and inspect affected systems for web shells. CVE-2026-48282 is a CVSS 10.0 path-traversal flaw requiring no authentication or user interaction, and attackers reportedly exploited it within about two hours of a technical write-up to deploy web shells. Teams running ColdFusion 2023 through Update 20 or ColdFusion 2025 through Update 9 should assume rapid exploitation pressure.

Patch on-premises Microsoft Exchange Server Outlook Web Access for CVE-2026-42897 and review OWA activity tied to suspicious messages. Proofpoint reported that TA488/Laundry Bear abused the XSS flaw in a half-click email attack: opening a booby-trapped message in an authenticated OWA session can execute attacker JavaScript, and the campaign deploys OWAReaper. Aerospace, financial, government, hospitality, telecom, U.S., and European organizations running on-premises OWA should prioritize this over routine Exchange maintenance.

Reduce exposed attack surface on Apache Tomcat, Citrix NetScaler, Langflow, and Marimo systems and investigate internet-facing hosts for signs of automated probing or compromise. Unit 42 reported a Chinese-speaking actor using DeepSeek through Hermes Agent to find exposed servers and launch attacks, with reported command execution and data theft among confirmed compromises. Organizations in Asia and operators of the named technologies should move exposed instances to the front of vulnerability, access-log, and configuration review queues.

Remove internet-facing PLC access from water-system environments and verify controller passwords, project files, safety logic, alarms, and monitoring settings. CISA warned that coordinated intrusions disrupted more than 30 Minnesota water systems by targeting exposed industrial controllers and PLCs, changing IP addresses and passwords, manipulating safety logic, disabling alarms, and forcing some manual operations. Utilities using Allen-Bradley MicroLogix 1100/1400 or related Rockwell Automation controllers should review exposure and recovery procedures now.