CYBER THREATCAST

Identify every internet-facing Progress LoadMaster and Progress ADC instance and prioritize CVE-2026-8037 as an emergency exposure review. CISA added the CVSS 9.6 unauthenticated command-injection flaw to its Known Exploited Vulnerabilities catalog after active exploitation was observed, and the bug enables unauthenticated remote command execution. Progress LoadMaster operators, including U.S. federal agencies, should treat any exposed appliance as a likely target and move remediation ahead of routine patch queues.

Patch and investigate exposed SonicWall SMA1000 appliances for CVE-2026-15409 and CVE-2026-15410 exploitation. CISA added both bugs to KEV, ransomware gangs are actively exploiting them, and Volexity reported exploitation by UTA0533 before public disclosure. Organizations using SonicWall Secure Mobile Access 1000 as an enterprise VPN gateway should assume these devices are high-value entry points and review them for signs of compromise before restoring normal trust.

Review Fortinet FortiOS, FortiProxy, VPN, and firewall appliances for exposure to CVE-2024-55591 and CVE-2025-24472, then hunt for Gunra ransomware activity. CISA, FBI, DC3, NSA, and the U.S. Secret Service warned that Gunra affiliates exploit Fortinet VPN and firewall flaws for initial access, then use phishing, Impacket tools, SMB lateral movement, and credential dumping before double extortion. Critical infrastructure, finance, government, healthcare, manufacturing, transportation, and utility organizations should move this ahead of general perimeter hardening.

Treat N-able N-central servers as potential downstream attack paths and investigate for StormEncryptor activity, especially where CVE-2026-18577 exposure may exist. Reported intrusions involved credential theft, reconnaissance, account manipulation, attempts to disable security software, and tools including AnyDesk, SimpleHelp, Advanced IP Scanner, and Mimikatz before exfiltration and ransomware deployment. MSPs and N-able partners should verify server integrity and assess customer-environment access before attackers turn compromised RMM infrastructure into a broader ransomware gateway.

Audit WordPress sites running affected BdThemes plugins for rogue administrator accounts, fake plugins, and web shells, even if WordPress.org plugin files appear unchanged. Attackers poisoned a promotional API/data feed used by seven BdThemes plugins, causing code to run in administrator browsers through wp-admin and abuse admin sessions to create accounts and install a fake plugin containing a webshell. Site owners using Element Pack, Prime Slider, Pixel Gallery, Live Copy Paste, Smart Admin Assistant, or other affected BdThemes plugins should review recent admin activity and installed plugins immediately.