CYBER THREATCAST

Remediate VMware vCenter CVE-2026-59310 immediately, restrict external access, and hunt affected systems for reverse_ssh persistence. The unauthenticated directory-traversal flaw enables remote code execution, and attackers began exploiting it within five days of disclosure, affecting 361 IP addresses across 47 countries.

Upgrade TeamCity On-Premises installations affected by CVE-2026-63077, then investigate them for unauthorized access. CISA has confirmed active exploitation of this unauthenticated remote-code-execution flaw; compromised build servers may expose source code, tokens, credentials, and production secrets. TeamCity Cloud is reportedly unaffected.

Identify every internal and third-party N-able N-central deployment, investigate it for compromise, and require affected service providers to report their findings. Attackers are actively targeting these remote-management servers, and a compromised instance can provide administrator-level network access and persistence. New York-regulated banks and insurers should include downstream vendors in their review.

Apply Adobe’s isolated patch for CVE-2026-71362 to Adobe Commerce, Adobe Commerce B2B, and Magento Open Source without delay. Remote attackers need no account, administrative privilege, or user interaction to switch customer sessions, take over accounts, and access private data; exploitation attempts have already been blocked in the wild.

Install Microsoft’s July 2026 SharePoint fix for CVE-2026-55040 and review exposed servers for attempted impersonation. Public proof-of-concept code has been used against honeypots, and the flaw permits unauthenticated user or administrator impersonation; chaining it with CVE-2026-63520 could enable remote code execution.