CYBER THREATCAST

Remediate CVE-2026-20349 immediately on Cisco Secure Firewall ASA and Threat Defense appliances exposing SSL VPN services. Cisco confirmed active exploitation, and repeated unauthenticated requests can reload affected appliances, disrupting VPN tunnels and perimeter traffic. Federal agencies face an August 14, 2026 deadline, but every affected operator should act now.

Disable or remediate the affected miniOrange SAML 2.0 Single Sign On plugin on WordPress sites immediately. Attackers are actively chaining CVE-2026-15981 and CVE-2026-61979 to forge SAML responses and gain unauthenticated administrator access; a public proof of concept may increase exploitation.

Upgrade Zimbra Collaboration Suite deployments affected by CVE-2026-73570, including versions before 10.1.20, without delay. The unauthenticated command-execution flaw is being exploited in the wild, and CISA required federal agencies to remediate within three days.

Patch Check Point VPN systems for CVE-2026-50751 and investigate activity during the month-long reported pre-remediation exposure window. A Qilin affiliate was linked to at least one intrusion involving the flaw, and patching alone does not address compromise that may have occurred before the fix.

Apply the emergency Keycloak updates for CVE-2026-18963 promptly. The flaw can allow unauthenticated account takeover, including administrator accounts, because the password-reset flow improperly validates state before accepting a new password. No active exploitation has been reported, but the potential impact is severe.