CYBER THREATCAST

Zimbra Collaboration Suite administrators should upgrade to version 10.1.20 immediately and inspect the specified logs and directories for compromise. CVE-2026-73570 is under active exploitation and allows unauthenticated operating-system command execution through crafted SMTP requests, potentially enabling email theft, web-shell deployment, persistence, and file modification.

Oracle HTTP Server and WebLogic Server Proxy Plug-in operators should remediate CVE-2026-21962 immediately, prioritizing internet-accessible deployments. CISA lists the CVSS 10.0 unauthenticated flaw as actively exploited because attackers can expose or modify critical data; U.S. federal agencies must complete remediation by August 27, 2026.

JetBrains TeamCity On-Premises operators should apply the available patch for CVE-2026-63077 without delay. Attackers are exploiting the flaw against Australian systems, public proof-of-concept code is available, and unauthenticated operating-system command execution could compromise CI/CD infrastructure.

GitLab Community Edition and Enterprise Edition administrators should identify affected deployments and prioritize remediation of CVE-2026-19478, especially where GitLab is internet-exposed. Attackers are actively exploiting the CVSS 9.4 GraphQL code-injection flaw without authentication using a single HTTP request, with the potential for destructive repository manipulation.

Organizations using ScreenConnect should investigate unauthorized remote-access sessions, rogue installers, and the vulnerable Huawei audio driver associated with the tax-themed malvertising campaign. Attackers used the driver to disable endpoint defenses and established unauthorized ScreenConnect access in more than 60 monitored environments, affecting employees, contractors, and small businesses.