CYBER THREATCAST

Patch Oracle HTTP Server for CVE-2026-21962 by CISA’s August 27 remediation deadline, prioritizing versions 12.2.1.4.0, 14.1.1.0.0, and 14.1.2.0.0 and the Oracle WebLogic Server Proxy Plug-in. CISA has observed active exploitation, and successful attacks can bypass security controls and completely compromise affected enterprise and government systems.

Apply JetBrains’ fix for TeamCity On-Premises CVE-2026-63077 immediately and investigate affected servers for compromise. Attackers are exploiting the authentication-bypass and command-execution flaw in the wild, including against Australian systems; a public proof of concept is also available, and CISA has added the vulnerability to KEV.

Remediate Zimbra Collaboration CVE-2026-73570 and examine exposed servers for compromise, especially deployments using the optional SNMP notification component. Shadowserver identified at least 274 compromised servers and 8,200 unpatched internet-facing instances. Critical-sector organizations should also account for Laundry Bear’s crafted emails, which can exploit Zimbra flaws when a user merely views a message and enable correspondence theft.

Update supported older iPhones to iOS 15.8.7 or 16.7.15, prioritizing devices used for cryptocurrency wallets. Apple backported fixes for vulnerabilities linked to Coruna, Operation Triangulation, and financially motivated cryptocurrency attacks; Coruna fingerprints devices before selectively delivering exploit chains.

Investigate VMware vCenter Server systems for CVE-2026-59310 compromise, focusing on unauthorized reverse SSH tooling and Babuk-derived ransomware activity. The flaw is reportedly being exploited across 47 countries and may permit unauthenticated arbitrary code execution, putting data-center management infrastructure at risk.