CYBER THREATCAST

Immediately assess Cisco Secure Firewall Management Center deployments for CVE-2026-20079 and CVE-2026-20316, then investigate affected systems for privileged access, web shells, remote-access tooling, credential harvesting, and ransomware preparation. Attackers are actively exploiting CVE-2026-20079, a CVSS 10.0 authentication bypass that enables unauthenticated root access.

Install N-central 2026.3 Hotfix 3 without delay. CVE-2026-86218 is a CVSS 10.0 pre-authentication code-injection flaw enabling remote code execution and is actively exploited; CVE-2026-86206 and CVE-2026-86207 can also be chained to create a rogue system administrator account.

Update Google Chrome, Microsoft Edge, other Chromium-based browsers, and Windows systems as a priority. Attackers are exploiting V8 flaw CVE-2026-87491 through crafted HTML, while China-aligned groups used CVE-2026-85046 and Windows flaw CVE-2026-85880 in a three-zero-day chain against NGOs, Southeast Asian government organizations, and U.S. defense contractors. Microsoft has also fixed actively exploited CVE-2026-81963; both Windows flaws can elevate access to SYSTEM.

Patch AniSign and review deployments of CrossEX, CrossWeb EX, MagicLine4NX, TouchEn NXKey, and VeraPort, prioritizing South Korean financial- and public-sector environments. Lazarus exploited an AniSign remote-code-execution flaw through compromised websites, which installed backdoors through visitors’ security software; poor patch adoption continued to leave users exposed after fixes were released.

Upgrade WeChat for Android to version 8.0.77 or later and WeChat for iOS to version 8.0.76 or later across managed mobile fleets. The WeWorm research demonstrated that an incoming call—including one from a trusted contact—could trigger memory-corruption-based remote code execution without the recipient answering or interacting, then propagate through trusted contacts.