CYBER_THREATCAST
$ briefing --date=
CYBER THREATCAST
CYBER THREAT INTELLIGENCE BRIEFING
CISA added five actively exploited JFrog Artifactory, ConnectWise ScreenConnect and MikroTik RouterOS flaws to its Known Exploited Vulnerabilities catalog. The Dutch NCSC separately warned of imminent exploitation of two patched Check Point VPN vulnerabilities, both rated CVSS 9.8 and potentially allowing unauthenticated remote code execution.
CVE-2026-84869, a critical authorization and privilege-management flaw, carries a reported CVSS score of 9.9. ScreenConnect attacks have spread through malicious clients and established VBScript persistence, while exploitation of the affected products has enabled administrative takeover, backdoor installation and unauthenticated router compromise.
ScreenConnect versions before 26.6.5, JFrog Artifactory, MikroTik RouterOS and internet-facing Check Point gateways warrant immediate review. The exposure reaches managed service providers, IT departments and organizations operating industrial and critical-infrastructure environments.
Editorial: Recommended Actions
01
PRIORITY
Patch internet-facing ConnectWise ScreenConnect, self-hosted JFrog Artifactory, MikroTik RouterOS, and Check Point VPN systems immediately, prioritizing ScreenConnect versions before 26.6.5. Inspect Artifactory for persistent administrator accounts, malicious plugins, shell commands, payloads, unauthorized SSH keys, and configuration exfiltration. Attackers are actively exploiting these products for administrative takeover, persistence, remote code execution, and unauthenticated router access; ScreenConnect attacks include worm-like propagation and malicious VBScript.
02
PRIORITY
Upgrade affected GitLab CE and EE deployments to 19.1.8, 19.2.6, or 19.3.2 as applicable, then investigate repository commits API activity for exploitation attempts. CVE-2026-85706 is already being exploited and permits unauthenticated reads of arbitrary server files, credentials, and secrets; GitLab operators should address any exposed credentials or secrets discovered during review.
03
PRIORITY
Deploy Google's emergency Chrome update for CVE-2026-85046 across managed endpoints and verify that browsers have restarted to complete installation. Google reports active exploitation of the Chrome V8 vulnerability, making rapid rollout especially important for organizations with large desktop fleets or delayed browser-update policies.
04
PRIORITY
Inspect Cisco Secure Firewall Management Center and cloud-delivered Firewall Management Center systems for root-command execution, credential theft, reverse shells, and persistent malware, isolating affected systems during investigation. Cisco Talos observed three intrusion groups exploiting one or both flaws, including Qilin ransomware operators and Sandworm-linked activity that deployed a reverse shell and a Cyclops Blink variant through CVE-2026-20316.
05
PRIORITY
Upgrade Dell ObjectScale deployments affected by CVE-2026-70416 to version 4.4.0.0 or later and restrict network exposure while completing remediation. The CVSS 10.0 deserialization flaw permits unauthenticated remote code execution in earlier ObjectScale versions; Dell also fixed four ObjectScale and Elastic Cloud Storage flaws that can enable unauthorized access, privilege escalation, information exposure, or denial of service.
Field Signals
Real-time intelligence from X/Twitter
$ scanning feeds_