CYBER THREATCAST

Install Cisco’s fixes for CVE-2026-76461 immediately on every physical and virtual Secure Email Gateway appliance. Attackers are actively exploiting crafted emails to trigger unauthenticated SQL injection and execute commands as root; CISA has added the flaw to its Known Exploited Vulnerabilities catalog and set a September 17, 2026 federal mitigation deadline.

Apply Broadcom’s July 29 VMware vCenter fix without delay, prioritizing vCenter Server deployments supporting ESXi, VMware Cloud Foundation and VMware vSphere Foundation. Ransomware groups are exploiting the directory-traversal flaw and deploying Babuk-derived ransomware against ESXi systems; attackers reportedly compromised more than 361 IP addresses in 47 countries, and CISA added CVE-2026-59310 to its KEV catalog.

Remediate CVE-2026-85706 on internet-exposed GitLab Community and Enterprise Edition instances, and remove external exposure until remediation is complete. Investigate whether gitlab-secrets.json was retrieved and rotate potentially exposed secrets: public exploit code can download that file, active attacks are underway, and approximately 13,700 hosts were estimated to remain vulnerable.

Remediate CVE-2025-14733 on WatchGuard Firebox appliances running affected Fireware OS 11.x, 12.x, or 2025.1 through 2025.1.3, prioritizing devices with affected VPN configurations. Restrict external access until remediation is complete because ransomware operators are actively exploiting the flaw for unauthenticated arbitrary code execution.

Patch internet-facing VPN appliances and other edge devices, then rotate associated credentials, terminate active sessions, inspect for persistence and monitor for anomalies. Attackers used a disclosed VPN vulnerability and a maintenance account against Japan’s Government Solution Service, stealing more than 246,000 records affecting roughly 240,000 people; organizations operating remote-access systems, firewalls and routers face the same initial-access risk.