CYBER_THREATCAST
$ briefing --date=
CYBER THREATCAST
CYBER THREAT INTELLIGENCE BRIEFING
Cisco confirmed active exploitation of CVE-2026-76504, a critical Catalyst SD-WAN Manager authentication bypass that can give an unauthenticated attacker administrator-level API access. Fortinet also reports active exploitation of FortiMail CVE-2026-104286 while patches remain pending, and attackers are targeting on-premises SharePoint Server through CVE-2026-65660 after technical details and proof-of-concept code became public.
A crafted API request against vulnerable Catalyst SD-WAN Manager deployments can yield administrator privileges and let an attacker alter configurations across managed branches. CISA added CVE-2026-76504 to its Known Exploited Vulnerabilities catalog, making affected managers an immediate remediation priority.
Unauthorized users reportedly remained inside a Defense Manpower Data Center personnel system for about nine months, exposing records tied to approximately 2.76 million living and 294,000 deceased individuals. Authorities in Spain, Romania and the United Kingdom, meanwhile, disrupted KillSec infrastructure linked to nearly 1,000 attacks and seized at least 110 terabytes of stolen data.
Editorial: Recommended Actions
01
PRIORITY
Restrict Cisco Catalyst SD-WAN Manager’s management API to trusted administrative networks and remediate CVE-2026-76504 immediately. CISA added the flaw to its KEV catalog after Cisco confirmed active exploitation; a crafted API request can grant an unauthenticated remote attacker administrator privileges and allow configuration changes across managed branches. Review administrative activity and branch configuration changes for signs of unauthorized access.
02
PRIORITY
Remove affected FortiMail systems from direct internet exposure where feasible and use Fortinet’s published compromise indicators to investigate them now. CVE-2026-104286 is actively exploited, CISA has added it to KEV, and patches remain pending. Organizations running FortiMail 7.2.0–7.2.9, 7.4.0–7.4.8, 7.6.0–7.6.6, or 8.0.0–8.0.1 should apply Fortinet’s fix as soon as it becomes available.
03
PRIORITY
Patch on-premises Microsoft SharePoint Server and investigate SYSVOL for unauthorized ransomware staging. CVE-2026-65660 is actively exploited after proof-of-concept code and technical details became public, while Storm-2603 is exploiting other unpatched SharePoint flaws, CVE-2025-49704 and CVE-2025-49706, to deploy Warlock ransomware and replicate it through domain controllers. SharePoint Online is not identified as affected.
04
PRIORITY
Update exposed Apple devices to iOS 26.7.1, iPadOS 26.7.1, macOS Tahoe 26.7.1, or macOS Sequoia 15.8.1 as applicable. Apple says CVE-2026-86950 may have been exploited in sophisticated attacks against selected individuals, and public proof-of-concept code is available. Prioritize devices used by personnel at elevated risk of targeted attacks.
05
PRIORITY
Isolate or tightly restrict affected Zammad deployments until CVE-2026-102489 and CVE-2026-102490 are remediated, then investigate for session hijacking, remote code execution, and root access. Attackers chained the flaws within seconds to breach the Dutch Institute for Vulnerability Disclosure and steal volunteer contact information. Review Zammad 6.3.0–6.5.4, 7.0.0–7.1.3, and other versions affected by CVE-2026-102490; maintain segmentation to limit further movement.
ROUNDTABLE
Expert Panel Discussion
12 AI experts analyzed this briefing across 3 turns of structured debate
12Agents19Messages46mDuration
→
Field Signals
Real-time intelligence from X/Twitter
$ scanning feeds_