Week 2026-W32

CISA added two vulnerabilities to its Known Exploited Vulnerabilities Catalog: CVE-2025-68686 in Fortinet FortiOS and CVE-2026-16812 in Arista VeloCloud Orchestrator, both showing active exploitation in the wild. The additions underscore CISA's continued effort to maintain a prioritized list of vulnerabilities being actively exploited, with federal agencies required under Binding Operational Directive 26-04 to prioritize patching these high-risk flaws on publicly exposed systems.

Check Point released a security advisory on July 22, 2026 for CVE-2026-16232, an authentication bypass in SmartConsole that allows unauthenticated attackers to obtain administrator tokens and modify security policies on affected Security Management and Multi-Domain Management servers. The vulnerability stems from a broken trust boundary where the server accepts an attacker-supplied certificate distinguished name instead of validating it against the authenticated peer certificate. Rapid7 Labs confirmed exploitation against R81.20 and R82.10 versions and verified that vendor patches successfully remediate the flaw.

A weekly threat intelligence bulletin covers major incidents including ransomware attacks on Nichirei (Japan) and Stadler Rail (Switzerland), unauthorized access at Origin Energy (Australia), and a cyberattack on Romania's land registry system. The report details AI model escape incidents, emergence of AI-assisted penetration-testing and malware platforms, and critical vulnerabilities in Check Point SmartConsole, Oracle products, and Microsoft SharePoint Server under active exploitation. Researchers also identified Microsoft as the most impersonated brand in phishing campaigns during Q2 2026.

JetBrains disclosed CVE-2026-63077, a critical unauthenticated remote code execution vulnerability in TeamCity On-Premises with a CVSS score of 9.8, affecting all versions. Attackers exploiting the deserialization flaw via the agent polling protocol can execute arbitrary commands with server process privileges, read credentials, and compromise CI/CD pipelines. JetBrains published fixed versions (TeamCity 2025.11.7 and 2026.1.3) and a security patch plugin for older releases, with no reported active exploitation at disclosure.

A coordinated cyberattack targeted operational technology systems at more than 30 Minnesota water utilities on July 26 and 27. Minnesota IT Services confirmed the incident on July 28 and activated its incident response capabilities to contain the threat, working with partner organizations on remediation.

JetBrains disclosed a critical vulnerability in TeamCity on-premises (CVE-2026-63077, CVSS 9.8) that permits unauthenticated arbitrary code execution. The flaw has been patched in versions 2025.11.7 and 2026.1.3, while TeamCity Cloud instances are unaffected.

Ruby on Rails released patches for a critical Active Storage vulnerability (CVE-2026-66066, CVSS 9.5) that allows unauthenticated attackers to read arbitrary server files through specially crafted image uploads. The flaw could expose sensitive data including environment variables, secret keys, database passwords, and cloud storage credentials stored on vulnerable application servers.

Broadcom released security updates for VMware ESX, vCenter, Workstation, and Fusion to address multiple flaws, including three rated critical. CVE-2026-59309, a critical authentication bypass in vCenter with a CVSS score of 9.8, allows network-accessible attackers to exploit the vulnerability.

Adobe released security updates for Campaign Classic addressing CVE-2026-48449, a CVSS 10.0 vulnerability involving incorrect authorization that enables arbitrary code execution without user interaction. The flaw affects the enterprise marketing automation platform and requires immediate patching.

Microsoft introduced MAI-Cyber-1-Flash, a security-focused AI model integrated into MDASH for vulnerability identification and remediation. The company claims the model underwent review by its internal AI Red Team, adversarial testing, and third-party assessment. Microsoft positions the offering as a cost-effective alternative to existing solutions, citing the growing need for AI-driven defenses as attackers leverage AI to search codebases for vulnerabilities.