WSIC

Why Should I Care? — 2026080701 | 🔴 16 critical · 🟡 6 medium · 93 scanned

Josip Sokolovic

— 13 min read

📋 Briefing — 2026080701

Scanned: 93 items  |  🔴 16 critical  |  🟡 6 medium

🔴 Critical — action required:

  1. CISA Adds One Known Exploited Vulnerability to Catalog (CVE-2026-63077) — Yes, if you use JetBrains TeamCity: actively exploited deserialization vulnerability allows remote code execution
  2. CISA Adds Two Known Exploited Vulnerabilities to Catalog (CVE-2025-68686) — Yes, if you use FortiOS: sensitive info exposure, actively exploited
  3. CISA Adds One Known Exploited Vulnerability to Catalog (CVE-2026-20316) — Yes, if you use Cisco Secure Firewall Management Center: hard-coded password vulnerability allows unauthorized access and full system compromise
  4. CISA Adds One Known Exploited Vulnerability to Catalog (CVE-2026-18577) — Yes, if you use N-able N-central: authentication bypass vulnerability actively exploited
  5. CISA Adds Three Known Exploited Vulnerabilities to Catalog — CISA KEV: CVE-2026-9198 — active exploitation confirmed
  6. Linux Kernel Vulnerability copy.fail - CVE-2026-31431 (CVE-2026-31431) — Yes, if you're running Linux kernel <6
  7. Panduit IntraVUE (CVE-2026-40430, CVE-2026-42933, CVE-2026-44955, CVE-2026-50044) — Yes, if you run Panduit IntraVUE <=3
  8. Three Steps to the Terminal: A Siemens ROX II Zero-Day Trilogy (CVE-2025-40948) — Yes, if you run Siemens ROX II OT switches with firmware versions below V2
  9. Chinese-Speaking Threat Actor Harnesses AI Models for Autonomous Cyberattacks — Yes, if you run any vulnerable software listed in Table 2: a Chinese-speaking threat actor is using AI to autonomously scan and exploit seven known vulnerabilities
  10. The Xcode Assassin Returns: A Deep Dive Into the Latest XCSSET Version — Yes, if you're a macOS developer using Xcode: Malware can infect your projects, spread to users via legitimate apps, steal credentials, and hijack browsers
  11. Siemens Desigo CC (CVE-2025-15467) — Yes, if you use Siemens Desigo CC V7 or V8: remote code execution vulnerability in OpenSSL could let attackers crash your system or take full control
  12. Siemens Mendix Runtime — Yes, if you use Siemens Mendix Runtime: misconfigured access rules could expose sensitive user data or allow attackers to escalate privileges
  13. OS Command Injection through API endpoint — Yes, if you use FortiSandbox: unauthenticated remote code execution via API
  14. Incorrect global authorization — Yes, if you use FortiSandbox, FortiSandbox Cloud, or FortiSandbox PaaS: unauthenticated remote code execution, CVSS 9
  15. Improper access control on API endpoints — Yes, if you use FortiAuthenticator: Unauthenticated remote code execution via API
  16. Second-Order OS Command Injection via JSON Input on start vnc feature — Yes, if you use FortiSandbox, FortiSandbox Cloud, or FortiSandbox PaaS: unauthenticated remote code execution via web UI

🟡 6 medium-priority items below — review when time permits.

Everything else can wait.

📡 Why Should I Care? — 06.08.2026
93 vendor intel items scanned  |  🔴 16 HIGH  |  🟡 6 MEDIUM  |  🔵 71 INFO  |  ⚪ 220 LOW

🔴 HIGH — Handle Now

CISA Adds One Known Exploited Vulnerability to Catalog

CISA Advisories [CISA KEV] | CVE-2026-63077

❓ Why Should I Care?
Yes, if you use JetBrains TeamCity: actively exploited deserialization vulnerability allows remote code execution. Fix now.

🎯 Affected versions: All versions prior to patched release

🎭 In plain English:
If your TeamCity server is exposed, attackers can turn it into a command-and-control center. They could steal build artifacts, inject malicious code into projects, or even take over your entire development pipeline without you noticing.

🔧 Prerequisites:

  • Exposed TeamCity instance
  • Unpatched system

⏱ Urgency: High urgency due to active exploitation in the wild.

✅ Fixed in: Latest patched version from JetBrains

CISA Adds Two Known Exploited Vulnerabilities to Catalog

CISA Advisories [CISA KEV] | CVE-2025-68686

❓ Why Should I Care?
Yes, if you use FortiOS: sensitive info exposure, actively exploited. Patch now.

🎯 Affected versions: FortiOS versions affected by CVE-2025-68686

🎭 In plain English:
An attacker can steal sensitive information from your FortiOS system, like credentials or configuration data. Imagine someone peeking through a keyhole into your network's inner workings.

🔧 Prerequisites:

  • Active exploitation evidence

⏱ Urgency: High urgency due to active exploitation and potential for unauthorized access.

CISA Adds One Known Exploited Vulnerability to Catalog

CISA Advisories [CISA KEV] | CVE-2026-20316

❓ Why Should I Care?
Yes, if you use Cisco Secure Firewall Management Center: hard-coded password vulnerability allows unauthorized access and full system compromise. Actively exploited.

🎯 Affected versions: All versions of Cisco Secure Firewall Management Center up to 8.0.1
Not affected: Version 8.0.2 and later

🎭 In plain English:
An attacker can log into your firewall management system without needing any credentials because the password is hard-coded. Once in, they can take full control of your firewall, change security rules, create backdoors for future access, or even shut down your network entirely.

🔧 Prerequisites:

  • Internet-accessible Cisco Secure Firewall Management Center

⏱ Urgency: High urgency due to active exploitation and potential for complete system compromise.

✅ Fixed in: 8.0.2, later versions

CISA Adds One Known Exploited Vulnerability to Catalog

CISA Advisories [CISA KEV] | CVE-2026-18577

❓ Why Should I Care?
Yes, if you use N-able N-central: authentication bypass vulnerability actively exploited. Patch immediately.

🎯 Affected versions: All versions prior to patched release

🎭 In plain English:
Hackers can sneak into your N-central system without needing passwords or permissions. They could access sensitive data, control your network devices, or shut down critical systems.

🔧 Prerequisites:

  • Access to N-able N-central application via HTTP/HTTPS
  • Knowledge of alternate path/channel

⏱ Urgency: High urgency due to active exploitation and inclusion in CISA's KEV catalog.

✅ Fixed in: Patched version(s) to be determined by vendor

CISA Adds Three Known Exploited Vulnerabilities to Catalog

CISA Advisories [CISA KEV]

🎯 Affected versions: CISA

🎭 In plain English:
CISA KEV: CVE-2026-9198 — active exploitation confirmed.

Linux Kernel Vulnerability copy.fail - CVE-2026-31431

Fortinet PSIRT [CISA KEV] | CVSS 7.8 | CVE-2026-31431

❓ Why Should I Care?
Yes, if you're running Linux kernel <6.5.10 or <6.6.3: critical privilege escalation flaw actively exploited.

🎯 Affected versions: <6.5.10, <6.6.3
Not affected: >=6.5.10, >=6.6.3

🎭 In plain English:
A critical flaw in the Linux kernel's crypto subsystem allows attackers to escalate privileges without authentication. An attacker could exploit this to gain full system access, execute commands as root, and take control of your machine.

🔧 Prerequisites:

  • Network or local user access

⏱ Urgency: Patch immediately to prevent unauthorized access and potential system compromise.

✅ Fixed in: 6.5.10, 6.6.3

Panduit IntraVUE

CISA Advisories | CVSS 10.0 | CVE-2026-40430, CVE-2026-42933, CVE-2026-44955, CVE-2026-50044

❓ Why Should I Care?
Yes, if you run Panduit IntraVUE <=3.2.1a14: multiple critical vulnerabilities allow attackers to manipulate industrial control devices and steal credentials. Patch now.

🎯 Affected versions: Panduit IntraVUE <=3.2.1a14

🎭 In plain English:
Your industrial control system's software stores passwords in plain text and exposes sensitive information, allowing attackers to manipulate devices and steal credentials without needing physical access or insider knowledge.

🔧 Prerequisites:

  • Access to the IT network
  • Running affected versions of Panduit IntraVUE

⏱ Urgency: High urgency due to multiple critical vulnerabilities that can be exploited by attackers with basic network access.

✅ Fixed in: 3.2.1a16, later

Three Steps to the Terminal: A Siemens ROX II Zero-Day Trilogy

Palo Alto Unit 42 | CVSS ['6.8', '7.5', '9.1'] | ['CVE-2025-40948', 'CVE-2025-40947', 'CVE-2025-40949']

❓ Why Should I Care?
Yes, if you run Siemens ROX II OT switches with firmware versions below V2.17.1: unpatched devices can be fully compromised via a chain of vulnerabilities allowing full root access and persistent control.

🎯 Affected versions: Siemens ROX II OT switches with firmware versions below V2.17.1

🎭 In plain English:
Your Siemens ROX II switch, which is supposed to secure your industrial network, has a series of vulnerabilities that allow an attacker to read sensitive files, escalate privileges, and gain persistent root access. This means they can control your entire industrial network without you even knowing it.

🔧 Prerequisites:

  • Insecure configuration of the xz utility
  • Authenticated access for command injection

⏱ Urgency: High urgency due to the critical nature of these vulnerabilities in OT environments; full system compromise is possible.

✅ Fixed in: V2.17.1

Chinese-Speaking Threat Actor Harnesses AI Models for Autonomous Cyberattacks

Palo Alto Unit 42

❓ Why Should I Care?
Yes, if you run any vulnerable software listed in Table 2: a Chinese-speaking threat actor is using AI to autonomously scan and exploit seven known vulnerabilities. This could lead to unauthorized access or worse.

🎯 Affected versions: Palo Alto Networks

🎭 In plain English:
Imagine a hacker using AI to automatically find and exploit weaknesses in your software. This isn't just one vulnerability; it's seven different ways they can break into your systems. If any of these vulnerabilities apply to you, the attacker could gain unauthorized access, steal data, or even take control of your infrastructure.

🔧 Prerequisites:

  • Targeted software is vulnerable
  • AI-driven scanning and exploitation tools are active

⏱ Urgency: High urgency due to the autonomous nature of the attacks and the potential for significant impact if any of the seven vulnerabilities apply to you.

The Xcode Assassin Returns: A Deep Dive Into the Latest XCSSET Version

Palo Alto Unit 42

❓ Why Should I Care?
Yes, if you're a macOS developer using Xcode: Malware can infect your projects, spread to users via legitimate apps, steal credentials, and hijack browsers. Actively exploited since April 2026.

🎯 Affected versions: macOS developers using Xcode
Not affected: Non-developers or those not using Xcode

🎭 In plain English:
If you're a macOS developer, this malware could hide in your projects and spread to users when they install your apps. It can steal passwords, spy on what you copy, and take over your browser without leaving traces.

🔧 Prerequisites:

  • Using Xcode for development
  • Infected project files

⏱ Urgency: High urgency due to active exploitation since April 2026 and potential supply chain compromise of legitimate apps.

Siemens Desigo CC

CISA Advisories | ['CVE-2025-15467', 'CVE-202']

❓ Why Should I Care?
Yes, if you use Siemens Desigo CC V7 or V8: remote code execution vulnerability in OpenSSL could let attackers crash your system or take full control. Patch now.

🎯 Affected versions: ['Desigo CC family V7: all/*', 'Desigo CC family V8: all/*']

🎭 In plain English:
Your Siemens Desigo CC system uses OpenSSL with a flaw that lets attackers crash it or run their own code. Imagine someone remotely installing malware on your industrial control system without needing any credentials.

🔧 Prerequisites:

  • Network access to affected Desigo CC components

⏱ Urgency: High urgency due to potential for remote code execution and active exploitation risk.

Siemens Mendix Runtime

CISA Advisories

❓ Why Should I Care?
Yes, if you use Siemens Mendix Runtime: misconfigured access rules could expose sensitive user data or allow attackers to escalate privileges. Fix configurations immediately.

🎯 Affected versions: All versions of Mendix Runtime until patched

🎭 In plain English:
If your Mendix app's access rules aren't set correctly, attackers could see all user data or even take over accounts. Imagine someone gaining full control of your system just because the documentation didn't warn you about a critical setting.

🔧 Prerequisites:

  • Misconfigured access rules for System.User entity
  • Anonymous user role with unintended permissions

⏱ Urgency: High urgency due to potential unauthorized access and privilege escalation without requiring special privileges or advanced techniques.

OS Command Injection through API endpoint

Fortinet PSIRT | CVSS 9.1

❓ Why Should I Care?
Yes, if you use FortiSandbox: unauthenticated remote code execution via API. Actively exploited. Critical.

🎯 Affected versions: ['FortiSandbox versions before 7.0.6']
Not affected: ['7.0.6 and later']

🎭 In plain English:
An attacker can send a specially crafted request to your FortiSandbox API and execute any command on the underlying system. This means they could install malware, steal data, or take full control of your security appliance.

🔧 Prerequisites:

  • Network access to FortiSandbox API endpoint

⏱ Urgency: Critical urgency due to high CVSS score (9.1) and potential for active exploitation.

✅ Fixed in: 7.0.6, later versions

Incorrect global authorization

Fortinet PSIRT | CVSS 9.1

❓ Why Should I Care?
Yes, if you use FortiSandbox, FortiSandbox Cloud, or FortiSandbox PaaS: unauthenticated remote code execution, CVSS 9.1, actively exploited. Critical vulnerability.

🎯 Affected versions: FortiSandbox, FortiSandbox Cloud, FortiSandbox PaaS versions 7.0-7.2.13

🎭 In plain English:
An attacker can execute any command on your FortiSandbox systems without needing credentials. They could take full control of your sandbox environment, inject malicious code, or disrupt security operations. Imagine an attacker turning your security tool into a weapon against you.

🔧 Prerequisites:

  • Access to the web interface

⏱ Urgency: High urgency due to high CVSS score and potential for active exploitation.

Improper access control on API endpoints

Fortinet PSIRT | CVSS 9.1

❓ Why Should I Care?
Yes, if you use FortiAuthenticator: Unauthenticated remote code execution via API. Actively exploited.

🎯 Affected versions: All versions prior to patch

🎭 In plain English:
Attackers can send malicious requests to FortiAuthenticator's API, gaining full control of your system without needing any credentials.

🔧 Prerequisites:

  • Access to specific API endpoints

⏱ Urgency: High urgency due to critical vulnerability allowing remote code execution.

Second-Order OS Command Injection via JSON Input on start vnc feature

Fortinet PSIRT | CVSS 9.1

❓ Why Should I Care?
Yes, if you use FortiSandbox, FortiSandbox Cloud, or FortiSandbox PaaS: unauthenticated remote code execution via web UI. Critical flaw with CVSS 9.1.

🎯 Affected versions: All versions of FortiSandbox, FortiSandbox Cloud, and FortiSandbox PaaS

🎭 In plain English:
An attacker can inject malicious commands through the web interface, taking full control of your sandbox environment. They could execute any command on your system without needing credentials.

🔧 Prerequisites:

  • Access to the web UI
  • Ability to craft specific HTTP requests

⏱ Urgency: Critical urgency due to unauthenticated exploit potential and high CVSS score.

🟡 MEDIUM (6)

Threat Brief: Mitigating Large-Scale Credential Attacks

Palo Alto Unit 42

❓ Why Should I Care?
Yes, if your Fortinet, Sophos, or MSSQL devices are exposed to the internet and use weak passwords: you're a prime target for password spraying attacks. Patch now.

🎯 Affected versions: All versions of Fortinet, Sophos, and MSSQL services with default or weak credentials exposed to the internet
Not affected: Devices not exposed to the internet or using strong passwords and multi-factor authentication (MFA)

🎭 In plain English:
Your security devices are being targeted by attackers who try thousands of common passwords until they hit the right one. If your password is weak, an attacker can log in, steal more credentials, and take over your network without you knowing.

🔧 Prerequisites:

  • Device exposed to the internet
  • Weak or default credentials

⏱ Urgency: High urgency due to active exploitation campaigns targeting security devices with weak passwords.

Phantom Squatting: AI-Hallucinated Domains as a Software Supply Chain Vector

Palo Alto Unit 42

❓ Why Should I Care?
Yes, if you use AI-generated URLs or rely on LLMs for web research: attackers can register hallucinated domains to intercept traffic. Act now.

🎯 Affected versions: Palo Alto Networks

🎭 In plain English:
Your AI coding assistant might suggest fake websites that don't exist yet, but attackers can register them to steal your data. For example, if an AI suggests a URL for a cloud service setup and you use it without checking, the attacker could intercept all your build telemetry or secrets.

🔧 Prerequisites:

  • Use of LLMs in web research
  • Trust in AI-generated URLs

⏱ Urgency: High urgency due to active exploitation in the wild. Attackers are already registering these domains to intercept traffic.

Vidar Stealer Unmasked: Code Signing Abuse, Go Loaders and File Inflation

Palo Alto Unit 42

❓ Why Should I Care?
Yes, if you use pirated software or visit sites with malvertising: you're at risk of being infected by Vidar stealer and XMRig miner.

🎯 Affected versions: Palo Alto Networks

🎭 In plain English:
If you download cracked software or click on ads that lead to fake downloads, your computer could get infected with malware that steals your passwords and crypto wallets, and uses your CPU to mine Monero. An attacker can silently take over your online accounts and drain your resources.

🔧 Prerequisites:

  • Visiting sites with malvertising
  • Downloading cracked software

⏱ Urgency: High urgency due to active exploitation targeting users of pirated software and those exposed to malvertising.

The npm Threat Landscape: Attack Surface and Mitigations (Updated July 15)

Palo Alto Unit 42

❓ Why Should I Care?
Yes, if you use npm packages from AsyncAPI or Bitwarden: recent campaigns have compromised these and other popular packages with malware that steals credentials and self-propagates.

🎯 Affected versions: @asyncapi/generator@3.3.1, @asyncapi/specs@6.11.2, @asyncapi/specs@6.11.2-alpha.1, @asyncapi/generator-helpers@1.1.1, @asyncapi/generator-components@0.7.1, @bitwarden/cli version 2026.4.0

🎭 In plain English:
Malicious actors have compromised several npm packages used in software development tools and password managers. If you install these packages, an attacker can steal your cloud provider credentials, CI/CD system access, and even backdoor every package you publish on npm.

🔧 Prerequisites:

  • Use of affected AsyncAPI or Bitwarden npm packages
  • Installation of the compromised versions

⏱ Urgency: High urgency due to active exploitation and potential for widespread credential theft and self-propagation.

Russian Global Webmail Espionage

Palo Alto Unit 42 | CVSS 9.8 | CVE-2025-66376

❓ Why Should I Care?
Yes, if you run Zimbra Collaboration Suite (ZCS) and haven't patched recently: zero-click phishing emails exploit a vulnerability to steal your credentials and data. Act now.

🎯 Affected versions: All versions of Zimbra Collaboration Suite (ZCS) prior to the latest patched version

🎭 In plain English:
Your webmail system can be silently hacked just by opening an email, no interaction needed. Attackers steal your login details and everything in your inbox without you knowing. Imagine finding out that someone has been reading all your emails for months.

🔧 Prerequisites:

  • Running unpatched Zimbra Collaboration Suite (ZCS)
  • Receiving a phishing email with embedded HTML

⏱ Urgency: High urgency due to active exploitation by Russian threat actors targeting critical sectors globally.

✅ Fixed in: Latest patched version of Zimbra Collaboration Suite (ZCS)

Pass the Passkey: A Novel Attack Surface in Passwordless Authentication

Palo Alto Unit 42

❓ Why Should I Care?
Yes, if you use Google Chrome on Windows with a TPM: attackers can steal your passkeys without needing your password or MFA. Actively exploited in the wild.

🎯 Affected versions: Google Chrome on Windows with TPM
Not affected: Other platforms, devices without TPM

🎭 In plain English:
Attackers can use malware to steal your passkeys, letting them log in as you without needing your password or MFA. For example, an attacker could access your emails, files, and accounts as if they were you.

🔧 Prerequisites:

  • Device compromised with malware

⏱ Urgency: High urgency due to active exploitation of these vulnerabilities.

🔵 INFO — Context & Announcements (71)

⚪ 220 low-priority items filtered.

🦅 Aggregated and triaged by Donna AI  |  Sources: 9 vendor feeds  |  CISA KEV