“CISA”

Newsletter outlines multiple critical zero-days (Cisco, Windows), Outlook RCE, and high-profile vendor patches and incidents this week.

Gunra actors exploit Fortinet vulnerabilities to exfiltrate large volumes of Microsoft service data, targeting critical infrastructure.

CISA ordered federal agencies to patch a Microsoft bug exploited in a long-running DPRK job-application campaign within two weeks.

Widening attacks against US water systems continue, targeting Internet-exposed PLCs; attribution reports suggest Iran-linked activity in some cases.

CISA confirms active exploitation of a high-severity Microsoft SharePoint RCE now used in ransomware intrusions and lateral movement.

Critical unauthenticated RCE CVE-2026-63077 in JetBrains TeamCity is being actively exploited for remote code execution.

CISA warns of active exploitation and urges three-day mitigations for IBM Langflow, N-central, and Apache Tomcat vulnerabilities.

CISA warns of rising attacks on internet-exposed PLCs in water/wastewater systems and recommends removing public exposure.

CISA urges water and wastewater utilities to lock down internet-exposed controllers after intrusions impacted dozens of Minnesota systems.

Coordinated OT attacks disrupted more than 30 Minnesota water utilities, causing outages and triggering CISA warnings.

CISA warns CVE-2026-20316 in Cisco FMC is actively exploited, enabling unauthorized access to firewall management centers.

U.S. and Australian guidance from CISA advises critical infrastructure to prepare for isolating OT systems during cyber incidents.

Arista's on-prem VeloCloud Orchestrator suffers active command-injection zero-day exploited in the wild; apply vendor patches immediately.

Rockwell fixed code-execution vulnerabilities in Arena simulation software that could be weaponized against industrial organizations.

Russian state-linked actors exploited a Zimbra zero-day to steal emails and bypass MFA, prompting urgent patching and mitigations.

Russian intelligence hijacks IP cameras across Europe and Ukraine to monitor military logistics and transport routes.

ServiceNow AI platform CVE-2026-6875 is being exploited for remote code execution days after disclosure.

A critical SharePoint vulnerability is being exploited in the wild shortly after disclosure, allowing remote authenticated code execution.