CVE-2026-20316

CVE: Cisco Secure Firewall Management Center Use of Hard-coded Password Vulnerability: Cisco Secure Firewall Management Center (FMC) formerly known as Firepower Management Center contains a use of hard-coded password vulnerability that could allow an unauthenticated, remote attacker to log in to an affected device using a low-privileged account to access sensitive data within the impacted systems.
CWE: CWE-259
Published: Cisco | Secure Firewall Management Center (FMC)
Link: https://www.cve.org/CVERecord?id=CVE-2026-20316

Threat Analysis (Cisco Secure Firewall Management Center Use of Hard-coded Password Vulnerability: Cisco Secure Firewall Management Center (FMC) formerly known as Firepower Management Center contains a use of hard-coded password vulnerability that could allow an unauthenticated, remote attacker to log in to an affected device using a low-privileged account to access sensitive data within the impacted systems.)

  1. Impact: Unauthenticated remote login to the Cisco Secure Firewall Management Center (FMC) can expose administrative dashboards, configuration files, and potentially sensitive operational data, compromising confidentiality. It does not directly alter device state or disrupt service, so integrity and availability remain largely intact.

  2. Affected Components & Attack Surface: The vulnerability resides in the FMC web interface (HTTP/HTTPS endpoints). The attack surface is remote (no local access required) and targets the login process for a low‑privileged service account.

  3. Exploitation Prerequisites: An attacker must be able to reach the FMC’s web server from the Internet, the low‑privileged account must exist on the firewall, and no authentication mechanisms (e.g., password protection) are enforced on the login endpoint.

  4. Detection Ideas & Indicators: Look for log entries showing successful login attempts from external IP addresses to /login or /auth, mismatched user‑agent strings, or repeated failed attempts that transition to a successful login. MITRE ATT&CK T1104 (Exploit Public‑Facing Application) is relevant.

  5. Mitigations & Workarounds: Apply Cisco’s official patch for CVE‑2026‑20316, enforce strong password policies for service accounts, disable remote management interfaces, and segment the FMC network from the Internet.

  6. Verification Steps: From an external host, issue a curl -X POST -d "username=lowpriv&password=hardcoded" https://fmc.example.com/login and observe if a dashboard is returned. A successful login confirms the vulnerability; the absence of a response indicates it is mitigated.

  7. Attack‑Path Sequence:

    sequenceDiagram
 Attacker->>FMC: Send HTTP POST to /login with hard‑coded credentials
 FMC->>FMC: Authenticate against low‑privileged account
 FMC->>Attacker: Return authenticated session cookie
 Attacker->>FMC: Use cookie to access admin dashboards

CVE-2026-16812

CVE: Arista VeloCloud Orchestrator On-Prem OS Command Injection Vulnerability: Arista VeloCloud Orchestrator On-Prem contains an OS command injection vulnerability that may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator.
CWE: CWE-78
Published: Arista | VeloCloud Orchestrator
Link: https://www.cve.org/CVERecord?id=CVE-2026-16812

Threat Analysis (Arista VeloCloud Orchestrator On-Prem OS Command Injection Vulnerability: Arista VeloCloud Orchestrator On-Prem contains an OS command injection vulnerability that may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator.)

  1. Impact: The vulnerability allows a remote attacker to execute arbitrary OS commands on the VeloCloud Orchestrator, potentially reading logs or data (confidentiality breach), altering system settings or commands (integrity breach), and causing crashes or denial of service (availability breach).

  2. Affected Components & Attack Surface: VeloCloud Orchestrator running on an on‑prem Linux host; the web interface is exposed to the internet, providing a remote command injection surface (CWE‑78).

  3. Exploitation Prerequisites: Ability to send HTTP GET/POST requests to the orchestrator’s web endpoint; no additional privileges needed beyond network access.

  4. Detection Ideas & Indicators: Unexpected command execution in OS or orchestrator logs; HTTP request payloads containing suspicious strings; crashes or error messages on the VCO host; MITRE ATT&CK T1105 (Command and Scripting Interpreter) and CWE‑78.

  5. Mitigations & Workarounds: Apply the latest OS and VeloCloud Orchestrator patches; disable remote web services or restrict them to localhost only; enforce strict network segmentation.

  6. Verification Steps: Send a crafted HTTP request with a command‑injection payload; observe whether the command runs on the host. Confirm the vulnerability is mitigated by verifying the patch is installed and no injection occurs.

  7. Attack‑Path Sequence:

    sequenceDiagram
 Attacker->>WebApp: HTTP request with injection
 WebApp->>OS: Exec command with injection
 OS->>Orchestrator: Exec command
 note right of OS: Command injection

CVE-2025-68686

CVE: Fortinet FortiOS Exposure of Sensitive Information to an Unauthorized Actor Vulnerability: Fortinet FortiOS contains an exposure of sensitive information to an unauthorized actor vulnerability. This may allow a remote unauthenticated attacker to bypass the patch developed for the symbolic link persistency mechanism observed in some post-exploit cases, via crafted HTTP requests. An attacker would need first to have compromised the product via another vulnerability, at filesystem level.
CWE: CWE-200
Published: Fortinet | FortiOS
Link: https://www.cve.org/CVERecord?id=CVE-2025-68686

Threat Analysis (Fortinet FortiOS Exposure of Sensitive Information to an Unauthorized Actor Vulnerability: Fortinet FortiOS contains an exposure of sensitive information to an unauthorized actor vulnerability. This may allow a remote unauthenticated attacker to bypass the patch developed for the symbolic link persistency mechanism observed in some post-exploit cases, via crafted HTTP requests. An attacker would need first to have compromised the product via another vulnerability, at filesystem level.)

  1. Impact: Unauthorized disclosure of sensitive data (e.g., configuration files, certificates) compromises Confidentiality; integrity and availability are not directly affected.

  2. Affected Components & Attack Surface: FortiOS web interface (HTTP/HTTPS), symbolic‑link persistency mechanism; exposure via remote, unauthenticated HTTP request. No specific version listed.

  3. Exploitation Prerequisites: A prior filesystem‑level compromise must exist; then an attacker sends a crafted HTTP request to trigger the exposure. No additional privileges needed beyond the initial compromise.

  4. Detection Ideas & Indicators: HTTP/HTTPS logs showing unexpected GET/POST to / or similar paths; presence of symbolic‑link entries in config; MITRE ATT&CK T1190 (Exploit Public‑Facing Application); repeated anomalous request patterns.

  5. Mitigations & Workarounds: Deploy any FortiOS patch that addresses CVE‑2025‑68686; disable or secure symbolic‑link persistency; restrict web‑interface access to authenticated users only.

  6. Verification Steps: From a remote host, issue a crafted HTTP request to the FortiOS web UI and observe whether confidential output is returned; also verify that no symbolic‑link entries appear in the running config.

  7. Attack‑Path Sequence:

    sequenceDiagram
 Attacker->>FortiOS: Initial filesystem compromise
 Attacker->>FortiOS: Crafted HTTP request
 FortiOS->>FortiOS: Executes symbolic‑link logic
 FortiOS->>Attacker: Sensitive data leak

CVE-2026-50522

CVE: Microsoft SharePoint Deserialization of Untrusted Data Vulnerability : Microsoft SharePoint contains a deserialization of untrusted data vulnerability which could allow an unauthorized attacker to execute code over a network.
CWE: CWE-502
Published: Microsoft | SharePoint
Link: https://www.cve.org/CVERecord?id=CVE-2026-50522

Threat Analysis (Microsoft SharePoint Deserialization of Untrusted Data Vulnerability : Microsoft SharePoint contains a deserialization of untrusted data vulnerability which could allow an unauthorized attacker to execute code over a network.)

  1. Impact: Remote code execution can compromise confidentiality (data theft), integrity (system tampering), and availability (service disruption).

  2. Affected Components & Attack Surface: SharePoint Server (SharePoint 2013‑2022), exposed via HTTP(S) to external users; remote exploitation only.

  3. Exploitation Prerequisites: An attacker must send untrusted data (e.g., crafted XML/JSON) to a SharePoint server endpoint; no special privileges required beyond network access.

  4. Detection Ideas & Indicators: SharePoint error logs showing “Deserialization error”, ATT&CK T1195 (Deserialization of Untrusted Data), unexpected file writes or process creations.

  5. Mitigations & Workarounds: Deploy latest Microsoft security update, disable external publishing, enforce least‑privilege SharePoint roles, or block external XML/JSON uploads.

  6. Verification Steps: Send a malicious payload (e.g., <xml><data>test</data></xml>) to the vulnerable endpoint; observe remote command execution or abnormal log entries confirming deserialization abuse.

  7. Attack-Path Sequence:

    sequenceDiagram
 User->>SharePoint Server: Send crafted untrusted data (XML/JSON)
 SharePoint Server->>SharePoint Server: Deserialize data
 SharePoint Server->>Attacker: Execute remote code

CVE-2026-16232

CVE: Check Point SmartConsole Improper Authentication Vulnerability: Check Point SmartConsole contains an improper authentication vulnerability which could allow an unauthenticated remote attacker to obtain an application login token and use it to authenticate with full administrative privileges.
CWE: CWE-287
Published: Check Point | SmartConsole
Link: https://www.cve.org/CVERecord?id=CVE-2026-16232

Threat Analysis (Check Point SmartConsole Improper Authentication Vulnerability: Check Point SmartConsole contains an improper authentication vulnerability which could allow an unauthenticated remote attacker to obtain an application login token and use it to authenticate with full administrative privileges.)

  1. Impact: Confidentiality, Integrity, and Availability are compromised; an unauthenticated attacker can obtain an admin‑level application login token, enabling full system takeover and potential data exfiltration.

  2. Affected Components & Attack Surface: SmartConsole server running vulnerable releases; remote web interface (HTTP/HTTPS) is the attack surface.

  3. Exploitation Prerequisites: No authentication required; the attacker must reach the SmartConsole endpoint and send a crafted request to generate a token.

  4. Detection Ideas & Indicators: Logs of SmartConsole error 500, ATT&CK T1190 (Application Layer Protocol: Path Traversal), and unusual admin‑token login attempts from external IPs.

  5. Mitigations & Workarounds: Apply the vendor patch, disable remote admin, rotate tokens, and enforce MFA or token expiration policies.

  6. Verification Steps: Capture the token via exploitation, use it to log into admin services, and confirm successful access; verify the same token is rejected after applying the patch.

  7. Attack-Path Sequence:

    sequenceDiagram
 Attacker->>SmartConsole: HTTP request
 SmartConsole->>Auth Engine: token generation
 Auth Engine->>Attacker: token
 Attacker->>Admin Services: admin login with token
 Admin Services->>Attacker: success