CVE-2026-20316

CVE: Cisco Secure Firewall Management Center Use of Hard-coded Password Vulnerability: Cisco Secure Firewall Management Center (FMC) formerly known as Firepower Management Center contains a use of hard-coded password vulnerability that could allow an unauthenticated, remote attacker to log in to an affected device using a low-privileged account to access sensitive data within the impacted systems.
CWE: CWE-259
Published: Cisco | Secure Firewall Management Center (FMC)
Link: https://www.cve.org/CVERecord?id=CVE-2026-20316

Threat Analysis (Cisco Secure Firewall Management Center Use of Hard-coded Password Vulnerability: Cisco Secure Firewall Management Center (FMC) formerly known as Firepower Management Center contains a use of hard-coded password vulnerability that could allow an unauthenticated, remote attacker to log in to an affected device using a low-privileged account to access sensitive data within the impacted systems.)

  1. Impact: The vulnerability compromises confidentiality by allowing an unauthenticated attacker to log into the Cisco Secure Firewall Management Center (FMC) and retrieve sensitive data. It may also affect integrity if the attacker alters configuration files, though availability is unlikely to be directly impacted.

  2. Affected Components & Attack Surface: The vulnerability resides in the Cisco Secure Firewall Management Center (FMC) software (any version with the hard‑coded password). The attack surface is the web‑based management interface, reachable remotely over the internet.

  3. Exploitation Prerequisites: No authentication is required; the attacker only needs the hard‑coded credentials and an internet connection. Minimal assumptions: the web interface is exposed and the hard‑coded account is not disabled.

  4. Detection Ideas & Indicators: Look for login events from unknown IPs, repeated failed attempts followed by a successful login, and unusual access to admin dashboards. MITRE ATT&CK T1078 (User Account Control) and CWE‑259 are relevant.

  5. Mitigations & Workarounds: Apply Cisco’s official patch to remove the hard‑coded password. Immediately rotate all FMC admin accounts, enforce strong password policies, and restrict remote access via VPN or firewall rules.

  6. Verification Steps: From an external host, attempt to log in using the known hard‑coded credentials; a successful session indicates the vulnerability is present. After applying the patch, repeat the login attempt; it should fail or be blocked.

  7. Attack‑Path Sequence:

    sequenceDiagram
 Attacker->>FMC: Remote request to login page
 FMC->>Attacker: Accepts hard‑coded credentials
 Attacker->>FMC: Sends credentials
 FMC->>Attacker: Authenticates and grants session
 Attacker->>FMC: Accesses protected data

CVE-2026-16812

CVE: Arista VeloCloud Orchestrator On-Prem OS Command Injection Vulnerability: Arista VeloCloud Orchestrator On-Prem contains an OS command injection vulnerability that may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator.
CWE: CWE-78
Published: Arista | VeloCloud Orchestrator
Link: https://www.cve.org/CVERecord?id=CVE-2026-16812

Threat Analysis (Arista VeloCloud Orchestrator On-Prem OS Command Injection Vulnerability: Arista VeloCloud Orchestrator On-Prem contains an OS command injection vulnerability that may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator.)

  1. Impact: Remote command injection allows an attacker to execute arbitrary OS commands on the VCO host, potentially exposing sensitive data (confidentiality), altering configuration files or services (integrity), and disrupting orchestrator operation (availability).

  2. Affected Components & Attack Surface: The VeloCloud Orchestrator On‑Prem OS (e.g., Linux kernel) exposed via a web API that interpolates user input into system commands; the vulnerability is reachable from the network (remote).

  3. Exploitation Prerequisites: Ability to send a malicious command via the vulnerable API endpoint; no additional privileges or local access required beyond a standard HTTP request.

  4. Detection Ideas & Indicators: Unexpected command lines in syslog or audit logs, SIEM alerts matching ATT&CK T1059.001, repeated failed auth attempts, and the CVE‑2026‑16812 identifier in security events.

  5. Mitigations & Workarounds: Deploy the vendor patch; disable the vulnerable API or restrict it to internal networks; enforce strict input validation/sanitization.

  6. Verification Steps: Use a tool like curl to send a crafted payload to the API endpoint and confirm command execution; alternatively, verify that the patched version is installed and the vulnerability ID is no longer present in logs.

  7. Attack‑Path Sequence:

    sequenceDiagram
 User->>VeloCloud Orchestrator: HTTP request with malicious input
 VeloCloud Orchestrator->>OS Command: Executes untrusted command
 OS Command->>VCO Host: Executes command
 VCO Host->>User: Data access / modification

CVE-2025-68686

CVE: Fortinet FortiOS Exposure of Sensitive Information to an Unauthorized Actor Vulnerability: Fortinet FortiOS contains an exposure of sensitive information to an unauthorized actor vulnerability. This may allow a remote unauthenticated attacker to bypass the patch developed for the symbolic link persistency mechanism observed in some post-exploit cases, via crafted HTTP requests. An attacker would need first to have compromised the product via another vulnerability, at filesystem level.
CWE: CWE-200
Published: Fortinet | FortiOS
Link: https://www.cve.org/CVERecord?id=CVE-2025-68686

Threat Analysis (Fortinet FortiOS Exposure of Sensitive Information to an Unauthorized Actor Vulnerability: Fortinet FortiOS contains an exposure of sensitive information to an unauthorized actor vulnerability. This may allow a remote unauthenticated attacker to bypass the patch developed for the symbolic link persistency mechanism observed in some post-exploit cases, via crafted HTTP requests. An attacker would need first to have compromised the product via another vulnerability, at filesystem level.)
  1. Impact: The vulnerability breaches confidentiality by allowing an unauthenticated attacker to read sensitive information; integrity and availability remain largely unaffected.
  2. Affected Components & Attack Surface: FortiOS web interface handling HTTP requests, specifically the symbolic link persistency mechanism; remote, unauthenticated access.
  3. Exploitation Prerequisites: The product must already be compromised at the filesystem level; a crafted HTTP request is required to trigger disclosure.
  4. Detection Ideas & Indicators: Logs of HTTP payloads containing the exploit payload, ATT&CK T1071.001, high request rate to the web interface.
  5. Mitigations & Workarounds: Deploy the latest FortiOS patch, disable symbolic link persistency, and restrict HTTP access to trusted networks only.
  6. Verification Steps: Use curl to send the known exploit payload to the web interface and confirm sensitive data is disclosed; verify that the patch version is applied.
  7. Attack-Path Sequence: 
    sequenceDiagram
 Attacker->>FortiOS: Sends crafted HTTP request (post‑exploitation)
 FortiOS->>Web Interface: Processes request, disables symbolic link
 FortiOS->>Attacker: Returns sensitive data

CVE-2026-50522

CVE: Microsoft SharePoint Deserialization of Untrusted Data Vulnerability : Microsoft SharePoint contains a deserialization of untrusted data vulnerability which could allow an unauthorized attacker to execute code over a network.
CWE: CWE-502
Published: Microsoft | SharePoint
Link: https://www.cve.org/CVERecord?id=CVE-2026-50522

Threat Analysis (Microsoft SharePoint Deserialization of Untrusted Data Vulnerability : Microsoft SharePoint contains a deserialization of untrusted data vulnerability which could allow an unauthorized attacker to execute code over a network.)
  1. Impact: Remote code execution (RCE) on the SharePoint server can lead to full confidentiality breach (data theft), integrity compromise (malicious modifications), and availability denial (service disruption).
  2. Affected Components & Attack Surface: SharePoint Server 2022/2019 runtime, SPFx components, HTTP/HTTPS request paths; attack surface is remote network exposure.
  3. Exploitation Prerequisites: Ability to send a crafted untrusted data payload (e.g., oversized JSON/XML) to a vulnerable SharePoint endpoint; no additional privileges needed beyond network access.
  4. Detection Ideas & Indicators: Windows Event ID 4103 (SPFx error), ATT&CK T1059.004, anomalous large payloads in request logs, elevated memory usage, suspicious process creation.
  5. Mitigations & Workarounds: Apply Microsoft patch CVE‑2026‑50522, disable deserialization of untrusted data via SPFx configuration, use secure libraries, restrict remote script execution.
  6. Verification Steps: Send crafted payload to the endpoint, capture memory dump, confirm execution of attacker‑controlled code, and validate patch presence via Microsoft Update Catalog.
  7. Attack‑Path Sequence: 
    sequenceDiagram
 Attacker->>SharePoint: Send crafted payload
 SharePoint->>SharePoint: Deserialize payload
 SharePoint->>Attacker: Execute code
 Attacker->>Attacker: Gain RCE

CVE-2026-16232

CVE: Check Point SmartConsole Improper Authentication Vulnerability: Check Point SmartConsole contains an improper authentication vulnerability which could allow an unauthenticated remote attacker to obtain an application login token and use it to authenticate with full administrative privileges.
CWE: CWE-287
Published: Check Point | SmartConsole
Link: https://www.cve.org/CVERecord?id=CVE-2026-16232

Threat Analysis (Check Point SmartConsole Improper Authentication Vulnerability: Check Point SmartConsole contains an improper authentication vulnerability which could allow an unauthenticated remote attacker to obtain an application login token and use it to authenticate with full administrative privileges.)

  1. Impact: Unauthorized retrieval of an application login token grants full administrative access to the Check Point SmartConsole, enabling complete confidentiality breach, potential integrity manipulation, and availability disruption of the management system.

  2. Affected Components & Attack Surface: Vulnerable SmartConsole software versions (≤ v 2.0.5‑pre‑patch) exposed via HTTP/HTTPS login endpoint; only the web server is the attack surface.

  3. Exploitation Prerequisites: Unauthenticated remote attacker can send a crafted request to the login endpoint; no additional credentials or local access required beyond network reachability.

  4. Detection Ideas & Indicators: Log entries showing successful token generation (e.g., “Token retrieved” in SmartConsole logs), ATT&CK T1078 (User Account Management), CVE‑2026‑16232 ID in audit trails.

  5. Mitigations & Workarounds: Deploy the latest patched SmartConsole release, disable remote login (use VPN), enforce MFA for console access, and restrict web server exposure.

  6. Verification Steps: Connect to vulnerable instance, issue a GET request to the login endpoint with a valid request token; capture the resulting admin token and compare its value/permissions to the expected admin token.

  7. Attack‑Path Sequence:

sequenceDiagram
    Attacker->>SmartConsole: Send crafted login request (no auth)
    SmartConsole->>Auth Service: Process request, generate admin token
    Auth Service-->>SmartConsole: Return token to attacker
    Attacker-->>SmartConsole: Use token to authenticate as admin
    SmartConsole->>System: Execute privileged commands