By SAFE Threat Research Team
This week’s exploitation activity is concentrated around known vulnerabilities affecting exposed enterprise platforms, with attackers targeting systems that provide access to sensitive data, privileged administration, and business-critical infrastructure.
PTC Windchill and FlexPLM are being exploited for data theft and extortion, including the deployment of web shells against internet-facing systems. Zimbra, Roundcube, MDaemon, and SOGo remain targets of cyber espionage campaigns focused on mailbox access and sensitive communications. Meanwhile, compromised GitHub repositories and GitHub Actions infrastructure are being used to scan for and exploit vulnerable cPanel and WHM servers, turning legitimate development infrastructure into a mechanism for distributed exploitation.
Active exploitation also extends to security management and SD-WAN infrastructure, including Check Point management systems and VeloCloud Orchestrator deployments. Compromise of these platforms has broader implications because they manage security policies, network configurations, credentials, and downstream infrastructure.
For security teams, the priority this week is to identify where confirmed exploitation intersects with reachable, high-value systems and to account for the potential post-compromise impact when determining remediation urgency.
Vulnerability Landscape
This week, NVD published 2,996 CVEs, including 1,546 rated critical or high severity. Public exploits or proof-of-concept code are available for 361 vulnerabilities, while 19 carry stronger weaponized-exploit signals.
The numbers are substantial, but disclosure volume alone says little about which vulnerabilities are likely to drive near-term risk. The useful narrowing happens when public exploitability and weaponization are combined with evidence that attackers are already using the vulnerability against real systems.
Trending Vulnerabilities
This week, 22 CVEs showed confirmed exploitation activity, including just three newly published vulnerabilities and 19 pre-existing CVEs.
That represents a sharp reversal from last week, when eight of 12 exploited CVEs were newly published. Rather than exploitation being driven primarily by fresh disclosures, this week shows attackers returning to vulnerabilities with establishedexploit paths across systems that remain exposed or insufficiently patched.
Top CVEs to Watch
PTC Windchill and FlexPLM CVE-2026-12569: Active Exploitation Escalates into Data Theft and Extortion
CVE-2026-12569 is a critical remote code execution vulnerability affecting PTC Windchill and FlexPLM. The flaw involves improper input validation and deserialization of untrusted data, allowing unauthenticated attackers to execute arbitrary code on vulnerable systems. Active exploitation was confirmed in June, and the vulnerability was subsequently added to the CISA Known Exploited Vulnerabilities (KEV) catalog.
The threat has since moved beyond opportunistic exploitation. Attackers are targeting internet-exposed Windchill and FlexPLM instances, deploying JSP web shells for persistent command execution and exfiltrating sensitive product and engineering data. Recent extortion activity has been linked to Cl0p, with victims receiving extortion emails after data was stolen from compromised environments.
The campaign raises the priority of vulnerable PLM systems because they can contain intellectual property, engineering designs, product data, and other information with direct extortion value. Organizations should patch affected deployments immediately and investigate previously exposed systems for web shells, unexpected command execution, and suspicious outbound data transfers.
Zimbra, Roundcube, MDaemon, and SOGo: TA458 Exploits Webmail Platforms for Cyber Espionage
Webmail platforms remain a recurring target for espionage operations, with attackers exploiting XSS vulnerabilities across Zimbra, Roundcube, MDaemon, and SOGo. The relevant vulnerabilities include CVE-2025-27915 in Zimbra, CVE-2023-43770 and CVE-2024-42009 in Roundcube, CVE-2025-3929 in MDaemon, and the newer CVE-2026-8496 in SOGo. The flaws differ technically, but each can allow malicious content delivered through email or calendar invitations to execute JavaScript inside an authenticated webmail session.
TA458 continues to exploit this attack surface as part of Operation RoundPress, targeting government, military, telecommunications, technology, and other organizations. The group uses so-called half-click exploitation, in which the victim does not need to open an attachment or follow a malicious link; viewing the crafted message in a vulnerable webmail client may be sufficient. A successful compromise is followed by the deployment of the SpyPress JavaScript framework to collect emails, credentials, contacts, and other mailbox data.
A separate espionage campaign involving LAUNDRY BEAR reinforces the same risk. CVE-2025-66376, a stored XSS vulnerability in Zimbra Collaboration Suite, was exploited as a zero-day against government and defense-related organizations. The exploit can trigger when a malicious email is viewed, enabling the collection of mailbox data and other information from the authenticated session.
cPanel and WHM CVE-2026-41940: Compromised GitHub Workflows Turn into Distributed Exploitation Infrastructure
CVE-2026-41940 is a critical authentication vulnerability in the cPanel & WHM session-management layer. Insufficient sanitization in a single session-file write path can allow a specially crafted request to create a session that is incorrectly treated as authenticated, granting access without valid credentials. The vulnerability has been actively exploited and is listed in CISA KEV.
What makes the vulnerability particularly relevant this week is how attackers are scaling exploitation. Compromised GitHub repositories have been modified with malicious GitHub Actions workflows that use hosted runners to scan for vulnerable cPanel and WHM servers, exploit CVE-2026-41940, and collect credentials and secrets from compromised environments. Observed targeting includes SSH credentials, cloud keys, API tokens, database credentials, and other sensitive server data.
The activity is notable because the compromised repositories are not simply being used to distribute malicious packages. Instead, trusted CI/CD infrastructure is being repurposed as a distributed attack infrastructure against unrelated internet-facing systems. Organizations should verify that cPanel and WHM servers are up to date, use available compromise-detection tooling on systems that were exposed while vulnerable, and review GitHub repositories and workflows for unauthorized changes.
Check Point CVE-2026-16232: Authentication Bypass Exposes the Security Management Plane
CVE-2026-16232 is a critical authentication bypass affecting the SmartConsole login process used with Check Point Security Management and Multi-Domain Management. In affected configurations, an unauthenticated remote attacker can obtain an application login token and authenticate with administrative privileges, potentially allowing them to modify security policies and configurations.
The vulnerability has been exploited in the wild against a limited number of organizations, in which the management environment was directly exposed to the internet without IP restrictions. That deployment condition is important: exploitation requires network access to the management server and exposure of the relevant administrative interface.
The impact extends beyond the compromise of a single server. Administrative access to a security management platform can place firewall policies, gateway configurations, and other defensive controls within an attacker’s reach. Organizations should install the available hotfix, restrict management access to trusted administrative networks, and review affected systems for unauthorized logins or unexpected policy and configuration changes.
Arista VeloCloud Orchestrator CVE-2026-16812: Exploited Zero-Day Targets SD-WAN Management
CVE-2026-16812 is a maximum-severity OS command injection vulnerability affecting VeloCloud Orchestrator On-Prem. The flaw exposes privileged internal functionality that was not intended to be remotely accessible, allowing an unauthenticated attacker with network access to the VCO web interface to affect the orchestrator host and the data it manages.
The vulnerability was disclosed on July 27 and is known to be actively exploited, making it one of the most significant newly published in-the-wild vulnerabilities in this week’s dataset. On-premises VCO deployments are exposed by default, although restricting the web interface to trusted administrative networks can reduce practical exposure. Hosted and dedicated VCO environments were patched ahead of public disclosure.
Because the orchestrator manages enterprise SD-WAN infrastructure and can contain configuration data, credentials, certificates, and device information, compromise can provide substantial visibility and control over the managed environment. Organizations operating affected on-premises versions should apply the fixed releases immediately and review web, application, and system logs for unexpected command execution, configuration changes, outbound connections, or access to sensitive orchestrator data.
Langflow CVE-2026-0770: Unauthenticated RCE Moves into Confirmed Exploitation
CVE-2026-0770 is a critical remote code execution vulnerability affecting Langflow. The flaw exists in the handling of the exec_globals parameter within the code-validation functionality, allowing an unauthenticated remote attacker to execute arbitrary code on an affected installation.
Although the vulnerability was disclosed earlier in 2026, and public exploit code has been available, confirmed exploitation has now pushed it into the KEV catalog. Its combination of unauthenticated network access, arbitrary code execution, and readily available exploitation techniques makes exposed Langflow deployments particularly attractive targets.
Organizations should identify internet-accessible Langflow deployments, apply available fixes or vendor-recommended mitigations, restrict access where immediate remediation is not possible, and investigate systems that remained exposed for evidence of unauthorized code execution or follow-on activity.
Zimbra Collaboration Suite CVE-2025-66376: LAUNDRY BEAR Exploits Zero-Day to Steal Emails from Western Organizations
CVE-2025-66376 is a stored cross-site scripting (XSS) vulnerability affecting Zimbra Collaboration Suite (ZCS) versions 10 before 10.0.18 and 10.1 before 10.1.13. The flaw allows attackers to abuse CSS @import directives embedded in HTML email messages to execute arbitrary JavaScript within the Classic UI when a victim simply views a malicious email. Successful exploitation enables attackers to hijack authenticated sessions, access sensitive mailbox data, and establish persistent access to compromised accounts.
The Russian state-sponsored threat actor LAUNDRY BEAR has actively exploited this vulnerability since at least July 2025 in cyber espionage campaigns targeting Western government and commercial organizations. Unlike traditional phishing attacks, the campaign requires no user interaction beyond viewing a malicious email, allowing attackers to exfiltrate up to 90 days of email communications, harvest Global Address List (GAL) data, and maintain persistent access to victim accounts.
CVE-2025-66376 has been added to the CISA Known Exploited Vulnerabilities (KEV) catalog, and organizations should immediately upgrade to supported Zimbra versions, prioritize internet-facing deployments, and investigate for indicators of compromise, including unauthorized mailbox access, suspicious session activity, and persistence mechanisms established through compromised accounts.
From Exploitation Signals to Remediation Priorities
This week, 19 of the 22 CVEs with confirmed exploitation signals were pre-existing vulnerabilities, reinforcing that remediation priority should not be determined by disclosure date alone. Vulnerabilities remain relevant when affected systems are exposed, exploitable, or provide access to high-value enterprise functions.
Security teams should focus on:
- Actively exploited vulnerabilities on reachable systems, particularly those enabling remote code execution, authentication bypass, or privileged access.
- Management and control-plane infrastructure, where compromise can expose credentials, configurations, security policies, or downstream systems.
- Compromise assessment alongside patching when systems were exposed during an active exploitation window, including checks for web shells, persistence, unauthorized sessions, credential theft, and data exfiltration.
- Reviewing CI/CD environments for abuse, particularly repositories and GitHub Actions workflows that could be modified and repurposed as attack infrastructure.
This is where a broader CTEM approach becomes important. SAFE CTEM brings exposure data into a unified view, enriches findings with threat and business context, identifies and prioritizes exploitable exposures, validates whether those exposures can actually be used, and connects prioritized findings to remediation workflows. Continuous validation and risk tracking then help teams determine whether actions taken have reduced the underlying exposure rather than simply closed a ticket.
The result is a continuous process spanning discovery, prioritization, validation, mobilization, and measurable risk reduction, rather than a vulnerability program centered only on finding and patching CVEs.
