When Exploitation Precedes Disclosure: A Week of Zero-Days, Backdoors, and Botnets

This week leaned toward pre-disclosure exploitation, with adversaries reaching production systems before patches or advisories caught up, ranging from hard-coded credentials in security appliances to browser-resident implants inside a victim's inbox. Ransomware crews, botnet operators, and state-aligned actors converged on one playbook: get in early, and hold on.  

CISA added three vulnerabilities to its KEV catalog. Leading was a hard-coded password flaw in Cisco Secure Firewall Management Center, exploited as a zero-day for unauthenticated login through a static account. A command injection flaw in Arista VeloCloud Orchestrator followed, weaponized to seize privileged functionality and cascade control across downstream SD-WAN devices. A Fortinet flaw already patched in 2025 rounded out the list.

Beyond KEV, Fastjson faced active exploitation as a critical deserialization weakness enabled unauthenticated RCE against Spring Boot deployments. A WordPress video-embedder plugin was caught harboring a deliberately planted backdoor, a supply chain compromise granting full administrative control across thousands of sites via a single crafted request.

The threat-actor landscape stayed busy. XLAB tracked the Dysphoria botnet past 200,000 nodes with blockchain-based C2, Russia-aligned TA488 deployed the stealthy OWAReaper implant via an OWA zero-day, and Cl0p affiliates exploited a PTC Windchill/FlexPLM zero-day for RCE and double extortion.

Key points:

• CISA added three actively exploited vulnerabilities to its KEV catalog  
• Fastjson and a backdoored WordPress video-embedder plugin faced active exploitation
• The Dysphoria botnet grew past 200,000 nodes, chaining IoT exploits and weak credentials  
• Russia-aligned TA488 deployed the stealthy browser-resident OWAReaper implant through an Outlook Web Access zero-day
• Cl0p affiliates exploited a PTC Windchill and FlexPLM zero-day for unauthenticated RCE

Several high-impact vulnerabilities are currently trending across the cybersecurity community, demanding immediate attention and patch prioritization. Monitoring these emerging and widely discussed threats provides valuable insights, enabling organizations to make informed security decisions and strengthen their overall defense posture.

CVE-2026-16723 - Remote Code Execution vulnerability in Fastjson

A Remote Code Execution vulnerability in Fastjson allowed unauthenticated remote attackers to execute arbitrary code on systems running versions 1.2.68 through 1.2.83. The flaw combined two weaknesses in Fastjson 1.x's type-checking system, where a malicious @type value pointing to a nested JAR URL pattern triggered the @JSONType annotation trust signal and loaded attacker-controlled bytecode directly into memory during deserialization. Exploitation affected Spring Boot executable fat-JAR deployments exclusively, requiring a network-reachable endpoint that processed attacker-controlled JSON and SafeMode left at its disabled default, while functioning consistently across Spring Boot 2.x, 3.x, and 4.x on JDK 8, 11, 17, and 21. ThreatBook confirmed active exploitation in the wild following public disclosure, deploying detection signatures on July 20, 2026, and identified two paths: full remote code execution on JDK 8 fat-JAR deployments via jar:http handlers, and SSRF plus remote JAR fetch on embedded Tomcat deployments. Imperva's telemetry revealed targeting across Financial Services, Healthcare, Computing, Retail, and Business sectors, predominantly US-based with emerging activity in Singapore and Canada, though no vendor disclosed attack counts, named victims, or confirmed compromises. Given Alibaba confirmed Fastjson 1.x reached end-of-life with no official patch planned, organizations were advised to migrate to Fastjson 2.x, with interim mitigation through SafeMode, the restricted 1.2.83_noneautotype build, or perimeter filtering of malicious payloads.  

CVE-2026-16812 - Command Injection vulnerability in Arista VeloCloud Orchestrator

A Command Injection vulnerability in Arista VeloCloud Orchestrator On-Prem allowed a remote unauthenticated attacker to access privileged internal functionality and impact the VCO host, compromising the confidentiality, integrity, and availability of the orchestrator and the data it managed. A feature intended solely for internal use became remotely accessible, exposing the entire host and all downstream managed VeloCloud Edge devices, enabling credential rotation, unauthorized configuration changes, and device takeover across the victim's SD-WAN infrastructure. Arista acknowledged external discovery and active exploitation in the wild while withholding disclosure timelines and the number of affected customers and identified three attacking IP addresses (8.19.75[.]217, 206.72.242[.]124, and 206.72.242[.]162) that organizations were instructed to block and audit against their logs. Arista patched the vulnerability in versions 5.2.3.14, 6.1.3.4, 6.4.2.4, and 7.0.0.1, and this vulnerability was added to the CISA KEV catalog.

CVE-2026-18072 - Authentication Bypass vulnerability in The Advanced Responsive Video Embedder for Rumble, Odysee, YouTube, Vimeo, Kick plugin for Wordpress

An Authentication Bypass vulnerability in the Advanced Responsive Video Embedder for Rumble, Odysee, YouTube, Vimeo, Kick plugin for WordPress allowed an unauthenticated attacker to bypass authentication entirely in version 10.8.7. According to Wordfence, the autonomous AI agent Wordfence PRISM identified the critical backdoor on July 28, 2026, less than two hours after malicious code was introduced, revealing a deliberate supply chain attack rather than an accidental coding mistake, engineered to grant unauthenticated attackers full administrative access across roughly 20,000 active installations. The backdoor registered a function on WordPress's init hook at priority 1 to execute before any authentication logic, reading an attacker-supplied token from the wplogin or wpm parameter and comparing it against a hardcoded SHA-256 hash that served as a universal master credential requiring no nonce, capability check, or user interaction. Once validated, the backdoor enumerated administrator accounts while deliberately filtering out attacker-seeded usernames beginning with wpsvc, developer, dev_, or wp_update_, selected a random remaining admin, exfiltrated the site URL and chosen username to a C2 endpoint at fontswp.com, and established full persistent authentication through a long-lived cookie that redirected the attacker into the admin dashboard. The exploit executed as a single stateless HTTP GET request carrying the known token, with the professionally concealed implementation confirming intent for supply chain compromise rather than accidental flaw. WordPress.org closed the plugin for downloads and confirmed the malicious release had not reached existing installations, though Wordfence urged treating every site running the affected version as potentially compromised amid the risk of active exploitation and recommended immediate removal, as no fixed version exists.

CVE-2026-20316 - Use of Hard-coded Password vulnerability in Cisco Secure Firewall Management Center (FMC)

Use of Hard-coded Password vulnerability in Cisco Secure Firewall Management Center (FMC) formerly known as Firepower Management Center, allowed an unauthenticated, remote attacker to log in to an affected device using a low-privileged account and access sensitive data. The vulnerability stemmed from the presence of static user credentials for a low-privileged account, exploitable by using that account to authenticate to an affected system. Actively exploited as a zero-day, the flaw drew Cisco's awareness in July 2026, though details on when the attacks began, attribution, and the organizations targeted were withheld, while Jimi Sebree of Horizon3.ai received credit for reporting it. Cisco released hot fixes for Secure FMC releases 7.0, 7.2, 7.4, 7.6, 7.7, and 10.0 with no available workarounds, and the vulnerability was added to the CISA KEV catalog.

‍CVE-2025-68686 - Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Fortinet FortiOS

An Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Fortinet FortiOS allowed a remote unauthenticated attacker to bypass the patch developed for the symbolic link persistency mechanism through crafted HTTP requests. The flaw functioned as a secondary exploitation vector, requiring prior filesystem-level compromise through another vulnerability and affecting only deployments with SSL-VPN enabled, where improper HTTP request handling exposed sensitive data without elevated privileges or user interaction. Successful exploitation carried high confidentiality impact, extending an initial filesystem foothold into sustained unauthorized visibility of device secrets and configurations after patching. Fortinet released fixes requiring FortiOS 7.6 deployments to upgrade to 7.6.2 or above and 7.4 deployments to 7.4.7 or above, while the 7.2, 7.0, and 6.4 branches had no fixed release and required migration to a supported version, with a virtual patch (FG-VD-60389.0day) available through FMWP database update 26.033 for interim protection. The vulnerability was added to the CISA KEV catalog.

Cytellite telemetry captured active exploit attempts and mass scanning campaigns against exposed services globally. The data highlights which vulnerabilities are under attack and provides source IPs and payloads to authorized teams for detailed threat analysis and validation.

Active malware campaigns exploited specific vulnerabilities to deliver payloads and carry out post-exploitation actions. Each targeted vulnerability is proactively monitored, manually analysed, and mapped to MITRE ATT&CK tactics and techniques. Insights are derived from the LOVI vulnerability intelligence platform, which aggregates and curates data from multiple sources, OSINT groups, blogs, and data leak sites.

XLAB tracks Dysphoria botnet exploiting IoT vulnerabilities

According to XLAB, a joint report with China's CNCERT tracked an emerging botnet family named Dysphoria that has exceeded 200,000 bots since the first quarter of 2026, evolving rapidly across jackskid and fbot variants while introducing blockchain-based ENS/SNS domain C2 resolution and converting victim hosts into C2 relay/proxy nodes to resist takedown. The malware disguised its process as libdalvikengine.so and protected strings with a customized RC4 algorithm augmented by LCG-based S-box shuffling and LFSR stepping, while retrieving C2 infrastructure by querying TXT records on domains such as burrberry.eth, ukranianhorseriding.eth, and 24carnforth2merseyside.sol, extracting a real IPv4 address (144.31.38(.)215) hidden within fake IPv6 strings before pulling relay lists via HTTP GET requests to port 9000. A dedicated relay variant stripped all DDoS functionality, used automated UPnP to map 155 ports for NAT traversal, and performed bidirectional epoll-based traffic relaying while reporting JSON health status to login.trees4sale(.)net:9000 every four seconds. Dysphoria propagated through Telnet/SSH weak-password brute-forcing and known IoT RCE exploits against routers, gateways, and cameras, confirming 4,401 active domestic bots and up to 239,000 daily overseas bots during July 14–20, 2026. XLAB assessed Dysphoria as a commercialized operation advertising up to 4 Tbps of DDoS capacity through tiered service packages priced from tens to hundreds of dollars.

TA488 Weaponizes Outlook Web Access Zero-Day With Half-Click Exploit to Deploy OWAReaper Implant

According to Proofpoint, the Russia-aligned threat actor TA488 (Void Blizzard, Laundry Bear) launched a campaign on 22 July 2026 abusing CVE-2026-42897, a cross-site scripting vulnerability in Outlook Web Access, through "half-click" exploits where simply opening the email in OWA triggered compromise against US and European government, telecommunications, financial, hospitality, and aerospace targets. The malicious messages carried banal informational lures with no URLs or attachments, and once opened, the Exchange server mishandled the HTML sanitization and executed a loader that used an onload= event handler to assemble a Base64 fragment hidden in social media icons and run it as encoded JavaScript, delivering a previously unknown browser-based implant named OWAReaper, that operated entirely within the OWA reading pane with no host footprint, rewrote the email to remove exploit content, harvested the victim's OWA credentials via invisible autofill input elements, and established persistence by writing an encrypted copy of itself into the PageDataPayload.OwaUserDefaultSettings localStorage key, poisoning the IndexedDB offline cache with a hidden iframe, and abusing Outlook add-ins to steal OAuth tokens and grant the "Default" user Owner-level mailbox permissions, ensuring server-side access that survived credential rotation and full device re-imaging. For command and control, the implant fetched AES-CTR-encrypted commands (code, domn, and cmnd types) from GitHub commit messages every 24 hours or from attacker-sent inbound emails polled every five minutes, and exfiltrated data over HTTPS with encrypted URI paths proxied through legitimate image CDNs (relaying to acocdn[.]com) or fell back to AES-CTR-encrypted, Base32-encoded DNS label tunnelling. Proofpoint assessed that the earliest infrastructure dated to March 2026, two months before Microsoft's out-of-band patch, making it feasible that TA488 exploited the flaw as a zero-day, signalling a marked leap in the group's tradecraft and capability.

Cl0p Affiliates Exploit PTC Windchill & FlexPLM Zero-Day for Unauthenticated RCE and Double Extortion

According to Ransom-ISAC, in a coordinated Unified Threat Advisory with eCrime.ch and DEFUSED, Cl0p ransomware affiliates actively exploited internet-exposed PTC Windchill and FlexPLM deployments by chaining a pre-authentication information-disclosure flaw in the FlexPLM WSDL endpoint with CVE-2026-12569, a critical remote code execution vulnerability in Windchill PDMLink and FlexPLM caused by deserialization of untrusted data and affecting releases prior to 11.0 M030. The RCE chain enabled unauthenticated code execution and the deployment of hex-named JSP webshells under /Windchill/login/ matching the pattern [0-9a-f]{16}.jsp, followed by filesystem enumeration via flst.txt, staging of engineering and design data, and double-extortion theft, with intrusions marked by the malicious header X-windchill-req: ?x8Fmgow and pre-attack reconnaissance requests to GET /Windchill/rfa/jsp/login/*.jsp?wsdl returning 4045 response bytes. The advisory assessed that Cl0p most likely weaponized CVE-2026-12569 as a zero-day in early June 2026, before its disclosure on 17 June and its addition to the CISA KEV catalog on 25 June, and observed an extortion campaign beginning 20 July that sent emails titled "Windchill PDMLink module serious data leak" from compromised accounts to hundreds of recipients across victim organizations spanning Manufacturing, Automotive, Aerospace, and Retail/Apparel sectors. PTC released fixed builds addressing both defects, yet unpatched internet-exposed instances remained the primary attack surface, and as of 22 July Cl0p had neither listed victims on its dark web leak site nor publicly claimed credit for the campaign.

Open-Source Software (OSS) vulnerabilities are security weaknesses discovered in publicly available codebases that can be exploited across widely used libraries, frameworks, and tools, often impacting thousands of downstream applications.

PRE-NVD vulnerabilities refer to security flaws that are discovered, discussed, or even exploited in the wild before their official inclusion in the National Vulnerability Database (NVD). These early-stage vulnerabilities often emerge through threat actor chatter, exploit proof-of-concepts, and technical disclosures shared across social media platforms and underground forums, signaling potential exploitation risks before public awareness.

The week's through-line was timing, with adversaries repeatedly outpacing the disclosure cycle, turning zero-days into footholds before defenders knew a flaw existed. Hard-coded credentials, planted backdoors, and browser-resident implants all pointed to a shrinking window between exploitation and awareness, where patch-when-published no longer holds. The teams that fared best were already hunting for compromise rather than waiting for an advisory. This is exactly the gap LOVI (Loginsoft Vulnerability Intelligence) closes, surfacing exploitation signals and threat-actor context early enough to keep defenders ahead of the headlines rather than reacting to them.

FAQs:

1) What is Fastjson?

Fastjson is an open-source, high-performance Java library developed by Alibaba for converting Java objects to JSON and back (serialization and deserialization). It is widely used across enterprise Java applications for JSON processing. Its 1.x branch has reached end-of-life, with Fastjson 2.x as the supported successor.  

2) What is Arista VeloCloud Orchestrator?

Arista VeloCloud Orchestrator is a centralized management and orchestration platform for VeloCloud Edge devices. It enables remote configuration, monitoring, and control of SD-WAN infrastructure across distributed networks, giving administrators single-point oversight of an organization's entire SD-WAN deployment.

3) Does inclusion in the CISA KEV catalog mean exploitation is widespread?

Not necessarily widespread - but confirmed. KEV inclusion indicates verified in-the-wild exploitation. While the scale may vary, the operational reality is that threat actors possess working exploits, making patch prioritization urgent regardless of observed targeting volume.

4) How does LOVI help organizations manage vulnerabilities effectively?

Loginsoft Vulnerability Intelligence empowers you to efficiently prioritize and respond to potential vulnerabilities by focusing on those actively exploited in the wild. LOVI correlates vulnerability data with real-world threat activity to reduce noise and improve decision-making. This approach enables faster remediation and stronger security posture.

5) What is Cytellite?

Cytellite is a Loginsoft security intelligence platform that provides real-time visibility into emerging threats through a global sensor network. It delivers actionable IP intelligence to help organizations detect, analyze, and respond to attacks quickly. By correlating threat data with live activity, Cytellite strengthens resilience across dynamic threat landscapes.