CYBER THREATCAST

Patch Microsoft SharePoint Server 2016, 2019, and Subscription Edition systems for CVE-2026-45659 immediately, and treat any internet-exposed instance as a compromise-review candidate. CISA added the SharePoint Server deserialization RCE flaw to its Known Exploited Vulnerabilities catalog with a three-day federal deadline, and Microsoft ransomware response activity has already found unrelated intruders including Warlock-linked activity. SharePoint operators should prioritize exposed servers first and verify remediation against CISA KEV requirements.

Upgrade Oracle E-Business Suite environments affected by CVE-2026-46817, especially Oracle Payments 12.2.3 through 12.2.15 and the Payments File Transmission component, and remove exposed EBS instances from direct internet access where possible. The flaw is being actively exploited, can allow unauthenticated HTTP attackers to take over vulnerable Oracle EBS systems, and Shadowserver identified roughly 950 exposed instances. Public proof-of-concept availability and honeypot exploitation attempts raise the near-term risk for organizations running exposed Oracle Payments systems.

Audit Fortinet FortiGate and FortiOS SSL-VPN environments for stolen or intercepted credentials, then reset VPN credentials and investigate suspicious administrative access. Researchers linked FortiBleed activity to INC and Lynx ransomware infrastructure, with stolen data from more than 73,000 Fortinet devices, scanning of about 11,250 FortiGate portals in more than 150 countries, and completed intrusion chains on 354 targets. At least 12 ransomware deployments followed harvested access, so FortiGate operators should assume credential exposure can become ransomware access.

Hunt Oracle PeopleSoft and WebLogic environments for signs of unauthenticated RCE exploitation and extortion activity, with higher education treating this as a priority exposure. ShinyHunters exploited a critical Oracle PeopleSoft zero-day in an active campaign affecting more than 100 organizations worldwide, and universities and colleges represented 68% of notified targets. PeopleSoft operators should review environment-management components, validate external exposure, and preserve logs for the May 27 to June 9 activity window described in the reporting.

Review Microsoft 365 and Azure authentication policy coverage for device-code and OAuth ROPC abuse, then investigate token issuance and suspicious login bursts against Azure CLI and Microsoft 365 accounts. Huntress reported more than 81 million login attempts over 14 days and compromised Microsoft accounts across organizations by abusing OAuth ROPC flows to obtain tokens without interactive MFA. Cisco Talos and the FBI also reported EvilTokens, ARToken, and Kali365 using Microsoft 365 device-code phishing to bypass MFA and enable email access, data theft, lateral movement, and business email compromise.