ThreatScope by DIAMATIX

Oracle, TrueConf, FortiWeb, Zimbra and Critical Infrastructure Risks (August 19–25, 2026)

Reporting period: August 19–25, 2026
Threat level: Critical

🎧 Listen to this week’s ThreatScope (audio brief)

Executive Snapshot

This week’s ThreatScope focuses on five newly confirmed actively exploited vulnerabilities affecting systems positioned at important trust boundaries across enterprise environments.

The highest immediate priority is CVE-2026-21962, a maximum-severity vulnerability affecting Oracle HTTP Server and WebLogic proxy components. It is remotely exploitable without authentication and may provide access from edge web infrastructure toward critical backend applications and data.

Two vulnerabilities in TrueConf Server are particularly significant when chained. An attacker may first achieve unauthenticated script execution and then escape the isolated environment to execute arbitrary code on the underlying host. Reported post-exploitation activity includes malicious client installers, PhantomCore malware, reverse SSH tunnels and credential dumping.

Fortinet FortiWeb and Zimbra Collaboration Suite are also affected by newly confirmed active exploitation. Both occupy trusted positions in enterprise infrastructure, increasing the potential impact beyond the initially compromised system.

Identity and operational technology also require attention. A critical Keycloak vulnerability can enable unauthenticated password reset and account takeover, while a joint US government advisory warns of active targeting of Siemens S7 programmable logic controllers (PLCs).

The practical priority this week is therefore broader than patching: identify exposure, investigate potential compromise and validate downstream trust.

Is This Report Relevant to Your Organization?

This report is particularly relevant if your organisation operates any of the following technologies or environments.

If these technologies are not present in your environment, immediate remediation for the specific vulnerabilities may not be required. However, this week’s activity highlights a broader pattern: attackers are targeting systems that mediate trust between users, applications, networks and physical processes.

Executive Summary

The reporting period was dominated by five newly confirmed actively exploited vulnerabilities added to the CISA Known Exploited Vulnerabilities (KEV) Catalog:

• CVE-2026-21962. Oracle HTTP Server / WebLogic Proxy;
• CVE-2026-72529. TrueConf Server;
• CVE-2026-72530. TrueConf Server;
• CVE-2025-64446. Fortinet FortiWeb;
• CVE-2026-73570. Zimbra Collaboration Suite.

Oracle represents the highest immediate enterprise exposure. CVE-2026-21962 carries a CVSS score of 10.0 and can be exploited remotely without authentication. A vulnerable proxy component may provide access through the DMZ toward backend WebLogic services and critical business data.

The two TrueConf vulnerabilities create a particularly important attack chain. CVE-2026-72529 allows unauthenticated arbitrary script execution through TCP port 4307. CVE-2026-72530 can then allow the attacker to escape the isolated execution environment and execute arbitrary code on the host. Reported attacks have used compromised servers to replace legitimate TrueConf client installers and distribute PhantomCore malware.

FortiWeb is also under active exploitation. Successful exploitation may allow administrative command execution, creation of unauthorized administrator accounts, modification of security policies and further access toward internal systems.

For Zimbra, exploitation occurs through crafted SMTP requests when specific optional functionality is enabled. Successful exploitation can execute operating-system commands under the Zimbra account, creating significant risk because email servers contain sensitive communications, authentication tokens and password-reset messages.

Outside the KEV additions, Keycloak CVE-2026-18963 deserves high priority despite no confirmed exploitation at the assessment cut-off. The vulnerability can bypass the email-verification stage of password recovery and potentially allow account takeover without authentication.

Key Vulnerabilities

Vulnerability Analysis

Oracle HTTP Server / WebLogic Proxy. CVE-2026-21962

Status: Actively exploited / CISA KEV / CVSS 10.0

CVE-2026-21962 affects WebLogic Server proxy plug-ins for Apache HTTP Server and Microsoft IIS.

An unauthenticated attacker with network access over HTTP can compromise affected proxy components. Successful exploitation may allow unauthorized access to critical information, modification or deletion of accessible data and movement through a DMZ proxy toward backend WebLogic services.

This makes the vulnerability particularly important because the affected component can sit between externally reachable web infrastructure and critical internal applications.

Most Relevant For

• organisations using Oracle WebLogic;
• financial services;
• government;
• large enterprises;
• internet-facing business applications.

How to Verify Exposure

Confirm:

• whether Apache or Microsoft IIS servers use WebLogic proxy plug-ins;
• whether versions 12.2.1.4.0, 14.1.1.0.0 or 14.1.2.0.0 are deployed;
• whether affected proxy endpoints are externally reachable;
• whether unusual HTTP requests or backend routing activity has occurred;
• whether proxy or web-server configurations have changed unexpectedly;
• whether WebLogic audit logs show unusual access originating from proxy servers.

Required Response

Apply the appropriate Oracle Critical Patch Update immediately.

Restrict proxy endpoints to required URLs and methods. Compare plug-in and web-server configurations against trusted baselines and review WebLogic audit logs.

If exploitation cannot be excluded, rotate relevant application credentials and investigate connected backend services rather than treating installation of the update as sufficient closure.

TrueConf Server. CVE-2026-72529 and CVE-2026-72530

Status: Actively exploited / CISA KEV

These two vulnerabilities are particularly significant when used together.

CVE-2026-72529 allows an unauthenticated remote attacker to execute an arbitrary script through an undocumented function when TCP port 4307 is reachable.

CVE-2026-72530 can then allow a specially crafted script to escape the isolated execution environment and execute arbitrary code on the underlying host.

Reported post-exploitation activity includes replacement of legitimate TrueConf client installers, distribution of PhantomCore malware, reverse SSH tunnels, LSASS memory dumping and reconnaissance of users and hosts.

The risk therefore extends beyond the TrueConf server itself. A compromised collaboration server can become a distribution point for malicious software to trusted users and downstream endpoints.

How to Verify Exposure

Confirm:

• whether TrueConf Server is deployed;
• whether TCP port 4307 is reachable from the internet or untrusted networks;
• whether the server runs an affected release;
• whether TrueConf client installation packages have changed;
• whether unexpected server-side scripts, services or scheduled tasks exist;
• whether reverse SSH tunnels or unusual outbound connections are present;
• whether suspicious LSASS access has occurred.

Required Response

Upgrade to the latest supported TrueConf Server release.

Block TCP 4307 from the internet and untrusted networks. Validate hashes of client installation packages and investigate unexpected server-side changes.

If compromise is suspected, rotate administrative, service and integration credentials and reinstall client software from a known trusted package.

Fortinet FortiWeb. CVE-2025-64446

Status: Actively exploited / CISA KEV / CVSS 9.8

CVE-2025-64446 is a path-traversal vulnerability allowing an unauthenticated remote attacker to execute administrative commands through crafted HTTP or HTTPS requests.

Successful exploitation may allow attackers to create administrator accounts, modify security policies, access protected application configurations and use the web application firewall as an entry point toward internal networks.

Because FortiWeb sits directly in the path of incoming application traffic, compromise may undermine a control that organisations rely on to protect other systems.

How to Verify Exposure

Review:

• whether FortiWeb management interfaces are publicly accessible;
• administrator accounts and recent account creation;
• recent security-policy changes;
• HTTP access and system-event logs;
• certificates, API keys and backend credentials stored on the appliance;
• the current configuration against a trusted backup.

Required Response

Upgrade to the corrected release for the deployed FortiWeb branch and remove management interfaces from public exposure.

Rotate local and external authentication credentials where necessary.

If compromise is confirmed, rebuilding from trusted media is preferable to simply deleting unauthorized administrator accounts.

Zimbra Collaboration Suite. CVE-2026-73570

Status: Actively exploited / CISA KEV

Zimbra Collaboration Suite versions before 10.1.20 are vulnerable when the optional zimbra-snmp package is installed and SNMP notifications are enabled.

An unauthenticated attacker can submit crafted SMTP requests that reach the notification-processing component and execute operating-system commands as the Zimbra user.

The position of an email server makes this particularly important. Successful compromise may expose sensitive communications, internal contacts, authentication tokens and password-reset messages.

How to Verify Exposure

Determine:

• whether the zimbra-snmp package is installed;
• whether SNMP notifications are enabled;
• whether the deployed Zimbra version is earlier than 10.1.20;
• whether mail logs contain abnormal SMTP fields or notification activity;
• whether unusual child processes have been launched by Zimbra or SNMP components;
• whether new web shells, cron jobs, SSH keys or startup modifications exist;
• whether mailbox forwarding, delegation or administrator settings changed unexpectedly.

Required Response

Upgrade Zimbra to version 10.1.20 or later.

Disable SNMP notifications where they are not operationally required. Review the host for persistence and suspicious process activity.

Rotate administrator, LDAP and service credentials where compromise cannot be excluded.

Critical Identity Security Exposure

Keycloak. CVE-2026-18963

CVE-2026-18963 affects the password-recovery process in Keycloak.

An unauthenticated attacker can manipulate the reset-credentials authentication flow so that it proceeds directly to the password-update stage without requiring the emailed action token.

This may allow the attacker to reset another user’s password and take over the account. Administrative identities may also be affected.

No confirmed exploitation was reported at the assessment cut-off, but the potential impact makes this a high-priority identity-security issue.

Required Response

Upgrade all Keycloak clusters and container images to a corrected release.

If patching is delayed, temporarily disable Forgot password in every affected realm.

Review password-update events that were not preceded by a valid action-token event, repeated reset attempts against multiple accounts, privileged-role assignments and identity-provider links.

Keycloak should be treated as Tier-0 identity infrastructure, with administrative access restricted accordingly.

Cisco Critical Security Hardening

Cisco published critical security releases for Crosswork and Secure Workload on August 19.

Crosswork is affected by several severe vulnerability classes, including:

• CVE-2026-20030. SQL injection, CVSS 10.0;
• CVE-2026-20357. Missing authentication, CVSS 10.0;
• CVE-2026-20358. External control of filesystem, CVSS 10.0;
• CVE-2026-20359. Insufficiently protected credentials, CVSS 9.9.

Cisco Secure Workload also received fixes for authentication, access-control, injection, memory-safety and input-validation issues, including several maximum-severity vulnerabilities.

Cisco states that these internally discovered vulnerabilities were not known to be actively exploited at the assessment cut-off. Complete workarounds are not available.

Organisations using these products should therefore upgrade to the corrected releases rather than relying on compensating configuration alone.

Web Application Security Watch

Elementor Pro. CVE-2026-32475

CVE-2026-32475 affects Elementor Pro and may allow an unauthenticated attacker to upload a PHP file under vulnerable conditions.

Successful exploitation can result in remote code execution and potentially complete compromise of the WordPress site.

Required Response

Upgrade Elementor Pro to version 4.2.2 or later.

Review upload directories for PHP and other executable files, inspect newly created administrator accounts and plug-ins and search web access logs for abnormal upload requests.

PHP execution should be disabled within upload directories where possible.

If compromise is suspected, rotate WordPress and database secrets.

Microsoft Entra ID Cloud Vulnerability

CVE-2026-69836

CVE-2026-69836 is a CVSS 10.0 remote-code-execution vulnerability caused by unsafe deserialization in Microsoft Entra ID.

Unlike the other major vulnerabilities in this report, customers do not need to deploy a local patch. Microsoft has applied a server-side correction.

Microsoft initially indicated active exploitation, but the public status was later changed. Exploitation should therefore not be treated as conclusively confirmed at the assessment cut-off.

Organisations should nevertheless review Entra sign-in and audit logs, investigate anomalous administrative changes, verify privileged role assignments and consent grants and confirm that Microsoft’s service-side mitigation applies to their tenant.

OT/ICS Active Threat. Siemens S7 PLCs

A joint advisory from CISA, NSA, FBI, the US Department of Energy and the Environmental Protection Agency warns of active targeting of Siemens S7-series programmable logic controllers.

Affected product families include:

• S7-200;
• S7-300;
• S7-400;
• S7-1200;
• S7-1500;
• associated F-series safety controllers.

Threat actors are using internet-scanning services to identify exposed or poorly protected PLCs. AI-generated exploitation scripts, sometimes presented as legitimate monitoring tools, are also being developed to interact with PLC services and protocols.

Potential consequences extend beyond information-security impact. Unauthorized access may enable modification of PLC logic or configuration, disruption of industrial processes, loss of visibility or control, equipment damage and potential safety incidents.

Immediate OT Actions

• Inventory Siemens S7 PLCs, CPU models and firmware versions.
• Remove direct internet exposure.
• Block TCP port 102 at network boundaries unless explicitly required.
• Review engineering workstation and remote-access pathways.
• Restrict programming and write operations to authorised stations.
• Monitor S7comm traffic for unauthorized reads, writes and downloads.
• Search for snap7 and python-snap7 outside approved tools.
• Validate PLC logic and configuration against trusted backups.
• Preserve forensic evidence before rebooting or reprogramming suspicious PLCs.

Firmware updates should follow approved OT change procedures.

Continuing KEV Exposure

Four vulnerabilities added to CISA KEV immediately before this reporting period remain urgent:

Organisations should verify both remediation and compromise assessment, particularly where vCenter, SharePoint or Screen Sharing services were accessible from the internet while vulnerable.

What Deserves Attention This Week?

Internet-Facing Enterprise Infrastructure

Priority systems: Oracle HTTP/WebLogic proxy components, TrueConf, FortiWeb and Zimbra.

Primary actions: identify exposed systems, apply vendor fixes, review administrative changes and investigate systems that were externally accessible while vulnerable.

Identity Infrastructure

Priority systems: Keycloak and Microsoft Entra ID.

Primary actions: validate password-reset activity, privileged roles, active sessions, administrative changes and identity-provider configuration.

Network and Application Management

Priority systems: Cisco Crosswork and Cisco Secure Workload.

Primary actions: deploy corrected releases and verify that vulnerable management services are not unnecessarily exposed.

Public Web Applications

Priority systems: Elementor Pro and continuing SharePoint exposure.

Primary actions: patch affected systems, inspect upload directories and administrative changes and investigate suspicious web activity.

Operational Technology

Priority systems: Siemens S7 PLCs and associated engineering infrastructure.

Primary actions: remove direct internet exposure, restrict programming paths, monitor S7 communications and validate PLC logic against trusted baselines.

Recommended Management Actions

Immediate Actions (0–7 Days)

• Identify whether Oracle HTTP Server / WebLogic proxy components, TrueConf Server, FortiWeb, Zimbra Collaboration Suite, Keycloak, Cisco Crosswork, Cisco Secure Workload and Elementor Pro are present in the environment.
• Patch and investigate internet-facing Oracle HTTP Server / WebLogic proxy components.
• Upgrade TrueConf Server and block TCP port 4307 from the internet and other untrusted networks.
• Upgrade FortiWeb and review administrator accounts, recent policy changes and stored credentials.
• Upgrade Zimbra to version 10.1.20 or later and disable unnecessary SNMP notifications.
• Patch Keycloak or temporarily disable password recovery where remediation cannot be completed immediately.
• Remove direct internet exposure from Siemens S7 programmable logic controllers and restrict access to TCP port 102.
• Review VMware vCenter, Microsoft SharePoint, Windows IKE and macOS Screen Sharing systems for the continuing KEV exposures carried over from the previous reporting period.
• Conduct compromise assessment for any KEV-listed system that was accessible from the internet while vulnerable.

Actions Within 30 Days

• Upgrade Cisco Crosswork and Cisco Secure Workload to the corrected releases.
• Update Elementor Pro and inspect WordPress upload directories for unexpected executable files.
• Review administrator accounts, privileged access and configuration changes across Oracle, FortiWeb, TrueConf, Zimbra and identity platforms.
• Rotate credentials, API keys, service accounts and integration secrets where exposure or compromise cannot be excluded.
• Review Keycloak password-reset activity, active sessions, privileged roles and identity-provider links.
• Validate external exposure of ports 80/443, 25, 102 and 4307 and remove unnecessary services from public access.
• Perform authenticated vulnerability scanning across externally accessible infrastructure.
• Validate PLC logic, firmware and configuration against trusted baselines and backups.
• Test restoration procedures for Zimbra, Oracle, FortiWeb and critical identity services.
• Close or formally document any remediation exceptions that remain unresolved.

Strategic Actions (Within 90 Days)

• Reduce unnecessary internet exposure of management interfaces, collaboration platforms, identity services and operational technology.
• Treat identity platforms such as Keycloak as Tier-0 infrastructure and apply stronger administrative-access controls.
• Strengthen monitoring for command injection, unauthorized administrator creation, password-reset abuse and suspicious privilege changes.
• Improve detection of unusual software distribution from trusted collaboration and internal application platforms.
• Review segmentation between externally accessible proxy or security systems and backend business applications.
• Strengthen monitoring of Siemens S7 and other OT protocols for unauthorized reads, writes and configuration changes.
• Ensure vulnerability prioritisation incorporates active exploitation, external exposure, system criticality and downstream trust relationships rather than CVSS scores alone.
• Review emergency isolation, recovery and business-continuity procedures for critical identity, communications, application-security and OT systems.
• Include compromise assessment and downstream validation as formal closure criteria for internet-exposed KEV vulnerabilities.

Enterprise Exposure Assessment

Security teams should assess this week’s vulnerabilities through four questions.

1. Was the System Externally Reachable?

Oracle proxy components, TrueConf, FortiWeb, Zimbra and Siemens PLCs become substantially more urgent when accessible from untrusted networks.

External exposure should therefore be established before remediation priority is assigned solely from CVSS scores.

2. Does the System Control Downstream Trust?

Several affected technologies occupy privileged positions:

• FortiWeb controls incoming application traffic.
• Oracle proxy components connect web infrastructure with backend applications.
• TrueConf distributes trusted client software.
• Zimbra handles communications and authentication messages.
• Keycloak controls identities and downstream access.
• Siemens PLCs directly control physical processes.

Compromise at these layers can therefore propagate beyond the initially vulnerable system.

3. Was Exploitation Possible Before Patching?

For KEV-listed systems, applying an update does not establish that the environment was not previously compromised.

Administrative changes, credentials, persistence mechanisms, logs and connected systems should be reviewed before remediation is considered complete.

4. Can the Service Be Recovered Safely?

Recovery readiness should be validated for Oracle, Zimbra, FortiWeb, identity infrastructure and critical OT systems.

This includes trusted configuration backups, tested restoration procedures and the ability to isolate a compromised system without creating unacceptable operational impact.

Ongoing Security Controls

Beyond this week’s immediate remediation cycle, security teams should:

• maintain an accurate inventory of externally accessible infrastructure;
• identify systems positioned at important trust boundaries;
• remove management interfaces and OT devices from unnecessary internet exposure;
• monitor administrator-account creation and privileged-role changes;
• detect unusual password-reset and session activity;
• monitor command execution from application and collaboration servers;
• validate software packages distributed through trusted internal systems;
• monitor OT protocols for unauthorized programming activity;
• maintain trusted configuration and application backups;
• verify remediation through authenticated scanning and compromise assessment.

Questions for Leadership

Boards and executive teams should ask:

• Do we operate any of the affected technologies?
• Which affected systems were accessible from the internet while vulnerable?
• Have all newly added KEV vulnerabilities been patched or isolated?
• Have exposed systems been investigated for compromise after patching?
• Could a compromised system distribute software, credentials or access to downstream environments?
• Are Keycloak and other identity systems treated as critical infrastructure?
• Are any Siemens PLCs directly reachable from external or untrusted networks?
• Have administrative changes and credentials been reviewed on FortiWeb, Zimbra, Oracle and TrueConf?
• Can critical services be restored from trusted backups?
• Which remediation exceptions remain open, and who owns the associated risk?

ISO 27001 Alignment

The actions in this report support several areas of an Information Security Management System (ISMS), including:

• asset inventory and ownership;
• vulnerability management;
• identity and access management;
• secure configuration;
• network security;
• logging and monitoring;
• incident response;
• supplier and software integrity;
• backup and recovery;
• operational technology security;
• business continuity;
• risk treatment and management review.

Evidence should be retained for remediation activities. Patch status alone is not sufficient where exploitation was possible before remediation.

Organisations should preserve relevant scan results, configuration records, administrator and identity reviews, compromise-assessment findings and recovery validation.

ISO 9001 Alignment

The response activities also support quality-management principles through:

• defined ownership;
• controlled change management;
• documented corrective actions;
• validation of remediation results;
• evidence-based decision-making;
• management review;
• continual improvement.

The objective is to verify that corrective actions have reduced operational risk rather than simply confirming that an update was installed.

Need Help Assessing Your Exposure?

If your organisation operates any of the technologies covered in this report, the first step is establishing whether affected versions and configurations are present.

The next questions are whether the systems were exposed while vulnerable, whether suspicious activity occurred before remediation and whether credentials, administrative changes or connected systems require further investigation.

DIAMATIX supports organisations with exposure assessment, continuous security monitoring, Managed Detection and Response as a Service (MDRaaS), Security Operations Center as a Service (SOCaaS) and Incident Response.

Contact our team to discuss your environment.

Conclusion

This week’s activity is concentrated around systems that occupy critical trust boundaries.

Oracle proxy components connect externally accessible web infrastructure with backend business applications. FortiWeb controls incoming application traffic. Zimbra contains sensitive communications and authentication messages. TrueConf distributes trusted client software. Keycloak manages identities and downstream access. Siemens PLCs directly influence physical processes.

The significance of these vulnerabilities therefore extends beyond the initially affected host.

For the five newly added CISA KEV vulnerabilities, remediation should follow three stages: patch, investigate and validate downstream trust.

Where an affected system was accessible from the internet while vulnerable, installing the update alone is not an adequate closure criterion. Security teams should also review administrative changes, credentials, persistence mechanisms and connected systems.

The objective is to establish that the vulnerability has been removed, previous compromise has been investigated and trust in downstream systems can be supported by evidence.

Sources

• Oracle January 2026 Critical Patch Update
• CISA Known Exploited Vulnerabilities Catalog
• TrueConf Security Advisory
• Fortinet PSIRT Advisory
• Zimbra Security Advisories
• Keycloak 26.7.2 Release Notes
• Cisco August 19 Security Advisories
• Patchstack Technical Advisory
• Microsoft Security Update Guide
• Joint CISA Advisory AA26-231A
• CISA KEV Update of August 18, 2026

Methodology

This report is based on open-source vulnerability and threat intelligence, prioritising confirmed active exploitation, CISA KEV status, vendor advisories, external accessibility and the operational role of affected systems.

Applicability should always be validated against the organisation’s actual asset inventory, deployed versions and configuration.

The presence of a vulnerable version does not by itself confirm compromise. Likewise, successful patching does not establish that exploitation did not occur before remediation.

Trusted · Innovative · Vigilant