GFL Summer Series: Threats That Hit When You’re by the Pool

The sun is shining. Out-of-office messages are going out. Half of the security team is wrestling for space around a hotel pool. The rest are frantically trying to figure out who can approve an emergency firewall upgrade.

Bad news: attackers do not care about your summer schedule.

Over the past few weeks, we have had another reminder that vulnerability management does not take holidays. Several major vulnerabilities have been identified across Microsoft SharePoint, Zimbra Collaboration Suite, Cisco and Oracle products. Several of these vulnerabilities are already being exploited in the wild.

Most affect perimeter systems that organisations expose to the internet and then promptly forget about until something breaks.

Put the inflatable raft away for five minutes. Below are some of the most significant vulnerabilities affecting organisations this summer.

CVE-2026-55040: Authentication Bypass in On-Premises SharePoint

On-premises SharePoint has once again become the focus of attackers’ attention.

CVE-2026-55040 is a critical authentication bypass caused by weak authentication in Microsoft Office SharePoint. An unauthorised remote attacker can bypass SharePoint authentication over a network without possessing valid credentials.

The vulnerability received a CVSS score of 9.1 and was added to CISA’s Known Exploited Vulnerabilities catalogue on 18 August after evidence of active exploitation emerged.

There are several reasons why CVE-2026-55040 is a concern.

Authentication bypass is rarely the attacker’s ultimate objective. Instead, it removes the primary barrier protecting other functionality and can expose attack paths that would normally require a valid account.

Research into this flaw showed that it could serve as the initial stage of a wider exploit chain, ultimately resulting in remote code execution against SharePoint without requiring valid authentication.

Affected organisations should install the applicable July security update for SharePoint Server 2016, SharePoint Server 2019 or SharePoint Server Subscription Edition.

SharePoint Online is not affected. These vulnerabilities concern on-premises versions of SharePoint that organisations are responsible for maintaining themselves.

What Defenders Should Look For

• Unusual requests to SharePoint authentication and token-handling endpoints
• Malformed or unusual JSON Web Tokens within requests to SharePoint
• Unexpected or newly created administrator activity
• Unusual child processes spawned by SharePoint or IIS worker processes
• Files recently written beneath SharePoint web directories
• PowerShell, cmd.exe or other scripting engines executed by w3wp.exe
• Outbound connections from the SharePoint server to unusual external infrastructure

Although applying the appropriate patches is the immediate defensive action, investigation is equally important.

If the server was exposed to the internet before the vulnerability was publicly disclosed or patched, do not assume that installing the update automatically closes the incident.

Investigate IIS logs, process telemetry, authentication events, file creation and outbound network communications to determine whether somebody reached the server before the patch did.

Microsoft’s July SharePoint security updates address CVE-2026-55040, and CISA now lists the vulnerability as actively exploited.

CVE-2026-73570: SMTP to Command Execution in Zimbra

CVE-2026-73570 is the sort of vulnerability likely to make an email administrator cancel their afternoon plans.

The flaw affects Zimbra Collaboration Suite before version 10.1.20 when the optional zimbra-snmp package is installed and SNMP notifications are enabled.

Inadequate sanitisation of untrusted input within the SNMP notification process allows an unauthenticated attacker to send crafted SMTP requests and execute arbitrary operating system commands as the Zimbra user.

Let us examine the attack path:

1. The attacker reaches the exposed SMTP service.
2. Attacker-controlled input reaches the SNMP notification component.
3. The input is not properly sanitised before being passed to a command.
4. Arbitrary commands execute in the context of the Zimbra service account.

The vulnerability does not require an attacker to steal a password. Instead, it abuses normal mail flow to reach a completely unrelated monitoring component.

Active exploitation has been observed, and CVE-2026-73570 was added to CISA’s Known Exploited Vulnerabilities catalogue on 21 August. Zimbra fixed the vulnerability in version 10.1.20.

What Defenders Should Look For

• Unexpected shell processes running as the Zimbra user
• Shell metacharacters or unusual encoded content in SMTP traffic
• Unexpected child processes spawned by Zimbra or the SNMP notification component
• Use of curl, wget, bash, sh, Python or Perl by Zimbra-owned processes
• Files created in /tmp, /var/tmp or Zimbra application directories
• New cron jobs, SSH keys or other persistence owned by the Zimbra account
• Outbound connections from mail servers that do not match normal delivery patterns

Disabling or removing the optional SNMP component, if it is not required, reduces exposure. Otherwise, organisations should upgrade to version 10.1.20 and investigate their mail servers for evidence of exploitation.

There is not much more useful to an attacker than landing on a mail server. It is trusted to communicate broadly, stores sensitive information and processes attacker-controlled content continuously throughout the day.

Zimbra’s security advisory confirms the affected component and fixed release. CISA subsequently added CVE-2026-73570 to its KEV catalogue following evidence of active exploitation.

CVE-2026-20316: Static Credentials in Cisco Secure FMC

Next up is CVE-2026-20316, a vulnerability within the web interface of Cisco Secure Firewall Management Center.

The affected software contains static credentials for a built-in, low-privileged account. An unauthenticated remote attacker who can reach the interface can use those credentials to log in and access sensitive data.

The vulnerability has a CVSS score of 5.3.

Although CVSS scores provide useful context when comparing similar vulnerabilities, it is important to remember that a score alone does not amount to a risk assessment.

Cisco rated CVE-2026-20316 as having a High security impact, confirmed that the vulnerability has been exploited in the wild and noted that it could be chained with other vulnerabilities to increase its overall impact.

CISA added CVE-2026-20316 to its KEV catalogue on 29 July.

Good vulnerability management therefore requires context. A single score cannot tell you that:

• The affected system manages your security infrastructure
• The credentials are already available to attackers
• The vulnerability is being exploited in the wild
• Low-privileged access may expose valuable configuration or operational data
• The flaw may represent the first stage of a broader exploit chain

What Defenders Should Look For

• Successful FMC login attempts from unfamiliar IP addresses
• Authentication using unexpected built-in or low-privileged accounts
• Authentication activity outside normal administrative windows
• Enumeration of device configurations, policies or managed assets
• New sessions followed immediately by attempts to access higher-privileged functions
• Changes made shortly after an unusual low-privileged login

Cisco has not provided a workaround. Affected organisations must apply the appropriate hotfixes or upgrade to a fixed release.

Management interfaces should also be restricted to dedicated administration networks and trusted jump hosts. If your firewall management platform is exposed directly to the internet, this vulnerability is probably only one of several issues that need addressing.

Cisco’s official advisory for CVE-2026-20316 provides details of the affected releases and the appropriate remediation guidance.

CVE-2026-20349: One Request, One Reloaded Firewall

Sticking with Cisco products, CVE-2026-20349 affects the Remote Access SSL VPN service in Cisco Secure Firewall ASA and FTD software.

Insufficient error checking during the processing of HTTP requests allows an unauthorised remote attacker to send a crafted request and cause the device to reload unexpectedly.

This results in a denial-of-service condition affecting the firewall or VPN gateway.

The vulnerability has a CVSS score of 8.6. Cisco has confirmed active exploitation of the flaw, and no workaround is available.

This is not remote code execution, but availability matters too.

A successful attack against an exposed VPN service can disconnect remote users and interrupt access to internal resources. It may also force responders to troubleshoot the device through whatever management path remains available, potentially while the person with the necessary access is attempting to build a sandcastle.

What Defenders Should Look For

• Unexpected ASA or FTD reloads and crashes
• Crash information or traceback files created around the time of the event
• Bursts of malformed HTTP requests sent towards the VPN interface
• Repeated requests from the same external source immediately before a reload
• Monitoring gaps that align with appliance restarts
• Multiple reloads without an associated administrative action or power event

Identify whether Remote Access SSL VPN, IKEv2 client services or relevant zero-trust functionality is enabled on an exposed interface. Confirm the exact software release and follow Cisco’s upgrade guidance.

Do not rely solely on a vulnerability scanner that cannot authenticate to the appliance and determine its feature configuration.

Cisco’s CVE-2026-20349 advisory documents the affected service, vulnerable releases and the absence of a workaround.

Before You Head Back to the Pool

The defensive actions are not glamorous, but they work:

1. Identify internet-facing SharePoint, Zimbra and Cisco systems.

2. Confirm versions using evidence from the host.

3. Patch or upgrade affected products.

4. Restrict management interfaces to trusted networks and jump hosts.

5. Hunt for exploitation that may have happened before remediation.

6. Make sure somebody owns emergency patching while key staff are away.