Date: Friday, July 31, 2026
Audience: Server admins, MSPs, infra leads, SOC/IR teams
Estimated reading time: 14 minutes

Executive Admin Summary

Today’s highest-priority development is CISA’s new sector-wide warning that threat actors are actively targeting internet-exposed programmable logic controllers in water and wastewater environments. The observed activity has progressed beyond scanning: attackers have changed controller passwords, altered IP addresses to disconnect equipment, forced sustained manual operations, and contributed to boil-water notices. CISA has not publicly attributed this activity. Remove direct PLC exposure—including forgotten cellular connections—before undertaking broader vulnerability work.

The most urgent conventional server issue is CVE-2026-20316 in on-premises Cisco Secure Firewall Management Center. Cisco confirms ongoing exploitation, CISA has added the vulnerability to the Known Exploited Vulnerabilities catalog, and Cisco has published a concrete log artifact associated with possible compromise. Although its standalone CVSS score is only 5.3, the exposed static credential can be chained with other FMC weaknesses, and Cisco recommends rotating all credentials, keys, and certificates on appliances where exploitation is suspected.

Newly disclosed flaws in VMware vCenter and JetBrains TeamCity also warrant accelerated action. The vCenter vulnerabilities provide network-reachable authentication bypass or arbitrary code execution without a workaround. TeamCity’s flaw allows unauthenticated operating-system command execution on every unpatched on-premises version. Neither vendor currently reports active exploitation, so these require urgent exposure reduction and patching without representing confirmed incidents by themselves.

The recommended sequence is: remove exposed operational technology; preserve and investigate potentially exploited Cisco FMC systems; patch Cisco; restrict and update externally reachable TeamCity and vCenter systems; then address newly disclosed industrial-controller, embedded TLS, and certificate-validation weaknesses according to actual deployment conditions.

Immediate Action Required

Remove public PLC exposure as disruptive attacks expand across water systems

Priority: Critical

Intelligence Update:

On July 30, CISA reported a significant increase in threat actors targeting programmable logic controllers in the Water and Wastewater Systems Sector. The agency says attackers have changed controller passwords to lock out operators and changed IP addresses to disconnect PLCs. The activity has resulted in boil-water notices and sustained manual operations.

This alert materially expands the defensive significance of the recently disclosed attacks against more than 30 Minnesota water systems. CISA is now describing an observed sector-wide activity pattern rather than treating the Minnesota incidents as an isolated regional event.

Assessment:

Directly exposed controllers allow an attacker to bypass the normal separation between enterprise information technology and physical operations. Changing a PLC’s IP address may appear comparatively unsophisticated, but it can eliminate operator visibility, interrupt automated control, invalidate engineering-workstation connection settings, and force a utility into manual operation.

Public reporting and leaked industry material have raised possible Iranian involvement. CISA’s July 30 alert, however, does not publicly attribute the activity. Defenders should hunt the observed access and configuration-change behavior without assuming a particular actor, toolset, or geopolitical origin.

Cellular modems are a particularly important blind spot. A PLC may be unreachable through the organization’s ordinary internet perimeter but still accessible through a vendor-installed, integrator-managed, or temporary cellular connection.

Operational Impact:

Immediately identify and remove every direct internet path to PLCs, human-machine interfaces, programming interfaces, remote terminal units, and cellular gateways. Place authenticated remote access behind a controlled virtual private network or security gateway, restrict source addresses, and verify trusted controller images and configuration backups before an emergency restoration is required.

Treat altered passwords, unexpected IP-address changes, unexplained controller disconnects, or unplanned manual operation as possible incident indicators—not merely equipment faults.

Operational Notes:

  • Inventory fixed public IPs, cellular modems, vendor remote-access paths, temporary maintenance connections, NAT rules, and externally reachable engineering services.
  • Disconnect directly exposed PLCs rather than relying solely on changing the controller password.
  • Preserve the current controller project, configuration, reusable code modules, alarms, shutdown logic, recipes, and communications settings before restoration.
  • Compare controller logic and network settings against an independently trusted engineering baseline.
  • Confirm that known-clean controller images and password-recovery procedures are available offline.
  • Use IP allowlisting so only specifically authorized engineering systems can reach controller management services.
  • Review firewall, cellular-carrier, engineering-workstation, historian, human-machine interface, and controller logs for unknown remote sources and configuration changes.
  • Rockwell Automation has published separate recovery guidance for restoring access to a MicroLogix 1400 when its password is unknown.
  • Do not reconnect a controller merely because access has been restored. Validate logic, addressing, setpoints, alarms, interlocks, and communications first.

Assessment Confidence: High — CISA directly reports an increase in observed attacks and specific disruptive controller changes; public attribution remains unconfirmed.

Sources:

CISA — CISA Urges Water and Wastewater Systems Sector to Protect OT Against Activity Targeting PLCs
CISA, FBI, NSA, EPA and partner agencies — Iranian-Affiliated Cyber Actors Exploit Programmable Logic Controllers in Multiple Critical Infrastructure Sectors, AA26-097A
Rockwell Automation — Important Notice: Restoring Access to a MicroLogix 1400 Controller When the Password Is Unknown

Actively exploited Cisco FMC static credential requires investigation and trust replacement

Priority: Critical

Intelligence Update:

Cisco disclosed CVE-2026-20316 on July 29 and confirms that active exploitation has been ongoing. CISA added the vulnerability to its Known Exploited Vulnerabilities catalog the same day, with an August 1 federal remediation deadline.

The vulnerability places static credentials for a low-privileged account in the web interface of on-premises Cisco Secure Firewall Management Center. An unauthenticated attacker who can reach the management interface can use those credentials to log in and access sensitive information. Cisco raised the advisory to High despite a CVSS 3.1 score of 5.3 because the access can be chained with other FMC vulnerabilities to elevate privileges.

Assessment:

This is a control-plane compromise problem, not simply a low-privileged information-disclosure bug. FMC centrally manages firewall policy, objects, connectivity, logging, and trust relationships. Even limited access can expose information needed for subsequent privilege escalation or evasion.

Internet exposure increases risk but is not required for exploitation. An attacker with access through a compromised workstation, vendor connection, adjacent management network, or existing foothold may also reach the interface.

Cisco has supplied a log pattern associated with possible exploitation. It should be treated as an investigation trigger rather than a definitive indicator: its presence may indicate exploitation, while its absence does not establish that the appliance is clean.

Operational Impact:

Preserve appliance logs, check for the Cisco-published artifact, install the release-specific hotfix, and restrict the FMC management interface to dedicated administrative networks. If the artifact or other unauthorized activity is found, contact Cisco TAC and treat all credentials, keys, and certificates stored on or trusted by FMC as potentially exposed.

Patching closes the vulnerability but does not remove an established foothold or invalidate material already obtained by an attacker.

Operational Notes:

  • Affected product: on-premises Cisco Secure Firewall Management Center Software, regardless of device configuration.
  • Cloud-Delivered FMC, Firewall Device Manager, ASA Software, Secure Firewall Threat Defense Software, and Security Cloud Control are not affected by this specific vulnerability.
  • Cisco provides release-specific hotfixes for the 7.0, 7.2, 7.4, 7.6, 7.7, and 10.0 trains.
  • Cisco lists no workaround. Network restriction reduces exposure but does not correct the static credential.
  • In expert mode, inspect /var/log/messages for a license event involving:
    • user www
    • /usr/local/sf/bin/package_info.pl
    • /var/tmp/license.tmp
  • Preserve relevant logs and appliance state before installing the hotfix where operationally possible.
  • Review administrator sessions, user changes, policy deployments, object modifications, remote commands, logging changes, certificate operations, and unusual outbound communications.
  • If exploitation is suspected, rotate all FMC user credentials, keys, and certificates as Cisco recommends.
  • Evaluate downstream firewalls for unauthorized policy changes even if the management appliance itself appears operational.

Assessment Confidence: High — Cisco confirms ongoing exploitation, CISA has placed the vulnerability in KEV, and Cisco has provided hotfixes and a specific investigation artifact.

Sources:

Cisco — Cisco Secure Firewall Management Center Software Static Credential Vulnerability
CISA — CISA Adds One Known Exploited Vulnerability to Catalog: CVE-2026-20316
CISA — Known Exploited Vulnerabilities Catalog

Patch network-reachable vCenter authentication bypass and code execution

Priority: Critical

Intelligence Update:

Broadcom published VMSA-2026-0006 on July 29 for five vulnerabilities in VMware products. The two most consequential are CVE-2026-59309 and CVE-2026-59310, both rated CVSS 9.8.

CVE-2026-59309 is an authentication bypass in VMware Directory Service. An attacker with network access to vCenter may gain unauthorized access. CVE-2026-59310 is a directory-traversal vulnerability in the vCenter Syslog server that can provide arbitrary code execution to a network-reachable attacker.

Broadcom lists no workaround. The vulnerabilities were privately reported, and neither Broadcom nor CISA currently reports active exploitation.

Assessment:

vCenter should be treated as Tier 0-adjacent because it administers virtual infrastructure, machine state, virtual networking, storage connections, templates, and privileged management workflows. A successful compromise can place a large proportion of the organization’s server estate under hostile administrative control.

The advisory establishes network reachability as the prerequisite but does not require public internet exposure. A compromised management workstation, virtual private network account, jump host, or adjacent server can provide the required access.

A third vulnerability, CVE-2026-47876, permits a virtual-machine escape through the VMXNET3 adapter, but it requires local administrative privileges inside a VM using VMXNET3. That prerequisite makes it principally a post-compromise or hostile-tenant risk rather than an unauthenticated perimeter flaw.

Operational Impact:

Restrict vCenter to dedicated management systems and patch within an emergency maintenance window. Preserve relevant authentication, Syslog, task, event, and operating-system logs before maintenance. Do not label an unpatched vCenter compromised without evidence, but do not leave it reachable from general user, server, or vendor networks while awaiting a routine patch cycle.

Operational Notes:

  • vCenter 9.1: update to 9.1.0.0300.
  • vCenter 9.0: update to 9.0.2.0100.
  • vCenter 8.0: update to 8.0 U3k.
  • VMware Cloud Foundation 5.x requires the documented asynchronous vCenter patch to 8.0 U3k.
  • Telco Cloud deployments should follow Broadcom KB449886.
  • No workaround is available for either vCenter vulnerability.
  • CVE-2026-47876 affects ESX hosts using VMXNET3 and requires local administrative privileges within the guest.
  • For suspected compromise, examine new accounts, identity-source changes, role assignments, scheduled tasks, extension registrations, certificate changes, unusual API activity, VM reconfiguration, snapshots, exports, and unexpected access to guest consoles.
  • Separate vulnerability assessment from incident declaration: Broadcom has not reported exploitation or published campaign indicators.

Assessment Confidence: High — Attack paths, prerequisites, affected products, fixed versions, and absence of workarounds come directly from Broadcom; exploitation has not been reported.

Sources:

Broadcom — VMSA-2026-0006: VMware ESX, vCenter, Workstation, and Fusion Updates Address Multiple Vulnerabilities
Broadcom — VMSA-2026-0006 Supplemental FAQ

All on-premises TeamCity versions require protection against unauthenticated command execution

Priority: High

Intelligence Update:

JetBrains has disclosed CVE-2026-63077, an unauthenticated remote-code-execution vulnerability affecting every version of TeamCity On-Premises before the newly fixed branches.

An attacker with HTTP or HTTPS access to the TeamCity server can exploit the agent polling protocol to bypass authentication and execute operating-system commands with the privileges of the TeamCity server process. JetBrains fixed the flaw in TeamCity 2025.11.7 and 2026.1.3 and released a security patch plugin for versions 2017.1 and later.

JetBrains says it is not aware of active exploitation. TeamCity Cloud has already been protected, and JetBrains reports no evidence that its cloud environments were exploited through this vulnerability.

Assessment:

TeamCity is a high-value continuous-integration and continuous-delivery control plane. Server-process access may expose source-code connections, stored credentials, deployment tokens, build configurations, signing material, artifact repositories, and downstream production environments.

The absence of reported exploitation supports a patch-and-monitor posture rather than a universal compromise declaration. Nevertheless, unauthenticated command execution across all on-premises versions sharply limits the acceptable delay for externally or broadly reachable installations.

Operational Impact:

Update to a fixed release or apply the security patch plugin immediately. Restrict the web interface and agent-polling path to trusted networks while patching. If unexpected commands, project changes, agents, builds, artifacts, or credential use are discovered, isolate the server and validate downstream pipeline integrity before rotating exposed secrets.

Operational Notes:

  • Affected: all TeamCity On-Premises versions before 2025.11.7 or 2026.1.3.
  • Fixed: TeamCity 2025.11.7 and 2026.1.3.
  • Alternative: JetBrains security patch plugin for TeamCity 2017.1 and later.
  • Versions 2017.1 through 2018.1 require a server restart after plugin installation.
  • TeamCity 2018.2 and later can enable the plugin without a restart.
  • The plugin fixes only CVE-2026-63077; it does not supply the other security fixes included in current releases.
  • TeamCity Cloud requires no customer action for this vulnerability.
  • Review server and reverse-proxy logs for unexpected access to agent-polling functions.
  • Audit new agents, project and build-configuration changes, credential-store access, unfamiliar builds, artifact replacement, and unexpected commands executed under the TeamCity service account.
  • Rotate pipeline credentials only when exposure or compromise is plausible; indiscriminate pre-investigation rotation can destroy useful attribution and timing evidence.

Assessment Confidence: High — JetBrains directly confirms the affected scope, attack path, fixed versions, plugin option, and current absence of known exploitation.

Sources:

JetBrains — Critical Security Issue Affecting TeamCity On-Premises: CVE-2026-63077
JetBrains — TeamCity 2026.1.3 and 2025.11.7 Are Now Available
NVD — CVE-2026-63077 Detail

Patch / Upgrade Watch

Toptech fuel-terminal controllers expose an unauthenticated root debug interface

CISA’s July 30 industrial advisory describes CVE-2026-12562 in Toptech RCU II+ and Multiload II+, equipment used in terminal and loading operations. A reachable Target Communications Framework debug service requires no authentication and provides root-level access to the embedded Linux environment.

The vulnerability is adjacent-network exploitable rather than internet-wide by definition, but that does not make it low consequence. A poorly segmented terminal, vendor-access network, or compromised engineering workstation could supply the required reachability. RCU II+ and Multiload II+ firmware older than the November 24, 2025 build is affected. Install Toptech’s latest firmware and ensure the devices are unreachable from untrusted IT, wireless, vendor, and public networks. No active exploitation has been reported.

Source: CISA — ICSA-26-211-03: Toptech Systems RCU II+ and Multiload II+

wolfSSL 5.9.2 corrects certificate-verification and embedded TLS failures

wolfSSL has published version 5.9.2 with multiple security corrections. The most broadly important for server and embedded-product teams are CVE-2026-11310 and CVE-2026-11999, which can allow attacker-controlled certificate chains to be accepted by applications using the OpenSSL compatibility verifier with caller-supplied intermediates.

The native wolfSSL TLS handshake is not affected by those two specific flaws. Exposure depends on build flags and API use, so administrators should identify products embedding wolfSSL rather than scanning solely for a conventional installed package. Firmware and application vendors using OPENSSL_EXTRA, X509_verify_cert(), Raw Public Key support, PKCS#7, DTLS 1.3, or specialized hardware ports should review the full 5.9.2 correction set.

Source: wolfSSL — wolfSSL Security Vulnerabilities
Source: wolfSSL — wolfSSL 5.9.2 Release Notes

Rockwell controller certificate revocation requires configuration-specific remediation

CISA republished Rockwell Automation’s CVE-2026-9636 advisory on July 30. Affected CompactLogix 5380, ControlLogix 5580, GuardLogix, and 1756-EN4TR devices may accept certificates signed by an intermediate certificate authority that has been revoked.

The flaw affects only customers using the Certificate Revocation List feature with intermediate certificates. It is not known to be exploited. Corrected versions include V38.011 for the affected Logix controllers and V8.001 for 1756-EN4TR. Sites not using that certificate architecture are not affected by this specific weakness.

Source: Rockwell Automation — SD1788: CompactLogix 5380, ControlLogix 5580 / 1756-EN4 Communications Module — Certificate Revocation List Vulnerability
Source: CISA — ICSA-26-211-05

Detection / Monitoring Watch

Cisco FMC investigation must extend downstream

The /var/tmp/license.tmp event is the best currently published Cisco-specific pivot, but investigation should also cover changes made through the management platform. Compare firewall policies, network objects, administrator accounts, certificates, logging destinations, and deployments against trusted configuration history. An attacker may use information or authority obtained from FMC without leaving persistence on the management appliance itself.

Water utilities should hunt configuration changes, not actor names

Prioritize unexpected password changes, altered controller addresses, unexplained loss of engineering connectivity, new cellular paths, unknown programming sessions, disabled alarms, and deviations from controller baselines. Do not constrain collection to indicators associated with a presumed Iranian group. The public evidence establishes disruptive behavior; it does not establish one exclusive operator or toolset.

TeamCity and vCenter require integrity review where exposure was broad

For exposed TeamCity systems, review build definitions, build history, service-account execution, agent enrollment, stored-secret access, artifacts, and downstream deployments. For vCenter, review identity sources, permissions, scheduled tasks, extensions, certificates, VM exports, snapshots, console activity, and management API calls.

Neither vulnerability set is presently reported as exploited. Hunting should therefore be proportional to exposure and anomalies rather than presented as proof of an incident.

Lower-Priority Server-Risk Notes

The Ruflo MCP bridge flaw, CVE-2026-59726, received renewed reporting this week but was originally disclosed and fixed in version 3.16.3 on July 9. It can provide unauthenticated command execution where the default Docker Compose bridge endpoints are exposed, but there is no newly confirmed exploitation or change in the affected range. Ruflo deployments should still be inventoried; the story was not promoted as a new July 31 emergency.

CISA released additional July 30 industrial advisories covering Schneider Electric IGSS, open62541, libiec61850, lib60870, NASA Core Flight System components, Watchfire controllers, Mitsubishi CC-Link IE TSN, MikroTik RouterOS, and Johnson Controls OpenBlue Employee. Several deserve product-specific maintenance, but most involve adjacent access, authentication, specialized configurations, denial of service, or development components. None currently carries a confirmed exploitation report sufficient to displace today’s exposed PLC, Cisco FMC, vCenter, TeamCity, or Toptech priorities.

The Ruby on Rails Active Storage issue covered in the previous edition has gained additional secondary analysis but no newly confirmed exploitation, revised affected range, public compromise indicators, or vendor response change. It is therefore not repeated as a lead item.

Admin Action Checklist

  1. Remove directly exposed PLCs, programming interfaces, cellular modems, human-machine interfaces, and operational-technology gateways from public access.
  2. Validate controller addressing, passwords, project files, reusable modules, logic, alarms, interlocks, setpoints, and communications against trusted engineering baselines.
  3. Inventory on-premises Cisco Secure FMC and determine whether each device has received the correct release-specific CVE-2026-20316 hotfix.
  4. Preserve Cisco FMC logs and search for license activity involving /var/tmp/license.tmp and package_info.pl.
  5. If Cisco FMC exploitation is suspected, isolate the management interface, contact Cisco TAC, investigate downstream policy changes, and rotate device credentials, keys, and certificates.
  6. Restrict vCenter access to dedicated management systems and update vCenter 8.0, 9.0, 9.1, Cloud Foundation, and telco deployments according to VMSA-2026-0006.
  7. Patch TeamCity On-Premises to 2025.11.7 or 2026.1.3, or deploy the JetBrains security patch plugin while preparing a full upgrade.
  8. Audit exposed TeamCity and vCenter systems for unauthorized administrative activity, configuration changes, credential use, build changes, VM operations, and downstream effects.
  9. Update Toptech RCU II+ and Multiload II+ devices older than the November 24, 2025 firmware and block untrusted access to their management and debug services.
  10. Identify products embedding wolfSSL, determine build flags and compatibility APIs in use, and prioritize upgrading affected implementations to 5.9.2.
  11. Review Rockwell Logix and EN4TR deployments using certificate revocation with intermediate certificate authorities; install corrected firmware where applicable.

BCG Assessment

Today’s risks share a structural weakness: administrative reachability is being allowed to become operational authority. A public PLC interface permits direct physical disruption. A static FMC credential creates a path into centralized firewall administration. Network access to vCenter can become authority over a virtual estate, while HTTP access to TeamCity can become command execution inside the software-delivery system. The affected technologies differ, but the security failure is the same: an interface intended to translate legitimate administrative intent into system-wide action is reachable from a threat environment it was never designed to trust.

Correct sequencing matters. For confirmed exploitation and active operational disruption, first remove reachability, preserve evidence, establish a trusted recovery source, and determine what authority may already have been exercised. Patch only after that preservation step. For severe vulnerabilities without reported exploitation, aggressively restrict reachability and patch, but do not manufacture incident conclusions unsupported by evidence.

The strategic lesson is that control planes require protection based on the authority they convey, not the apparent sensitivity of the account or interface through which access begins. A “low-privileged” firewall-management account, a build-server polling protocol, a Syslog service, or a cellular PLC connection may look peripheral when assessed alone. In a critical system, each is a translation point where modest access can become broad administrative or physical consequence.

Jonathan Lockhart is a cybersecurity researcher and investigative journalist at bordercybergroup.com.

If you would like to support our work — useful, well-researched, ad-free cybersecurity intelligence — subscribe, comment, or buy us a coffee! Thanks.