Another week, another batch of internet-facing masterpieces held together with hope, defaults, and apparently zero input validation. Let’s take a stroll through the latest ways vendors turned “known bad idea” into “shipping feature.”
This Week's Hall of Shame: Top CVEs
CVE-2026-20230 — Cisco’s WebDialer root-me side quest
The Gist: Cisco Unified Communications Manager and Unified CM SME are dealing with an SSRF flaw rated CVSS 8.6 that can be exploited remotely without authentication. It’s being exploited in the wild, public PoC code is out, and successful abuse can lead to file writes on the underlying OS and eventual elevation to root if WebDialer is enabled.
Why It Should Keep You Up at Night: This is the sort of bug that starts as “just SSRF” and then, because the universe enjoys irony, turns into root-level compromise. Cisco even slapped a Critical impact rating on it despite the numeric score saying High, which is corporate-speak for “yes, this is worse than it looks on the label.” If WebDialer is on, congratulations: your phone system may now also be a privilege-escalation hobby project.
Your Playbook:
- Patch affected Unified CM and Unified CM SME systems immediately using Cisco’s fixed releases.
- Verify whether the WebDialer service is enabled; if it’s not required, keep it disabled and review logs for suspicious crafted HTTP requests and unexpected file-write activity.
Sources: Rapid Risk Radar | Cisco Security Advisories | CVE Organization | Bleeping Computer
CVE-2026-45504 — Exchange serves up SSRF, because of course
The Gist: Microsoft Exchange Server has an SSRF vulnerability rated CVSS 8.8 that allows an authorized attacker to elevate privileges over the network. Patch guidance is available, PoC code exists, and while there’s no confirmed in-the-wild exploitation yet, Exchange has earned exactly zero benefit of the doubt.
Why It Should Keep You Up at Night: Exchange keeps showing up like a rebooted franchise nobody asked for, except the sequel is always “privilege escalation over the network.” The required low privileges are not much comfort when compromised accounts are practically a standard feature of modern intrusions. If you run on-prem Exchange, this is your reminder that “we’ll patch next cycle” is not a security strategy.
Your Playbook:
- Apply Microsoft’s June 2026 security updates for Exchange Server as soon as possible.
- Hunt for suspicious authenticated requests and signs of privilege escalation from low-privilege Exchange accounts, especially in environments with exposed or hybrid mail infrastructure.
Sources: Rapid Risk Radar | MSRC Security Updates | CVE Organization | Bleeping Computer
CVE-2026-7515 — WordPress plugin, same old cursed song
The Gist: BetterDocs Pro for WordPress, through version 3.8.0, is vulnerable to unauthenticated local file inclusion via the doc_style parameter. The bug carries a CVSS 9.8, is actively exploited, has public PoC details, and can lead to arbitrary PHP execution if attackers can get suitable files onto the server.
Why It Should Keep You Up at Night: This is the classic WordPress plugin arc: small convenience feature, enormous security hangover. Unauthenticated LFI on an internet-facing CMS is basically an engraved invitation to data theft, access-control bypass, and full code execution if the rest of the environment is even slightly messy—which, let’s be honest, it usually is. If your site runs a plugin zoo, this is why your weekends disappear.
Your Playbook:
- Update BetterDocs Pro beyond version 3.8.0 immediately, or disable/remove the plugin if no patched version is available in your environment.
- Review web server and WordPress logs for abuse of the
doc_styleparameter, unexpected PHP execution, and newly uploaded files in writable directories.
Sources: Rapid Risk Radar | CVE Organization | VulnCheck KEV
Industry Intel: What Else is On Fire This Week
-
DoJ Seizes Huione Cloud Account Tied to Cyber Scam Money Laundering — The Department of Justice yanked infrastructure allegedly tied to scam-money laundering, which is a nice reminder that “the cloud” also includes crime, apparently. Read more
-
FortiBleed Targeted FortiGate Firewalls in 110 Million-Credential Harvesting Operation — If your firewall is helping harvest 110 million credentials, it’s less “security appliance” and more “villain origin story.” Read more
-
Cisco Unified CM Flaw Exploited After PoC Reveals File-Write Path to Root — Because apparently dropping PoC details on a bug with a root path is still treated like a fun community activity instead of the opening scene of a disaster movie. Read more
Stay ahead of the threat landscape at Rapid Risk Radar — where CVEs get scored and prioritized so you don't have to panic-Google "is this bad" at 2am. Check out the platform and stop flying blind.