Weekly Threat Digest: 27 July to 02 August 2026

Summary

Arista patched a maximum-severity, unauthenticated OS command injection in VeloCloud Orchestrator (CVE-2026-16812), while Cisco disclosed an actively exploited zero-day rooted in static, built-in credentials in Secure Firewall Management Center (CVE-2026-20316).

TA488 ran an email campaign exploiting CVE-2026-42897 to deploy the disk-free OWAReaper backdoor. Cl0p-affiliated operators chained a FlexPLM WSDL disclosure with a Windchill login-servlet flaw (CVE-2026-12569) for unauthenticated RCE against internet-exposed PTC deployments.

---

Weekly Highlights

Insights

• Cisco's own firewall manager had a skeleton key baked in: CVE-2026-20316 turns static, built-in credentials into an actively exploited zero-day.
• A maximum-severity bug, zero credentials required: CVE-2026-16812 opened privileged internal functions of Arista's VCO to anyone remotely.
• CVE-2026-16723 gets RCE straight out of FastJson's default settings, already exploited in the wild.
• Cl0p's playbook again: pre-auth disclosure, one login servlet flaw, unauthenticated RCE — PTC Windchill data up for extortion via CVE-2026-12569.
• Just opening the email is the exploit: TA488's CVE-2026-42897 turns a glance at Outlook Web Access into OWAReaper, a backdoor that never touches disk.
• Built on Mirai's bones but far craftier, Tengu proves weak default Telnet passwords are still all it takes to build a botnet.

Threat Distribution: Backdoor, Botnet.

---

Geography

Targeted Countries

Targeting spanned 99 further countries across Europe, the Americas, Asia, and Africa; the full breakdown is available on the Uni5Xposure platform.

---

Adversary Tradecraft

Top MITRE ATT&CK TTPs

20 TTPs were mapped this week; the full ATT&CK matrix is available to Uni5 customers via Uni5Xposure.

---

Malware & Campaigns

Attacks Executed

OWAReaper

OWAReaper is a half-click backdoor and evolution of ZimReaper, running entirely inside the Outlook Web Access reading pane to rewrite the malicious email and harvest saved OWA credentials via Outlook APIs. It persists as an encrypted copy in the browser's localStorage under a legitimate OWA settings key, executing automatically whenever OWA is opened.

Tengu

Tengu is a Linux botnet derived from Mirai but more advanced in stealth and self-preservation, spreading via Telnet credential brute force across IoT and embedded Linux devices on multiple processor architectures.

---

Exploitation

Vulnerabilities Exploited

All five CVEs this week are tracked as Zero-Day, Celebrity Vulnerabilities and listed in the CISA KEV catalog.

CVE-2026-16812 — Arista VeloCloud Orchestrator OS Command Injection

CVE-2026-16812 is a maximum-severity, unauthenticated OS command injection flaw in the on-premises Arista VCO, used to centrally manage VeloCloud SD-WAN deployments and edge devices. It lets a remote attacker reach privileged internal functionality never intended for external exposure, without any credentials.

CVE-2026-12569 — PTC Windchill and FlexPLM Improper Input Validation

Cl0p-affiliated operators target internet-exposed PTC Windchill and FlexPLM deployments, chaining a pre-auth FlexPLM WSDL disclosure with this Windchill login servlet flaw (CVE-2026-12569) for unauthenticated RCE across all CPS (Critical Patch Set) versions prior to 11.0 M030.

Also Exploited

CVE-2026-16723 (Alibaba FastJson 1.x 1.2.68–1.2.83, CWE-502/CWE-20) is an unauthenticated RCE in FastJson's default deserialization settings, already exploited in the wild. CVE-2026-42897 (Microsoft Exchange Server, CWE-79) is the Outlook Web Access XSS flaw TA488 weaponized to deploy the OWAReaper backdoor — patch here. CVE-2026-20316 (Cisco Secure Firewall Management Center, CWE-259) is a static, built-in low-privilege credential affecting 7.0.x–7.7.x and 10.0.x builds prior to the fixed hot-fix — patch here. All three carry T1190 Exploit Public-Facing Application in their TTP chain.

---

Threat Actors

Adversaries in Action

TA488 (aka Void Blizzard, Laundry Bear)

TA488, also tracked as Void Blizzard or Laundry Bear, is a Russia-origin threat actor motivated by information theft and espionage, most recently weaponizing CVE-2026-42897 to deploy the OWAReaper backdoor.

TTPs: Spans Resource Development, Initial Access, Execution, Defense Evasion, Persistence, Credential Access, Collection, Command and Control, and Exfiltration — notably T1566 Phishing, T1203 Exploitation for Client Execution, T1555 Credentials from Password Stores, and T1041 Exfiltration Over C2 Channel. Full TTP mapping (30 techniques) is available via Uni5Xposure.

---

Guidance

Recommendations

Security Teams

Security teams should prioritize the five exploited vulnerabilities and block indicators tied to TA488 and OWAReaper, Tengu.

Uni5 Users

HivePro Uni5 customers get comprehensive threat exposure insights and can act on them effortlessly via the Uni5 dashboard.

---

Publications This Week

Threat Advisories

• Critical Zero-Day Hits Arista VeloCloud Orchestrator
• Cl0p-Linked Actors Exploit PTC Windchill and FlexPLM in Data Theft Campaign
• FastJson 1.x's Parting Gift: An Unpatched, Unauthenticated RCE
• TA488 Unleashes OWAReaper: A Half-Click Backdoor for Outlook Web Access
• Tengu: The Mirai Fork With a Resurrection Clause
• CVE-2026-20316: Cisco Secure FMC Skeleton Key Exploited as a Zero-Day

---

Definitions & Indicators

Appendix

Known Exploited Vulnerabilities (KEV): Vulnerabilities with public exploits or PoC code available, posing a high risk of harm to an organization's systems or data if unaddressed.

Celebrity Vulnerabilities: Vulnerabilities branded with catchy names and logos due to their profound, multifaceted impact, giving threat actors opportunities to breach sensitive systems and compromise critical information.

Indicators of Compromise (IOCs)

A comprehensive list of IOCs (Indicators of Compromise) associated with the executed attacks is available on the Uni5Xposure platform.

---

Next Steps