Cyber Centre Daily Advisory Digest — 2026-07-30 (6 advisories)

What Happened

A government cybersecurity agency published six security warnings on July 30, 2026, covering products from Cisco, GitLab, Spring, Adobe, Plesk, and Phoenix Contact. The most urgent warning is for Cisco's firewall management software, which has a vulnerability involving hardcoded (static) credentials that attackers are already exploiting in the wild — it has been added to a US government list of known exploited vulnerabilities. Spring's development tools also have multiple serious flaws, including one that could let attackers run arbitrary code and another that exposes debugging ports without authentication. Plesk, a web hosting control panel, has a vulnerability that could allow attackers to extract data from its database. Organizations using any of these products should review the advisories and apply patches as soon as they are available, prioritizing the Cisco FMC vulnerability due to active exploitation.

Key Takeaways

• CVE-2026-20316 in Cisco Secure Firewall Management Center (FMC) is being actively exploited and has been added to CISA's Known Exploited Vulnerabilities (KEV) Database — patch immediately.
• Spring Tools for Eclipse and VSCode/Cursor/Theia have 6 CVEs including remote code execution (CVE-2026-47858) and unauthenticated debug port exposure (CVE-2026-47873).
• Plesk versions prior to 18.0.79.4 are vulnerable to blind SQL injection via the XML-RPC API (CVE-2026-58046).
• Phoenix Contact CHARX SEC3xxx charging controllers (prior to 1.9.1) have multiple firmware vulnerabilities affecting OT/ICS environments.
• GitLab versions prior to 19.0.5, 19.1.3, and 19.2.1 have unspecified vulnerabilities requiring patch releases.

Affected Systems

• Cisco Secure Firewall Management Center (FMC) prior to 7.0.9.1, 7.2.11.1, 7.4.7.1, 7.6.5.1, 7.7.12.1, 10.0.1.1
• GitLab prior to 19.0.5, 19.1.3, 19.2.1
• Spring Tools for Eclipse prior to or equal to 5.2.0
• Spring Tools for VSCode / Cursor / Theia prior to or equal to 2.2.0
• Adobe Campaign Classic all versions except 7.4.3 build 9398
• Plesk prior to 18.0.79.4
• Phoenix Contact CHARX SEC-3000, SEC-3050, SEC-3100, SEC-3150 prior to firmware 1.9.1

Vulnerabilities (CVEs)

Attack Chain

1. Initial Access: Exploit CVE-2026-20316 static credential vulnerability in Cisco FMC to gain unauthorized access to firewall management infrastructure
2. Persistence: Leverage static credentials to maintain persistent access to firewall management plane
3. Lateral Movement: Use compromised FMC to reconfigure firewall policies and enable further network traversal
4. Discovery: Enumerate managed firewall policies and network topology via FMC administrative interface

Detection Availability

• YARA Rules: No
• Sigma Rules: No
• Snort/Suricata Rules: No
• KQL Queries: No
• Splunk SPL Queries: No
• EQL Queries: No
• Other Detection Logic: No

No detection rules or queries are provided in this advisory digest. The article links to vendor advisories and CISA KEV for patch and remediation guidance only.

Detection Engineering Assessment

Required Log Sources

• Cisco FMC authentication and configuration change logs
• Web application firewall logs for Plesk XML-RPC API
• Network flow logs for unexpected JDWP/JMX port connections
• IDE and developer workstation process logs
• OT/ICS network logs for Phoenix Contact CHARX devices

Hunting Hypotheses

Control Gaps

• Static credential vulnerabilities like CVE-2026-20316 may not be detected by signature-based network security monitoring since exploitation uses valid credentials.
• Developer workstation IDE plugin behavior (Spring Tools) is often not monitored by EDR or network security tools.
• OT/ICS devices like Phoenix Contact CHARX controllers may lack logging and monitoring capabilities standard in IT environments.
• Blind SQL injection in Plesk XML-RPC API may not trigger WAF rules if requests appear structurally valid.

Key Behavioral Indicators

• Authentication to Cisco FMC from previously unseen source IPs or outside management network segments
• Inbound network connections to JDWP (port 8000 or similar) or JMX ports on developer workstations
• Unusual volume or patterns of requests to Plesk XML-RPC API endpoints
• Configuration changes on Cisco FMC outside of approved change windows
• Firmware modification attempts on Phoenix Contact CHARX SEC3xxx controllers

False Positive Assessment

Recommendations

Immediate Mitigation

Infrastructure Hardening

• Evaluate whether network segmentation can restrict access to Cisco FMC management interfaces to dedicated management networks only.
• Consider implementing WAF rules to inspect and filter requests to Plesk XML-RPC API endpoints for SQL injection patterns.
• If applicable to your OT environment, consider network segmentation for Phoenix Contact CHARX SEC3xxx charging controllers and restrict management interface access.
• Evaluate whether GitLab instances can be updated to versions 19.0.5, 19.1.3, or 19.2.1 or later to address unspecified vulnerabilities.

User Protection

• Consider pushing updates to Spring Tools for Eclipse (beyond 5.2.0) and Spring Tools for VSCode/Cursor/Theia (beyond 2.2.0) across all developer workstations.
• If developer workstations cannot be immediately patched, consider deploying host firewall rules to block inbound JDWP and JMX ports.
• Evaluate whether Adobe Campaign Classic can be updated to 7.4.3 build 9398 or later.

Security Awareness

• Consider notifying development teams about the Spring Tools vulnerabilities and the importance of applying IDE plugin updates promptly.
• If your organization uses Phoenix Contact CHARX controllers, consider informing OT/ICS teams about the firmware update requirement and the importance of restricting physical and network access to charging controllers.

MITRE ATT&CK Mapping