Week of July 20, 2026: Russian Zero-Click Zimbra Campaign and Upbound's $13 Million Fraud Loss

Security leaders faced a joint U.S.-allied warning about a Russian zero-click campaign against Zimbra webmail, a Securities and Exchange Commission filing from Upbound Group describing cybersecurity incidents tied to $13 million in fraud losses, and six new entries added to CISA's Known Exploited Vulnerabilities catalog. The week of July 20, 2026 also brought an updated advisory on Iranian-affiliated targeting of programmable logic controllers and CISO transitions at Meta and Datavault AI.

CISA, NSA, FBI Warn of Russian Zero-Click Zimbra Campaign

On July 23, 2026, CISA joined NSA, the FBI, and international partners to publish a joint advisory on a Russian state-supported group known primarily as LAUNDRY BEAR targeting organizations that use Zimbra Collaboration Suite webmail. The advisory described a zero-click exploit that only required a user to view a malicious email to trigger data exfiltration, using a custom tool called Ulej to exploit CVE-2025-66376. More than 10 organizations across defense, government, law enforcement, technology, education, media, and nonprofit sectors were targeted since July 2025, with attackers attempting to steal email credentials and two-factor authentication tokens. (CISA)

CISA Adds Check Point and SharePoint Flaws to KEV Catalog

CISA added two vulnerabilities to its Known Exploited Vulnerabilities catalog on July 22, 2026, based on evidence of active exploitation: CVE-2026-16232, an improper authentication flaw in Check Point SmartConsole, and CVE-2026-50522, a deserialization of untrusted data vulnerability in Microsoft SharePoint. The agency reiterated that Binding Operational Directive 26-04 requires federal civilian agencies to prioritize remediation of catalog entries on internet-facing assets that grant full control after exploitation, while encouraging all organizations to apply the same risk-based approach to patching. (CISA)

CISA Adds Four More Exploited Vulnerabilities, Including Two in WordPress

A day earlier, on July 21, 2026, CISA added four additional vulnerabilities to the Known Exploited Vulnerabilities catalog: a stack-based buffer overflow in DD-WRT (CVE-2021-27137), an untrusted-control-sphere flaw in Langflow (CVE-2026-0770), and two WordPress Core issues, an interpretation conflict (CVE-2026-63030) and a SQL injection flaw (CVE-2026-60137). CISA again pointed to Binding Operational Directive 26-04 for federal remediation timelines and urged all organizations to treat these entries as high priority given confirmed active exploitation. (CISA)

Iran-Affiliated PLC Targeting Advisory Updated to Add Schneider, Siemens

On July 22, 2026, CISA, the FBI, EPA, and other partners updated an April 2026 advisory on Iranian-affiliated actors exploiting internet-connected programmable logic controllers, expanding the manufacturer scope beyond Rockwell Automation to include Schneider Electric and Siemens devices. The update added guidance for detecting malicious changes to reusable code modules in Rockwell PLC programs and additional mitigations. The underlying activity has disrupted PLCs across Water and Wastewater, Energy, and Government Facilities sectors by manipulating HMI and SCADA displays, producing operational disruption and financial loss. (CISA)

Upbound Group Discloses Cybersecurity Incidents Tied to $13 Million in Fraud Losses

Upbound Group filed an 8-K on July 21, 2026, disclosing cybersecurity incidents in which non-sensitive customer information and other documents were obtained without authorization. The company said the exposed information was subsequently used to facilitate fraudulent lease-to-own agreements, contributing to approximately $13 million in elevated fraudulent contract losses within its Acima segment during the second quarter of 2026. Upbound said it notified federal law enforcement, engaged external cybersecurity experts, added authentication and fraud-monitoring controls, and currently assesses the incidents as not material under its disclosure policy. (SEC EDGAR)