Weekend Security Maintenance: The 7 Cyber Stories Australian SMBs Must Know Before Monday

---

1. FortiBleed: 74,000 Fortinet Devices Compromised — Are Yours Among Them?

CISA issued an alert on June 18 urging all Fortinet customers to immediately harden FortiGate firewalls and SSL VPN gateways after reports emerged that malicious actors have been targeting internet-accessible Fortinet devices using leaked credentials. The campaign, dubbed "FortiBleed" by researchers, has exposed credentials for approximately 74,000 devices — roughly half of all internet-facing Fortinet firewalls globally, spanning 194 countries.

Why it matters to Australian SMBs: Fortinet FortiGate firewalls are one of the most common perimeter devices used by Australian small and mid-size businesses. If your organisation has a Fortinet firewall with an internet-facing management interface or SSL VPN portal, you should assume your credentials may be in the leaked dataset. This is not a theoretical risk — attackers are actively using these credentials to log in.

Do this today:

• Terminate all active SSL VPN and admin sessions on every FortiGate device
• Reset all Fortinet VPN and administrative passwords — especially on internet-facing systems
• Enforce PBKDF2 password hashing and remove legacy weak hashes (per Fortinet's guidance for FortiOS v7.2.11+)
• Enable phishing-resistant MFA on all remote access and admin accounts
• Restrict management interfaces to trusted internal networks only — never expose admin to the public internet
• Review firewall, VPN, authentication, and domain controller logs for lateral movement, unusual access, or unauthorised config changes

2. New CVEs Added to CISA's Known Exploited Vulnerabilities Catalog

CISA added multiple new entries to its Known Exploited Vulnerabilities (KEV) catalog this week — these are vulnerabilities confirmed to be actively exploited in the wild, not theoretical risks. The catalog now stands at 1,623 entries total.

Top entries added this week:

• CVE-2026-20253 (Splunk Enterprise) — Missing authentication for a critical function allows unauthenticated users to create or truncate arbitrary files through a PostgreSQL sidecar service endpoint. Date added: June 18. CISA remediation due date: June 21 (this Sunday). If you run Splunk Enterprise, this is a same-day fix.

• CVE-2026-48907 (Widget Factory Joomla Content Editor) — Improper access control allows unauthenticated users to upload and execute arbitrary PHP code via creation of new editor profiles. Date added: June 16. CISA due date was June 19 — if you haven't patched yet, you're already past the deadline. Any Joomla site using the Widget Factory Content Editor plugin needs immediate patching or removal of the plugin.

• Multiple additional KEV additions throughout the week — CISA posted at least 10 separate "Adds Known Exploited Vulnerability" alerts, indicating sustained threat actor activity across diverse vendor ecosystems.

Why it matters: The KEV catalog is the gold standard for patch prioritisation. If a CVE is on this list, attackers are already using it. Australian SMBs should subscribe to KEV catalog updates and treat any matching software in their environment as an emergency patch — not a scheduled maintenance item.

3. Google Chrome: Batch of High-Severity Vulnerabilities

The National Vulnerability Database published a cluster of high-severity Chrome CVEs (CVE-2026-9990 through CVE-2026-9999) affecting versions prior to 148.0.7778.216. These include:

• Sandbox escape vulnerabilities via use-after-free bugs in Input, Core, Views, and Network components
• Out-of-bounds read in WebRTC allowing information disclosure from process memory
• Integer overflow in Skia enabling potential sandbox escape from a compromised renderer
• Use-after-free in WebXR and WebAppInstalls enabling code execution

Why it matters: Chrome is the dominant browser in Australian workplaces. While many of these require a compromised renderer process as a prerequisite, the chain from a malicious web page to full sandbox escape is shorter than most assume. Ensure all Chrome installations are updated to 148.0.7778.216 or later across every device — including personal devices used for work.

4. Regulatory Watch: Australian Privacy Act and Notifiable Data Breach Obligations

With FortiBleed affecting organisations across 194 countries, Australian businesses need to be thinking about their obligations under the Notifiable Data Breach (NDB) scheme. If a Fortinet credential leak leads to unauthorised access to personal information held by your organisation, and that access is likely to result in serious harm to individuals, you have a legal obligation to assess and notify.

Key obligations under the Privacy Act:

• Assess within 30 days of becoming aware of a suspected breach
• Notify the OAIC and affected individuals if the breach is likely to result in serious harm
• Document every step of your assessment — failure to assess is itself a compliance failure
• Apply the Essential Eight — the ACSC's baseline mitigation strategies remain the most cited control set in Australian breach investigations

Practical step this weekend: If you run Fortinet devices, document your credential reset and log review process now. If you later discover unauthorised access occurred, having a timestamped record of your response actions strengthens your position with the OAIC.

5. Threat Actor Activity: Active Exploitation Pace Remains High

The volume of KEV catalog additions this week — at least 10 separate alerts — signals sustained, broad-spectrum exploitation by threat actors. The FortiBleed campaign alone demonstrates that credential leak databases are being operationalised at scale. Threat actors are not waiting for zero-days; they are weaponising known vulnerabilities and leaked credentials faster than organisations can patch.

Key indicators this week:

• Credential-based attacks on network edge devices (FortiBleed)
• Web application plugin exploitation (Joomla Content Editor)
• Enterprise SIEM platform targeting (Splunk Enterprise)
• Browser-based exploit chains (Chrome sandbox escapes)

The pattern is clear: attackers are hitting every layer — perimeter, application, SIEM, endpoint. No single control is sufficient.

---

Patches to Apply This Weekend

Priority	CVE / Issue	Software	Deadline
Critical	FortiBleed credential leak	Fortinet FortiGate / FortiOS	Immediately
Critical	CVE-2026-20253	Splunk Enterprise	June 21 (Sunday)
Critical	CVE-2026-48907	Joomla Widget Factory Content Editor	Past due — patch now
High	CVE-2026-9990–9999	Google Chrome < 148.0.7778.216	Update all devices
High	All June 2026 KEV additions	Check CISA KEV catalog	Per due dates

---

Threat Level This Week: ELEVATED

Active exploitation of Fortinet credentials plus 10+ new KEV entries in a single week indicates a high-tempo threat environment. Australian SMBs with Fortinet perimeter devices are at direct risk. Treat this weekend as an active maintenance window, not a break.

---

What to Watch Next Week

• FortiBleed fallout: Expect follow-on advisories as researchers analyse which organisations were actively breached using leaked credentials. Australian-specific impact assessments may emerge from the ACSC.
• Additional KEV additions: The pace of 10+ additions per week suggests more are coming. Monitor the CISA KEV catalog RSS feed.
• Privacy Act reform: Watch for any movement on the Australian Government's Privacy Act review — proposed changes to penalties and the small business exemption could shift SMB obligations significantly.
• Chrome exploit chains: Researchers may publish proof-of-concept code for the Chrome sandbox escape cluster, raising the risk of in-the-wild exploitation.

---

FAQ

Conclusion

This week's threat landscape demands action, not awareness. FortiBleed alone puts every Australian SMB with a Fortinet firewall at direct risk of credential-based compromise, and the cascade of new KEV catalog entries means threat actors have a widening toolkit to work with. Block out Saturday morning: reset your Fortinet credentials, patch Splunk and Joomla if you run them, update Chrome everywhere, and document every action you take in case you need to demonstrate compliance to the OAIC later.

Security is our religion, privacy is our drive. Don't let Monday morning be the first time you think about this week's threats.

Visit consult.lil.business for a free cybersecurity assessment.

---

References

1. CISA Alert: CISA Urges Hardening Fortinet Devices After Reports of Credential Exposure
2. CISA Known Exploited Vulnerabilities Catalog
3. NIST National Vulnerability Database — Recent CVE Publications
4. Office of the Australian Information Commissioner — Notifiable Data Breaches Scheme
5. Australian Cyber Security Centre — Essential Eight Maturity Model