July 28 evening: Check Point MDS scope, vBulletin

Three updates that landed after the morning edition.

Check Point CVE-2026-16232 — Rapid7 analysis, MDS scope confirmed

Rapid7 published an independent technical analysis of CVE-2026-16232 today. Two additions to the picture.

Confirmed independently: The attack path works as described. An unauthenticated attacker with network access to the Management Server can extract a login token through the SmartConsole authentication process and authenticate with full administrator privileges. Rapid7 replicated this. Confidence: high.

New scope: Rapid7 explicitly identifies Multi-Domain Security Management Server (MDS) as within scope. Check Point’s original July 22 advisory scoped the flaw to Security Management Server only. MDS operators who were not tracking this — because the original advisory didn’t name them — are in scope.

What hasn’t changed: CISA added CVE-2026-16232 to KEV on July 22. BOD 26-04 federal patching clock has been running for six days. Exploitation requires network reachability to the Management Server — Trusted Client restrictions, if configured, close the remote path.

Patch: Check Point advisory sk185169. Full coverage: Check Point CVE-2026-16232: Rapid7 Technical Analysis. Original disclosure coverage: Check Point SmartConsole Flaw Added to KEV.

vBulletin — pre-auth RCE patched, public exploit live

vBulletin has patched a critical unauthenticated remote code execution vulnerability in its template rendering engine. PHP template injection. No login, no admin access, no user interaction required. A public proof-of-concept is already circulating. CVE identifier not confirmed in public advisories at time of writing.

Patch is available via vBulletin’s official support portal and announcements forum. If patching is not immediate: minimize internet exposure of the admin interface. That reduces attack surface; it does not close the underlying vulnerability in the main application.

Automated scanner pickup typically follows PoC release within hours for this vulnerability class. Full coverage: vBulletin patches pre-auth RCE; public exploit is out. Confidence: confirmed patch and public PoC, CVE ID pending.

Talos Q2 2026 IR — phishing leads, RMM tools displace custom malware

Talos published its Q2 2026 incident response trend data. Two findings worth operationalizing.

Phishing remains the dominant initial access vector. This is not a new finding. The Q2 data says it is still dominant. Defenses that are not specifically built around phishing-resistant authentication are not keeping pace with the primary entry point.

Legitimate RMM tools have displaced custom malware as the persistence mechanism of choice. Level, ScreenConnect, ConnectWise, TeamViewer — the same tools enterprise IT deploys for authorized management. An attacker-installed RMM agent and a helpdesk-installed one produce identical telemetry. If you do not have a clean inventory of authorized RMM deployments in your environment, you cannot tell them apart.

Operation BlueDash demonstrated this last week: phishing via counterfeit Teams update page → Level RMM and ScreenConnect delivered. Not custom malware. The Q2 data says that case is representative. Full coverage: Q2 IR: Phishing and RMM Abuse Lead Attack Chains.

What to watch

1. Check Point MDS patches. If your organization runs MDS and was tracking this advisory against Security Management Server scope only, recheck. MDS is affected.
2. vBulletin CVE assignment. When the CVE ID appears in NVD, CISA watchlist automation fires. Track the assignment and set remediation priority against your install base accordingly.
3. FastJson 1.x. No patch as of this writing. US firm targeting confirmed yesterday. Mitigation is WAF-layer blocking or migration to Fastjson 2.x.

— airgap