Weekly Threat Landscape Digest – Week 33

1. SAP August 2026 Security Updates

Overview

• SAP released August 2026 security updates addressing multiple vulnerabilities across its product portfolio.
• Vulnerabilities include improper authorization, code injection, memory corruption, privilege escalation, buffer overflow, credentials disclosure, directory traversal, missing authorization checks, XML external entity injection, SQL injection, cross-site scripting, OS command injection, and use of vulnerable third-party components.
• Key affected products: SAP Commerce Cloud, SAP Manufacturing Integration and Intelligence, SAP NetWeaver and ABAP Platform, SAP BusinessObjects BI Platform, SAP Change and Transport System Attach Tool, SAP ABAP Developer Tools, SAP Business AI Platform (Approuter), SAP S/4HANA, SAP Advanced Planning and Optimization, and SAP Data Services Management Console.

Impact

• Critical impact includes potential unauthorized data access, remote code execution, privilege escalation, and memory corruption leading to possible system compromise.
• High and medium severity issues may allow attackers to execute arbitrary code, disclose sensitive information, escalate privileges, or bypass security controls.
• Several vulnerabilities affect authorization checks, increasing risk of unauthorized actions.
• Some flaws involve injection attacks potentially exploited for full system takeover.

Affected / Fixed Versions

• Detailed affected versions and fixed releases are described in SAP’s official advisory.

Recommendations

• Update affected SAP products to the fixed or latest versions provided in the August 2026 security notes.
• Review and apply all relevant security patches promptly to mitigate risks.
• Monitor for any suspicious activity potentially linked to these vulnerabilities.
• Share relevant information with subsidiaries and partners for coordinated defense.

Reference Links

• https://support.sap.com/en/my-support/knowledge-base/security-notes-news/august-2026.html

2. Zoom Security Patches – RCE and Information Disclosure in Zoom Clients

Overview

• Zoom released security patches addressing multiple vulnerabilities in Zoom Clients including remote code execution, denial of service, and information disclosure issues.
• CVE-2026-53413 (CVSS 8.3): Buffer overwrite via missing bounds check in annotator function enabling remote code execution by meeting participants.
• CVE-2026-53415 (CVSS 8.3): Use-after-free in annotator function allowing remote code execution by meeting participants.
• CVE-2026-53416 (CVSS 7.1): Path traversal in Zoom VDI Client and Plugins enabling authenticated users local information access.
• CVE-2026-53414 (CVSS 6.5): Buffer over-read in annotator function possibly leading to denial of service.

Impact

• Remote code execution risks to participants in Zoom meetings via network exposure.
• Potential denial of service conditions.
• Unauthorized information disclosure through local access in VDI environments.

Affected / Fixed Versions

• Zoom Workplace: fixed in versions 7.1.5 or 7.0.6 and later.
• Zoom Workplace VDI Client for Windows: fixed in versions 7.0.11 or 6.6.16 and later.
• Zoom Workplace VDI Plugins: fixed in versions 7.0.11 or 6.6.15 and later.
• Zoom Rooms: fixed in version 7.1.5 and later.
• Zoom Meeting SDK: fixed in version 7.1.5 and later.

Recommendations

• Update affected Zoom products to the fixed or latest versions immediately.
• Verify deployment of patches across all organizational Zoom client installations, especially in VDI environments.

Reference Links

• https://www.zoom.com/en/trust/security-bulletin/

3. Security Updates – Google Chrome (August 12, 2026)

Overview

• Google released security updates for Chrome to address multiple high-severity use-after-free vulnerabilities in V8, TabStrip, Extensions, HTML, and Blink components.
• Exploitation could result in memory corruption, crashes, or arbitrary code execution within the browser context.

Impact

• CVE-2026-19556: Use-After-Free in V8.
• CVE-2026-19557: Use-After-Free in TabStrip.
• CVE-2026-19558: Use-After-Free in Extensions.
• CVE-2026-19559: Use-After-Free in HTML.
• CVE-2026-19560: Use-After-Free in Blink.

Affected / Fixed Versions

• Fixed in Chrome 151.0.7922.137/.138 for Windows and Mac, and 151.0.7922.137 for Linux.
• Android update: Chrome 151.0.7922.137.
• Extended Stable Channel: Chrome 150.0.7871.230 for Windows and Mac.

Recommendations

• Update Google Chrome to the latest available version to mitigate these vulnerabilities.

Reference Links

• https://chromereleases.googleblog.com/2026/08/stable-channel-update-for-desktop_01815628406.html
• https://chromereleases.googleblog.com/

4. Microsoft August 2026 Patch Tuesday – 398 CVEs Including 3 Zero-Days

Overview

• Microsoft released August 2026 security updates fixing multiple vulnerabilities across its products.
• The update addresses 398 CVEs, including three zero-day vulnerabilities (one actively exploited, two publicly disclosed).
• The release includes 42 Critical-severity vulnerabilities, with 37 remote code execution (RCE) flaws.

Impact

• CVE-2026-68820 (actively exploited): Use-after-free in Windows Ancillary Function Driver for WinSock allows authenticated local attackers to elevate privileges to SYSTEM.
• CVE-2026-62832 (publicly disclosed): Elevation of privilege in Windows User Profile Service through improper link resolution.
• CVE-2026-72971 (publicly disclosed): Tampering vulnerability in Windows Container Isolation FS Filter Driver usable by authenticated local attackers.
• CVE-2026-62893 (Critical): RCE in Windows Deployment Services TFTP Server exploitable by unauthenticated remote attackers.
• CVE-2026-62823 (High): Heap-based buffer overflow in Windows DHCP Server enabling remote unauthenticated code execution over adjacent network.

Recommendations

• Apply all Microsoft August 2026 security updates promptly to mitigate active and potential exploitation.
• Prioritize patches for zero-day and critical remote code execution vulnerabilities.

Reference Links

• https://msrc.microsoft.com/update-guide/releaseNote/2026-Aug
• https://www.tenable.com/blog/microsofts-august-2026-patch-tuesday-addresses-398-cves-cve-2026-68820

5. Critical Vulnerabilities in IBM App Connect Enterprise, Power HMC, and webMethods

Overview

• Multiple critical vulnerabilities identified in IBM App Connect Enterprise, Power Hardware Management Console (HMC), and webMethods Integration Server.
• Vulnerabilities allow unauthenticated attackers to execute arbitrary commands or code, or write files to arbitrary locations.

Impact

• CVE-2026-12943 (Power HMC): Improper input validation enabling unauthenticated command execution with elevated privileges.
• CVE-2026-12118 (webMethods Integration): Deserialization of untrusted data allowing arbitrary code execution.
• CVE-2026-15435 (App Connect Enterprise): Path traversal permitting arbitrary file writes, potentially facilitating further system compromise.

Affected / Fixed Versions

• IBM App Connect Enterprise versions 12.0.1.0–12.0.12.27 and 13.0.1.0–13.0.7.2; fixed in 12.0.12.28 and 13.0.8.0.
• IBM Power HMC versions V10.3.1050.0–V10.3.1064.0 and V11.1.1110.0–V11.1.1112.0; apply security updates from IBM Fix Central.
• IBM webMethods Integration Server versions 10.11 and 10.15; remove WmServiceMock package from production and internet-facing systems.

Recommendations

• Upgrade IBM App Connect Enterprise to versions 12.0.12.28 or 13.0.8.0.
• Apply applicable Power HMC security updates from IBM Fix Central.
• Remove WmServiceMock package from production and internet-facing webMethods Integration Server instances.

Reference Links

• https://www.ibm.com/support/pages/node/7278667
• https://www.ibm.com/support/pages/node/7278857
• https://www.ibm.com/support/pages/node/7281896

6. Multiple Vulnerabilities in WordPress Prior to 7.0.3

Overview

• Multiple vulnerabilities discovered in WordPress versions prior to 7.0.3, including a high-severity pre-authentication reflected XSS (CVE-2026-64638, CVSS 8.9).
• Additional issues addressed include stored XSS vulnerabilities, a multisite privilege escalation flaw, SSRF vulnerability, and information disclosure risks.

Impact

• Reflected XSS vulnerability allows attackers to execute malicious scripts in victim browsers, potentially leading to remote code execution through social engineering.
• Privilege escalation and information disclosure could compromise site integrity and sensitive data.

Affected / Fixed Versions

• Affected: WordPress versions before 7.0.3.
• Fixed: WordPress 7.0.3 and later; fixes backported to supported branches dating back to version 4.7.

Recommendations

• Update all WordPress installations to version 7.0.3 or later.
• Apply security patches to all supported WordPress branches.
• Implement web security best practices and monitor for suspicious activity.

Reference Links

• https://www.cve.org/CVERecord?id=CVE-2026-64638
• https://patchstack.com/articles/wordpress-7-0-3-released-12-vulnerabilities-found-and-fixed/

7. N-able N-central Authentication Bypass (CVE-2026-18556 / CVE-2026-18577) – Active Exploitation

Overview

• N-able N-central contains two authentication bypass vulnerabilities, CVE-2026-18556 and CVE-2026-18577 (an incomplete fix for CVE-2026-18556).
• Both vulnerabilities allow remote attackers to bypass authentication and gain administrative access.
• CVSS score: 8.2 (High). Active exploitation observed in the wild.

Impact

• Remote attackers can gain full administrative access to N-central servers and any systems managed through the platform.
• Successful compromise may lead to persistence and long-term control of affected environments.

Affected / Fixed Versions

• Affected: N-able N-central versions prior to 2026.3.1.7.
• Fixed: Update immediately to N-central version 2026.3.1.10 (Hotfix 2), which supersedes Hotfix 1.

Recommendations

• Apply the latest update, N-central 2026.3.1.10, without delay.
• Monitor systems for unauthorized access or suspicious activity.
• Investigate and contain activity linked to IoCs: 173.249.252.176, 173.249.252.200, 185.156.46.150, 23.234.94.43, 37.153.90.88, 37.19.210.32, 68.235.46.214, 68.235.46.235, 87.249.138.34, 92.118.112.181.
• Continuously review logs, accounts, and network traffic for signs of intrusion.

Reference Links

• https://www.n-able.com/blog/n-central-security-update-august-6-2026
• https://status.n-able.com/2026/08/06/n-central-2026-3-hotfix-2-additional-mitigation-for-cve-2026-18577/
• https://www.cve.org/CVERecord?id=CVE-2026-18556
• https://www.cve.org/CVERecord?id=CVE-2026-18577

8. Multiple Vulnerabilities in Jenkins Core and Plugins

Overview

• Multiple vulnerabilities identified in Jenkins core and several plugins, including critical deserialization bypass (CVE-2026-70426) enabling remote code execution on Jenkins controllers.
• Additional high-severity flaws include arbitrary file creation (CVE-2026-70427), path traversal (CVE-2026-70428), privilege escalation (CVE-2026-70429), and code execution in the Multijob Plugin (CVE-2026-70431, CVE-2026-70432).
• Other issues involve stored XSS, XXE in Ivy Report Plugin, missing permission checks, CSRF, credential exposure, unauthorized access, and timing attacks.

Impact

• Exploitation may lead to arbitrary code execution on Jenkins controllers, unauthorized file writes, privilege escalation, credential exposure, unauthorized workspace access, and XSS attacks.

Affected / Fixed Versions

• Jenkins weekly up to 2.575; update to 2.576.
• Jenkins LTS up to 2.568.1; update to 2.568.2.
• External Workspace Manager Plugin up to 1.4.1; update to 1.4.2.
• HCL AppScan Plugin up to 1.8.3; update to 1.8.4.
• Multijob Plugin up to 669.v9d96a_d9c71b_0; update to 677.v7ffc23d6a_4c2.
• SCM-Manager Plugin up to 1.11.1; update to 1.12.1.
• Webhook Secret Credentials Provider Plugin up to 16.v0cfa_f0215cf5; update to 32.v09c9b_522f0a_8.
• No fixes currently available for AWS CodeBuild, CodeSonar, Google Chat Notification, Horreum, Ivy Report, Parameterized Remote Trigger, Qualys Container Scanning Connector, Sauce OnDemand, Summary Display, Violation Comments to GitLab, and XML Job to Job DSL plugins.

Recommendations

• Update Jenkins core and plugins to patched versions where available.
• Disable or remove vulnerable plugins without available updates.
• Restrict administrative and system access to Jenkins environments.
• Monitor Jenkins systems for suspicious or unauthorized activities.

Reference Links

• https://www.jenkins.io/security/advisory/2026-08-05/

9. Critical Auth Bypass and Privilege Escalation in HPE Aruba Private 5G Core

Overview

• HPE Aruba Networking Private 5G Core is impacted by multiple vulnerabilities in third-party components Traefik and Grafana, including authentication bypass and privilege escalation.

Impact

• CVE-2026-54763 (Traefik, CVSS 10.0): Allows unauthenticated remote attackers to bypass authentication and spoof identity via crafted HTTP headers.
• CVE-2026-33377 (Grafana, CVSS 7.1): Allows authenticated Grafana Editors with write access to escalate privileges to administrator on dashboards.

Affected / Fixed Versions

• Affected: HPE Aruba Networking Private 5G Core versions 1.26.1.2 and earlier.
• Fixed: Version 1.26.1.3 and later.

Recommendations

• Update HPE Aruba Networking Private 5G Core to version 1.26.1.3 or later to remediate these vulnerabilities.

Reference Links

• https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05119en_us&docLocale=en_US

10. Multiple ClamAV Vulnerabilities in Cisco Secure Endpoint Products

Overview

• Multiple high-severity vulnerabilities discovered in ClamAV used by Cisco Secure Endpoint products.
• Issues include out-of-bounds write, memory corruption, and integer overflow during processing of ZIP, PESpin, GPT, PDF, Mach-O, and XAR file formats.
• Exploitation can cause denial of service by terminating the ClamAV scanning process; some vulnerabilities may lead to broader memory corruption impacts.
• Proof-of-concept code publicly available for CVE-2026-20337 and CVE-2026-20338.

Impact

• Denial of service via termination of ClamAV scanning processes.
• Potential for broader memory corruption effects.

Affected / Fixed Versions

• Affected: Cisco Secure Endpoint Connector for Windows, Linux, and Mac.
• Fixed versions planned for August 2026 release (exact versions TBD).
• Cisco Secure Endpoint Private Cloud fixed in version 4.2.8 and later.

Recommendations

• Apply relevant security updates immediately upon availability.
• Prioritize remediation for systems exposed to untrusted or malicious files.
• Monitor systems for unusual scanning failures or service disruptions.

Reference Links

• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-clamav-WuuvVd26

11. New DRAM Scrambling Attack Exposes CPU’s Most Protected Memory Zones

Overview

• Researchers revealed an attack technique manipulating the memory controller’s address-translation logic, bypassing hardware security boundaries like System Management Mode, Platform Security Processor, and CPU microcode protections.
• By flipping configuration bits, attackers can redirect protected addresses to accessible DRAM cells, undermining protections for technologies like SEV, SGX, TDX, TrustZone, and firmware memory carveouts.
• The vulnerability is a structural issue: the address transform is a linear operation over GF(2), which can be reverse-engineered using linear algebra and SMT solvers.
• Proof-of-concept demonstrated on AMD Family 16h processors; the attack likely affects a broad range of modern CPUs including Intel, ARM, and RISC-V.

Impact

• Unauthorized access to highly protected memory regions, including secure processor memory and CPU microcode.
• Potential for reading and modifying critical firmware and CPU runtime state, undermining root-of-trust components.
• Challenges existing hardware security models, as protections above the memory controller fail to detect remapping.

Recommendations

• Monitor forthcoming research and vendor advisories following detailed presentation at Black Hat 2026.
• Evaluate and harden system architectures against low-level memory controller manipulation.
• Prepare SOC visibility enhancements to detect exploitation attempts targeting memory controller configurations.

Reference Links

• https://cybersecuritynews.com/dram-scrambling-attack/

12. USN-8631-3: Linux Kernel (NVIDIA Tegra IGX) Vulnerabilities

Overview

• Affected Linux kernel contains multiple security flaws across various subsystems including x86 architecture, InfiniBand and network drivers, NVME, Ext4, SMB, IPv4/IPv6 networking, TCP and SCTP protocols, and others.
• A notable issue involves improper handling of aggregated frames in WiFi mesh networks (CVE-2025-27558), allowing physically proximate attackers to inject packets.

Impact

• Exploitation of these vulnerabilities could allow attackers to compromise system integrity, execute unauthorized code, or disrupt network communications.

Affected / Fixed Versions

• Linux kernel versions including NVIDIA Tegra IGX affected; updates issued to address these issues.

Recommendations

• Apply the security updates released by Ubuntu promptly to mitigate these vulnerabilities.

Reference Links

• https://ubuntu.com/security/notices/USN-8631-3

13. USN-8529-2: Linux Kernel Vulnerabilities – Fragnesia (CVE-2026-43503)

Overview

• A logic flaw called Fragnesia (CVE-2026-43503) was found in the XFRM ESP-in-TCP subsystem, enabling local attackers to escalate privileges or escape containers.
• Multiple security vulnerabilities identified across various Linux kernel subsystems including InfiniBand, SCSI, Thermal, USB over IP, NFS, SMB, B.A.T.M.A.N. meshing, Ethernet bridge, Ceph, DCCP, IPv4/IPv6, Netfilter, RxRPC, and X.25.

Impact

• Potential privilege escalation, container escape, and system compromise through exploitation of these kernel flaws.

Affected / Fixed Versions

• Linux kernel versions as specified in the Ubuntu security notice have been updated to address these issues.

Recommendations

• Apply the provided Linux kernel security update promptly to mitigate exploitation risks.

Reference Links

• https://ubuntu.com/security/notices/USN-8529-2

14. Global Threat Campaign Hits Critical VMware vCenter Flaw (CVE-2026-59310)

Overview

• Exploitation of CVE-2026-59310 started earlier in August 2026.
• The vulnerability affects VMware vCenter.
• Patching alone may not fully mitigate the threat from this flaw.

Impact

• Active global threat campaign leveraging CVE-2026-59310 to compromise affected systems.

Recommendations

• Apply available patches for CVE-2026-59310 promptly.
• Employ additional mitigations beyond patching as patching may be insufficient.

Reference Links

• https://www.darkreading.com/vulnerabilities-threats/global-threat-campaign-critical-vmware-vcenter-flaw

15. Microsoft Patches LegacyHive Windows Zero-Day Vulnerability

Overview

• Microsoft released security updates to fix a zero-day vulnerability in Windows called ‘LegacyHive’.
• The vulnerability was publicly disclosed shortly after the July 2026 Patch Tuesday.
• LegacyHive affects Windows Registry handling, enabling potential exploitation.

Impact

• Exploitation allows attackers to execute code with elevated privileges on vulnerable systems.
• Poses serious risks for unauthorized access and system compromise.

Recommendations

• Deploy the latest Microsoft security patches immediately to mitigate the LegacyHive zero-day vulnerability.
• Ensure Windows systems are fully updated and monitor for any unusual activity.

Reference Links

• https://www.bleepingcomputer.com/news/microsoft/microsoft-patches-legacyhive-windows-zero-day-vulnerability/

16. Fortinet Patches Multiple Authentication Vulnerabilities in FortiWeb, FortiManager, and FortiClient

Overview

• Fortinet released patches for several authentication vulnerabilities affecting FortiWeb, FortiManager, and FortiClient products.
• CVE-2026-26035: Critical improper authentication in FortiWeb when Remote RADIUS with wildcard is enabled, allowing remote unauthenticated attackers to log in with any username and password.
• CVE-2026-70468: Authentication bypass in FortiManager FGFM protocol enabling impersonation of managed FortiGate devices.
• CVE-2026-70465: High-severity buffer overflow in FortiClient for Windows exploitable via crafted or spoofed DNS responses.
• Other vulnerabilities addressed include WAF evasion, SSRF, and DoS issues.

Impact

• Remote unauthenticated attacker can gain administrative control over FortiWeb.
• Attacker with valid certificate and CLI config can impersonate FortiGate devices to manipulate firewall policies.
• Arbitrary code execution on Windows endpoints running vulnerable FortiClient versions.

Affected / Fixed Versions

• FortiWeb 8.0.0–8.0.2, 7.6.0–7.6.6, 7.4.0–7.4.11, 7.2.0–7.2.12; fixed in 8.0.3, 7.6.7, 7.4.12, 7.2.13.
• FortiManager 7.6.1, 7.4.3–7.4.5, 7.2.5–7.2.9; fixed in 7.6.2, 7.4.6, 7.2.10.
• FortiClient Windows 7.4.0–7.4.3, 7.2.0–7.2.11; fixed in later releases.

Recommendations

• Apply the latest patches promptly, prioritizing systems using affected Fortinet products.
• For FortiWeb, disable the wildcard setting on Remote Type administrator accounts if immediate patching is not possible.
• Monitor for unusual authentication attempts and validate FortiManager certificate configurations.

Reference Links

• https://cybersecuritynews.com/fortinet-authentication-vulnerabilities/

17. Microsoft Exchange Server Vulnerabilities – DoS, Privilege Escalation, and RCE

Overview

• Microsoft released security updates for multiple Exchange Server vulnerabilities disclosed on August 11, 2026.
• Affected products include Exchange Server Subscription Edition, Exchange Server 2019, and Exchange Server 2016.
• CVE-2026-62911 (CVSS 8.0): Critical elevation-of-privilege flaw allowing authentication bypass via capture-replay attacks; publicly demonstrated at Pwn2Own Berlin.
• CVE-2026-62913 (CVSS 8.8): Heap-based buffer overflow RCE exploitable remotely with low privileges and no user interaction.
• Additional vulnerabilities include DoS via deserialization (CVE-2026-62912), privilege escalation (CVE-2026-62910), spoofing (CVE-2026-62914), and security feature bypass (CVE-2026-62915).

Impact

• Exploitation allows attackers to gain higher privileges, bypass authentication, disrupt services, execute code remotely, access Exchange mailboxes, and potentially deploy ransomware.
• Denial of service may disrupt email delivery and business operations.

Affected / Fixed Versions

• Exchange Server Subscription Edition, Exchange Server 2019, Exchange Server 2016.

Recommendations

• Apply Microsoft’s August 2026 Exchange Server security updates immediately.
• Review privileged accounts and monitor Exchange logs for unusual activity.
• Investigate abnormal mailbox access and restrict unnecessary remote administrative access.
• Exchange Online customers are already protected from server-side flaws.

Reference Links

• https://cybersecuritynews.com/microsoft-exchange-server-vulnerabilities-rce/

18. CVE-2026-49798: Windows Kernel Elevation of Privilege Vulnerability

Overview

• A vulnerability in the Windows Kernel allows elevation of privilege.

Impact

• Successful exploitation could allow attackers to gain elevated privileges, potentially leading to full system compromise.

Recommendations

• Apply the official security updates provided by Microsoft to mitigate the vulnerability.

Reference Links

• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-49798

19. CVE-2026-50342: Windows MIDI Service Module Elevation of Privilege

Overview

• A privilege escalation vulnerability has been identified in the Windows MIDI Service Module.

Impact

• Successful exploitation could enable an attacker to gain higher-level access than intended.

Recommendations

• Apply security updates and patches provided by Microsoft once available.

Reference Links

• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50342

20. Attackers Exploit Critical SharePoint Flaw After PoC Goes Public (CVE-2026-55040)

Overview

• CVE-2026-55040 is a critical vulnerability in Microsoft SharePoint patched in July 2026 Patch Tuesday.
• The flaw allows authentication bypass enabling impersonation.
• Rapid7 publicly released proof-of-concept (PoC) exploit code, leading to active exploitation by threat actors.

Impact

• Attackers can disclose files and modify data within SharePoint.
• The vulnerability does not affect system availability.

Affected / Fixed Versions

• Affected versions unspecified; fixed by Microsoft’s July 2026 updates.

Recommendations

• Apply the July 2026 Patch Tuesday security updates from Microsoft promptly.
• Monitor SharePoint environments for suspicious activity related to impersonation.

Reference Links

• https://www.helpnetsecurity.com/2026/08/13/microsoft-sharepoint-cve-2026-55040-poc-exploit/

21. The State of Ransomware Q2 2026

Overview

• The ransomware ecosystem remains concentrated with top 10 groups accounting for 57.6% of victims, but the number of active groups increased to 93, a new high.
• Data leak sites recorded 2,139 victims in Q2, up 33% year over year.
• The ransomware group Qilin remained most prolific for the fourth consecutive quarter with 279 victims; The Gentlemen surged 62% to 269 victims.
• An internal leak exposed The Gentlemen’s operation structure and confirmed the use of AI coding assistants to develop their ransomware management panel in about three days.
• Law enforcement efforts targeted shared infrastructure, including cryptocurrency laundering platforms, malware signing services, and anonymization networks.

Impact

• Ransomware payments reached over $820 million in 2025, despite ransom payment rates falling to near 23%.
• Exploitation timelines have shortened significantly, with vulnerabilities weaponized within hours to days after disclosure, aided by AI accelerating exploit development.

Recommendations

• Monitor and defend against rapidly weaponized vulnerabilities.
• Strengthen defenses on shared infrastructure targeted by law enforcement.
• Maintain vigilance for ransomware groups, including emerging operators using AI tools.

Reference Links

• https://research.checkpoint.com/2026/the-state-of-ransomware-q2-2026/

22. Belgium’s eID Authentication Opens Citizen Accounts to RCE

Overview

• Severe vulnerabilities in a key browser extension used by Belgium’s electronic ID (eID) system fully compromised the trust framework.
• The flaws enable remote code execution (RCE), posing serious risks to citizen accounts.

Impact

• Potential full control over affected citizen accounts through remote code execution.
• Undermines confidence in the national eID system’s security.

Recommendations

• Immediate patching or removal of the vulnerable browser extension.
• Thorough review and tightening of security controls for browser extensions in authentication frameworks.
• Users should follow official guidance and update affected software promptly.

Reference Links

• https://www.darkreading.com/application-security/belgium-eid-authentication-citizen-accounts-rce

23. Hackers Exploit Critical Adobe Commerce Flaw to Hijack Customer Accounts (CVE-2026-71362)

Overview

• A critical vulnerability identified as CVE-2026-71362 affects Adobe Commerce and Magento e-commerce platforms.
• Exploitation attempts have been detected in the wild targeting this flaw.

Impact

• Successful exploitation allows attackers to hijack customer accounts within affected platforms.

Recommendations

• Adobe Commerce and Magento users should monitor for security updates and apply patches promptly.
• Implement additional security measures such as multi-factor authentication to protect customer accounts.

Reference Links

• https://www.bleepingcomputer.com/news/security/hackers-exploit-critical-adobe-commerce-flaw-to-hijack-customer-accounts/

24. CVE-2026-0299: GlobalProtect App Local Privilege Escalation (Medium)

Overview

• Multiple local privilege escalation vulnerabilities have been identified in the GlobalProtect application by Palo Alto Networks.

Impact

• An attacker with local access could potentially escalate their privileges on the affected system, leading to unauthorized actions.

Recommendations

• Apply vendor patches or updates when available.
• Limit local user privileges to reduce risk exposure.

Reference Links

• https://security.paloaltonetworks.com/CVE-2026-0299

25. CVE-2026-0295: GlobalProtect App Local Privilege Escalation via Race Condition on macOS (Medium)

Overview

• A local privilege escalation vulnerability exists in the GlobalProtect app for macOS due to a race condition.

Impact

• An attacker with local access to a macOS system could exploit this vulnerability to escalate privileges.

Recommendations

• Update GlobalProtect macOS client to the fixed version once available.
• Restrict local user access where possible and monitor for suspicious activity.

Reference Links

• https://security.paloaltonetworks.com/CVE-2026-0295

26. CVE-2026-0293: Prisma Access Agent Anti-Tamper Protection Bypass on Windows (Medium)

Overview

• Prisma Access Agent on Windows contains an anti-tamper protection bypass vulnerability allowing attackers to bypass security mechanisms designed to prevent unauthorized tampering.

Impact

• Successful exploitation could enable adversaries to alter the agent’s operation or evade security controls, potentially reducing the effectiveness of endpoint protection.

Recommendations

• Monitor Palo Alto Networks advisories for patches or mitigations.
• Implement defense-in-depth controls to mitigate potential exploitation impacts.

Reference Links

• https://security.paloaltonetworks.com/CVE-2026-0293

27. Adobe Patches Three CVSS 10.0 ColdFusion and Campaign Classic Flaws

Overview

• Adobe released security updates to fix critical vulnerabilities in ColdFusion, Commerce, and Campaign Classic.
• The most severe is CVE-2026-48362, an operating system command injection vulnerability in ColdFusion.

Impact

• Successful exploitation could allow arbitrary code execution and privilege escalation.

Recommendations

• Apply the Adobe updates promptly to mitigate these critical risks.

Reference Links

• https://thehackernews.com/2026/08/adobe-patches-three-cvss-100-coldfusion.html

28. Microsoft August Patch Tuesday – CVE-2026-62878 Windows DNS Server RCE

Overview

• Microsoft released August security updates addressing multiple vulnerabilities.
• The most critical is CVE-2026-62878, a remote code execution flaw in Windows DNS Server.
• This vulnerability requires no user interaction to be exploited.

Impact

• Successful exploitation could allow attackers to remotely execute arbitrary code on affected Windows DNS Servers without user action.

Recommendations

• Apply the August 2026 Microsoft security updates promptly to mitigate the risk from CVE-2026-62878 and other patched vulnerabilities.

Reference Links

• https://www.darkreading.com/application-security/microsofts-patch-tuesday-deluge-continues

29. Cisco Secure Firewall Management Center Static Credential Vulnerability

Overview

• A vulnerability in the Cisco Secure FMC web interface involves static user credentials for a low-privileged account.
• Allows unauthenticated, remote attackers to log in and access sensitive data on affected devices.
• Exposure is reduced if the FMC management interface is not accessible from the public internet.
• The vulnerability has a High Security Impact Rating because it can be combined with other FMC vulnerabilities to escalate privileges.

Impact

• Successful exploitation grants unauthorized access to sensitive data with low-privileged user rights.

Affected / Fixed Versions

• Cisco has released software updates addressing this vulnerability.

Recommendations

• Apply the provided Cisco software updates promptly.
• Restrict public internet access to the FMC management interface to reduce attack surface.

Reference Links

• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fmc-static-cred-BET3Cjh

30. Cisco Secure Firewall ASA and FTD SSL VPN Denial of Service Vulnerability

Overview

• A vulnerability in the Remote Access SSL VPN service of Cisco Secure Firewall ASA and FTD Software allows unauthenticated remote attackers to cause device reloads.
• The issue stems from insufficient error checking when processing crafted HTTP requests to the SSL VPN service.

Impact

• Exploitation leads to denial of service (DoS) by forcing the affected firewall devices to reload unexpectedly.

Affected / Fixed Versions

• Specific versions not detailed; Cisco has released software updates to address the vulnerability.

Recommendations

• Apply the Cisco provided software updates promptly.
• No workarounds are available to mitigate this vulnerability.

Reference Links

• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-vpn-dos-dzv4mQFF

31. Inside the Metabase SQL Injection – Exploited in the Wild (CVE-2026-72898)

Overview

• Analysis of a SQL injection vulnerability in Metabase identified as CVE-2026-72898.
• The report details active exploitation instances and reverse engineering efforts to understand the vulnerability.

Impact

• Enables attackers to execute unauthorized SQL queries, potentially leading to data leakage or system compromise.

Affected / Fixed Versions

• Metabase versions affected by CVE-2026-72898 (specific versions not stated).

Recommendations

• Apply patches addressing CVE-2026-72898 promptly.
• Monitor for exploitation attempts targeting this vulnerability.

Reference Links

• https://www.wiz.io/blog/inside-the-metabase-sqli-exploited-in-the-wild

AI Threat Landscape

1. AI’s ‘Middle Class’ Has Gotten Dramatically Better at Hacking

Overview

• Research from XBOW highlights that mid-tier AI models, both proprietary and open-source (Z.ai’s GLM-5.2, xAI’s Grok 4.5, Anthropic’s Opus 4.7, Meta’s Muse Spark 1.1), are becoming strategically important in offensive security.
• These models now perform well on complex agentic hacking and exploitation tasks, closing the gap with frontier AI models.
• The cheaper cost of mid-tier models allows attackers to run many more iterations, compensating for individual performance gaps.
• GPT 5.5 showed significant improvements in autonomous web application testing, reducing vulnerability miss rates to 10% compared to 40% for GPT 5.
• Multi-agent AI swarms coordinating on vulnerability discovery found significantly more vulnerabilities but required millions of tokens and resources.

Impact

• Growing accessibility and effectiveness of mid-tier AI models lower the entry barrier for attackers to conduct sophisticated hacking activities.
• This shift poses a persistent and widespread offensive AI threat that is cheaper and more scalable than reliance on frontier models alone.
• Attacker use of multi-agent coordination could accelerate vulnerability discovery and exploitation campaigns.

Recommendations

• Monitor evolving AI model capabilities in offensive security operations continuously.
• Prioritize defenses against AI-driven autonomous and multi-agent exploitation attempts.
• Apply strict sandboxing and access controls to prevent AI model escape incidents.
• Increase investment in security tools capable of detecting AI-generated attack patterns and behaviors.

Reference Links

• https://cyberscoop.com/mid-tier-ai-models-hacking-threat/

2. Researchers Observe First ‘Near-Autonomous’ AI Attack on Government Target in Taiwan

Overview

• Suspected Chinese hackers used open-source AI frameworks Hermes and OpenClaw to conduct a near-autonomous cyberattack against Taiwan’s government.
• The AI system autonomously searched vulnerability databases, GitHub, and security research publications in ‘Learning Cycles’ to identify exploitable vulnerabilities.
• The operation targeted multiple sectors including government IT supply chain vendors, a nuclear safety agency, government email systems, and energy companies in parallel.
• The AI attack adapted mid-operation without human intervention and improved by learning from mistakes during the campaign.
• The hackers bypassed AI system safety measures by framing activities as authorized penetration testing.

Impact

• More than 2,500 personnel records and other sensitive data were extracted.
• The campaign achieved confirmed real-world compromises of state infrastructure.

Recommendations

• Increase monitoring of AI-assisted attack techniques, especially multi-agent systems leveraging adaptive self-correction.
• Enhance defense postures around exposed admin interfaces and supply chain vendors to mitigate AI-driven exploratory attacks.
• Develop countermeasures against autonomous AI frameworks that utilize Bayesian prioritization and adaptive learning cycles.

Reference Links

• https://cyberscoop.com/near-autonomous-ai-attack-government-target-taiwan/

3. NIST Plans Overhaul of Vulnerability Database to Address AI-Driven Threat Landscape

Overview

• NIST seeks input to modernize its National Vulnerability Database (NVD) to meet challenges posed by AI, particularly large language models that can identify and exploit vulnerabilities at scale.
• Current vulnerability management relying on periodic scanning and manual remediation is increasingly inadequate.
• The RFI highlights increased volume, complexity, and automation in vulnerability disclosure and prioritization due to AI hacking tools.
• NIST aims to integrate AI and automation into vulnerability reporting, dissemination, auditing, and remediation processes for near real-time responsiveness.

Impact

• Potential to improve speed and accuracy of vulnerability identification and mitigation in an AI-accelerated threat environment.
• Supports future-ready ecosystem responsive to automation-enabled threats and business priorities.

Recommendations

• Security practitioners should monitor NIST outreach for opportunities to influence and adopt emerging AI-driven vulnerability management standards.
• Organizations should prepare for increased automation and AI integration in vulnerability workflows.

Reference Links

• https://cyberscoop.com/nist-national-vulnerability-database-ai-overhaul/