Thursday, August 20, 2026 | Jonathan Brown

CISA moves an exploited MLflow cloud-metadata flaw into KEV

CISA on August 19 added CVE-2026-64849 to its Known Exploited Vulnerabilities catalog based on evidence of active exploitation. The flaw affects MLflow versions before 3.15.0 and exposes a particularly dangerous boundary: an internet-reachable machine-learning management service that may also carry privileged access to cloud infrastructure.

The vulnerability is an unauthenticated server-side request forgery in MLflow's webhook test mechanism. MLflow validates the original webhook address but can follow a redirect or re-resolve a hostname to an internal destination without applying the same protection. Because the endpoint returns the remote response body, an attacker can potentially query internal services or cloud instance-metadata endpoints and recover credentials rather than merely causing a blind outbound request.

This should be treated as more than a normal application patch. Upgrade to MLflow 3.15.0 or later, put authentication in front of Tracking Servers, restrict access to webhook APIs, and prevent the MLflow host from reaching link-local metadata and unnecessary internal networks. Since exploitation is confirmed, defenders should also review webhook activity, cloud audit logs and IAM use originating from MLflow workloads. Credentials accessible through instance metadata should be rotated if suspicious access is found.

Watch for: Evidence showing which cloud providers or credentials attackers are targeting, exploitation scale, or a named campaign using stolen MLflow-host credentials for lateral movement.

Sources: CISA, “CISA Adds One Known Exploited Vulnerability to Catalog,” August 19, 2026; MLflow/GitHub Security Advisory GHSA-7gwp-5pfp-969j, August 17, 2026; NVD record for CVE-2026-64849.

CERT Polska warns that attackers are exploiting a Zimbra command-injection flaw

CERT Polska has issued a new operational warning that CVE-2026-73570 is being actively exploited against Zimbra Collaboration Suite. The vulnerability allows an unauthenticated remote attacker to execute shell commands as the zimbra account, but exposure is configuration-dependent rather than universal across every Zimbra installation.

The vulnerable path involves Zimbra's SNMP notification processing. CERT Polska says affected servers have SNMP traps enabled through snmp_notify and the swatchdog service running; swatchdog is normally enabled. Zimbra fixed the flaw in version 10.1.20. The underlying CVE record describes affected Zimbra Collaboration versions before 10.1.20 when the optional SNMP component and notifications are in use.

Because exploitation is already underway, patching should be accompanied by compromise assessment. CERT Polska specifically recommends checking /var/log/zimbra.log for repeated service-status changes and reviewing files created by the zimbra user during the previous 30 days under the Jetty web-app directories and /tmp. Unexpected web-accessible files or shell activity should be handled as evidence of possible server compromise, not simply as a vulnerable configuration.

Watch for: CISA KEV inclusion, published infrastructure or malware associated with the campaign, and evidence establishing how broadly the Zimbra flaw is being exploited outside Poland.

Sources: CERT Polska Communication 145/2026, “Actively exploited vulnerability in Zimbra Collaboration Suite,” August 2026; Zimbra Collaboration Security Vulnerability Advisories, CVE-2026-73570, August 2026.

NetScaler patches an unauthenticated Gateway authentication bypass

Citrix published security bulletin CTX696939 on August 19 for two vulnerabilities in customer-managed NetScaler ADC and NetScaler Gateway appliances. The more consequential issue, CVE-2026-19490, is an unauthenticated authentication bypass through an alternate path and carries a CVSS version 4 base score of 9.3.

Exposure depends on configuration and software generation. A vulnerable appliance must be operating as a Gateway — including SSL VPN, ICA Proxy, CVPN or RDP Proxy — or as an AAA virtual server. On newer 14.1 and 13.1 builds, Citrix narrows the condition further to deployments using a SAML action; earlier affected builds have the broader Gateway-or-AAA precondition. Supported 14.1 releases before 14.1-73.32 and 13.1 releases before 13.1-63.21 are affected, with separate fixed FIPS and NDcPP builds specified by Citrix.

No confirmed exploitation is established in the material reviewed for this briefing. Administrators should nevertheless determine exposure from the actual running configuration, apply the fixed builds and review authentication, SAML and Gateway session telemetry for unexplained successful sessions or changes. This is exactly the kind of management-edge vulnerability where configuration inventory matters more than a raw severity score.

Watch for: Public exploit code, CISA KEV inclusion or incident-response reporting showing the bypass being used to establish unauthorized VPN or AAA sessions.

Sources: Citrix/Cloud Software Group, NetScaler ADC and NetScaler Gateway Security Bulletin CTX696939, August 19, 2026.

Cisco hardens Crosswork after finding critical flaws in its network control plane

Cisco on August 19 released a major security-hardening update for Crosswork Data Gateway, Crosswork Network Controller and Crosswork Planning. The affected products are vulnerable regardless of device configuration, and Cisco says there are no workarounds. The company is not aware of malicious use.

The advisory groups multiple internally discovered defects by vulnerability class rather than presenting each CVE as one individual bug. The classes include SQL command injection under CVE-2026-20030, missing authentication for a critical function under CVE-2026-20357, external control of the file system under CVE-2026-20358 and insufficient protection of credentials under CVE-2026-20359. Three classes carry a maximum CVSS score of 10.0. Cisco says the vulnerabilities were found through its existing testing processes.

Crosswork matters because it is management and orchestration software rather than an ordinary endpoint application. Organizations running Crosswork 7.2.1 or earlier should move to 7.2.1-SP, restrict the management plane to trusted administrative networks and review stored credentials and recent controller-level configuration changes. There is no evidence at present that attackers have operationalized these flaws.

Watch for: More granular technical disclosure showing which Crosswork interfaces are reachable without authentication or publication of exploit code against the missing-authentication and file-control classes.

Sources: Cisco Security Advisory, “Cisco Crosswork Security Hardening Release: August 2026,” August 19, 2026; Cisco advance notification for August 2026 security hardening releases.

Cisco Secure Workload needs customer-side upgrades even after the SaaS cluster is fixed

Cisco's second major August 19 hardening advisory covers Secure Workload in both SaaS and on-premises deployments. The vulnerabilities apply regardless of configuration and span improper access control, authentication, injection, input validation and memory-safety classes. Cisco says it has seen no malicious exploitation.

The highest-rated groups include CVE-2026-20315 for access-control failures and CVE-2026-20317 for improper authentication, both with maximum CVSS scores of 10.0. CVE-2026-20231 covers command, operating-system and argument-injection weaknesses at up to 9.9. These are again grouped classes representing multiple internally discovered issues, not necessarily one identical flaw across every component.

The operational detail that matters most is the patch boundary. Secure Workload's Cluster, Agent and Connector software all require updating. Cisco has already upgraded the Cluster component for SaaS customers, but those customers still need to update their Agents and Connectors. Fixed branches are 3.10.9.1 and 4.0.4.16.

Watch for: Technical details showing whether any of the authentication or injection classes provide practical paths from a compromised workload or connector into the broader Secure Workload control plane.

Sources: Cisco Security Advisory, “Cisco Secure Workload Software Security Hardening Release: August 2026,” August 19, 2026.

Cisco fixes an unauthenticated BroadWorks flaw that can read server files

Cisco also disclosed CVE-2026-20320 on August 19 in BroadWorks, its telecommunications application and provisioning platform. An unauthenticated remote attacker able to reach the Open Client Interface-Provisioning service can send crafted XML and read sensitive files from the server with the privileges of the BroadWorks account.

The flaw is an XML external entity, or XXE, vulnerability caused by external-entity resolution being allowed by default in the OCI XML parser. It affects vulnerable BroadWorks Application Delivery Platform, Application Server, Profile Server and Xtended Services Platform releases regardless of configuration. This is information disclosure, not remote code execution, but configuration files on telecommunications provisioning infrastructure can contain exactly the information needed to deepen an intrusion.

Cisco reports no known malicious use and no workaround. RI.2026.07 is the first fixed release across the affected components. Operators should update and limit OCI-P exposure to required provisioning systems. If suspicious requests are found, credentials or secrets stored in readable configuration should be treated as potentially exposed.

Watch for: Public XXE exploit tooling aimed specifically at OCI-P or reports that exposed configuration material can be converted into administrative or lateral access.

Sources: Cisco Security Advisory, “Cisco BroadWorks Out-of-Band Blind XML External Entity Injection Vulnerability,” August 19, 2026; NVD record for CVE-2026-20320.

Splunk patches code-execution and privilege paths in MCP Server and AI Toolkit

Splunk's August 19 application hardening release addresses a broad set of vulnerabilities across Splunk apps and add-ons, including a critical code-execution flaw in Splunk MCP Server and several high-impact problems in the Splunk AI Toolkit. The MCP issue, CVE-2026-76404, affects versions below 1.2.1 and carries a CVSS score of 9.1.

The MCP flaw is not unauthenticated initial access. A user already holding Splunk's admin role can exploit unsafe deserialization in the application's credential-management component to execute arbitrary commands on the operating system. Splunk AI Toolkit has a separate deserialization flaw, CVE-2026-76395, through which a user holding the power role can execute code by loading a maliciously crafted model. Other Toolkit flaws allow lower-privileged users to reach system-level searches, container controls or connection data they should not possess.

Splunk MCP Server should be upgraded to 1.2.1 or later. Older AI Toolkit 5.7 installations need 6.0.0 or later, while affected 6.0 builds require 6.0.1. Where these applications are unnecessary, Splunk also documents disabling or removing them as a mitigation. Defenders should pay particular attention to privileged-role assignments, model-loading activity, container configuration and MCP credential changes.

Watch for: Evidence of these vulnerabilities being chained with stolen Splunk credentials, especially where MCP or AI Toolkit instances can reach security telemetry, model infrastructure or privileged automation.

Sources: Splunk Vulnerability Disclosure SVD-2026-0808, “Security Hardening Release for Splunk Apps and Add-ons — August 2026,” August 19, 2026.

Bitdefender maps a China-nexus espionage operation using five newly documented RATs

Bitdefender Labs published new research on August 19 describing SilkParasite, a cyberespionage operation targeting government bodies across Central Asia. Bitdefender assesses the operation as China-nexus with medium confidence and identified seven remote-access-tool families, five of which the researchers say had not previously been documented.

The newly named families are DriveSilkRAT, CookiETagRAT, NomadRAT, GoginRAT and NodeEdgeRAT. The operation makes extensive use of DLL side-loading and modular in-memory payloads. DriveSilkRAT is particularly useful defensively because it uses shared Google Drive folders for command and control, allowing malicious tasking and exfiltration to blend with a cloud service that many organizations routinely permit.

Bitdefender also sees medium-confidence signs of AI-assisted development, but explicitly distinguishes that assessment from claiming the malware was AI-generated. The stronger intelligence finding is the tooling and lineage overlap with the broader China-nexus ecosystem, including BloodAlchemy and the ShadowPad/Deed RAT lineage associated with earlier FamousSparrow research. Organizations with government, diplomatic, energy or economic-policy exposure should hunt for signed applications unexpectedly loading adjacent DLLs and for unusual Google Drive traffic from systems that normally have no business using it.

Watch for: Independent attribution, expansion beyond Central Asia and the South Caucasus, or reuse of the newly documented RAT families against energy, telecommunications or Western government targets.

Sources: Bitdefender Labs, “SilkParasite: Tracking a China-Nexus APT Across Central Asia,” August 19, 2026; accompanying Bitdefender technical research report.

A Snowflake GitHub workflow showed how a public issue can reach internal secrets

Security research published this week details a GitHub Actions flaw in Snowflake's public snowflake-connector-net repository that allowed attacker-controlled issue text to become shell commands inside a CI runner. Wiz researchers demonstrated the attack during authorized testing under Snowflake's HackerOne program and recovered an internal Jira credential; Snowflake says its investigation found no evidence of unrelated unauthorized access.

The vulnerable workflow was merged on June 18 and could be triggered when any GitHub user opened an issue. Instead of safely passing the issue title as data, the workflow placed attacker-controlled text into shell processing. Snowflake patched the workflow on June 23, the same day it received the report. The public repository confirms the June 18 merge and June 23 corrective pull request.

There is an important attribution caution around the AI angle. The June 18 pull request contains a Copilot Autofix powered by AI co-author marker and also received automated AI security review, but repository history alone does not establish that Copilot independently authored the specific vulnerable line. The security lesson is broader: CI workflows must treat issue titles, pull-request fields and comments as hostile input whenever those values can reach privileged runners or secrets.

Defenders should search GitHub Actions for direct interpolation of ${{ github.event.* }} data inside shell run blocks, reduce permissions and secret availability on externally triggerable workflows, and prefer scoped or short-lived credentials. Public contribution channels should never inherit access to internal ticketing or production systems merely because an automation needs convenience.

Watch for: Further disclosures showing AI-assisted code or automated security reviews introducing or missing privileged-workflow injection paths in other enterprise repositories.

Sources: Wiz Research, “Red Agent: Snowflake Copilot CI/CD bug,” August 2026; Snowflake snowflake-connector-net pull request 1218, merged June 18, 2026; pull request 1402, merged June 23, 2026.

Forminator fixes an unauthenticated file-upload path to WordPress code execution

CERT-In on August 19 issued a critical vulnerability note for CVE-2026-15748 in the Forminator Forms WordPress plugin. Versions through 1.56.1 can allow an unauthenticated remote attacker to upload arbitrary files through a publicly accessible submission handler, potentially producing remote code execution and complete site compromise.

The problem is insufficient file-type validation in Forminator's handle_file_upload function. Because the attacker does not need a WordPress account, internet-facing sites that expose vulnerable forms have a materially different risk profile from flaws requiring administrator or contributor access. Version 1.56.2 addresses the vulnerability.

The reporting reviewed for this briefing does not establish active exploitation, so this should not be described as an exploited zero-day. Administrators should update first, then inspect recent uploads and web-accessible directories for executable PHP or other unexpected files. Preventing script execution from upload directories provides useful containment, but it is not a replacement for correcting the vulnerable plugin.

Watch for: Exploit code that reliably reaches code execution, mass scanning or CISA KEV inclusion, any of which would materially raise the assessment for internet-facing WordPress fleets.

Sources: CERT-In Vulnerability Note CIVN-2026-0414, “Arbitrary Code Execution in Forminator Forms plugin of WordPress,” August 19, 2026; NVD record for CVE-2026-15748.

Search Tags: MLflow, Zimbra, NetScaler, Cisco Crosswork, Splunk MCP, SilkParasite, GitHub Actions, Forminator

Introduction: Today’s feed centers on management-plane risk: exploited MLflow and Zimbra flaws, new NetScaler and Cisco patches, Splunk AI-tooling exposure, China-nexus espionage, and a CI/CD trust failure that reached internal credentials.

Jonathan Brown is a cybersecurity researcher and investigative journalist at bordercybergroup.com.

If you would like to support our work — useful, well-researched, ad-free cybersecurity intelligence — subscribe, comment, or buy us a coffee! Thanks.