August 13, 2026

Command View

Verification cutoff

14:51 UTC, August 13, 2026.

This edition prioritizes five distinct operating conditions: confirmed cyber-physical disruption against U.S. water utilities; successful exploitation of VMware vCenter; a DPRK-linked Windows zero-day campaign against defense-related targets; active exploitation of Cisco VPN infrastructure, Metabase and TeamCity; and rapidly rising SharePoint risk following public proof-of-concept use.

The principal change from the earlier edition is not simply more vulnerabilities. It is better separation of successful compromise, exploitation attempts, demonstrated exploitability, and configuration-dependent exposure. Scanning is not compromise, and patching an exploited system is not incident closure.

Priority posture

  • RED: active exploitation, confirmed operational effect, or control-plane/cyber-physical exposure requiring immediate containment, compromise assessment, or recovery validation.
  • AMBER: high-consequence exposure, major patching need, public exploit material, or serious supplier weakness without confirmed broad exploitation.
  • WATCH: credible defensive, regulatory, campaign, or vendor development requiring tracking.
  • CONTEXT: changes planning assumptions without establishing current compromise.

Today’s decisions

  • RED — OT / water operations: Remove any Rockwell Automation/Allen-Bradley MicroLogix 1100 or 1400 PLC from direct internet exposure. Compare PLC project files and ladder logic against known-good copies before trusting restored operation. Preserve the ability to operate manually. The FBI and EPA have confirmed loss of monitoring/control, pressure loss and flooding across affected U.S. water utilities.
  • RED — Virtualization / infrastructure: Patch network-reachable VMware vCenter systems for CVE-2026-59310 and conduct compromise assessment on systems exposed while vulnerable. Incident responders report successful compromise, malicious cron persistence and reverse_ssh use across hundreds of observed victim IP addresses.
  • RED — Windows / defense-sector SOC: Apply Microsoft’s fix for CVE-2026-68820 and hunt the surrounding Operation Dream Job intrusion chain. The flaw was used after initial execution to elevate to SYSTEM and deploy the FudModule kernel rootkit; patching alone cannot establish endpoint integrity.
  • RED — Firewall/VPN operations: Apply Cisco’s CVE-2026-20349 hotfix to affected ASA and FTD remote-access VPN systems. Cisco confirms active exploitation capable of forcing appliance reloads.
  • RED — Data platforms: Upgrade Metabase to one of the explicitly patched builds and perform the vendor’s post-exposure actions: revoke sessions, inspect administrators and API keys, rotate connected-database credentials, and review application and warehouse activity.
  • RED — CI/CD: Update TeamCity On-Premises to 2025.11.7 or 2026.1.3, or deploy JetBrains’ security patch plugin. Treat vulnerable, reachable build servers as possible compromise cases and validate secrets, configuration and artifact integrity.
  • AMBER — SharePoint: Ensure both the July fix for CVE-2026-55040 and the August fix for CVE-2026-63520 are deployed. Rapid7’s authentication-bypass PoC is now appearing in honeypot exploitation attempts, but that observation must not be inflated into proof of successful compromise, and the RCE component is not reported exploited.
  • AMBER — Fortinet / database / firewall management: Validate FortiWeb and FortiManager configuration prerequisites, deploy the August 13 PostgreSQL security releases, and move SonicWall GMS to 9.5.2. None of these items carries the same exploitation evidence as today’s RED set.

Threat and Resilience Ledger

RED — Water OT/ICS | United States — Internet-facing PLC attacks are producing real physical-process disruption

Quick reference

  • Affected technology: Rockwell Automation/Allen-Bradley MicroLogix 1100 and 1400 programmable logic controllers.
  • Exploitation: Confirmed attacks against U.S. water and wastewater utilities in at least seven states.
  • Operational effect: Loss of monitoring/control, pressure loss, flooding, password/IP changes and reported PLC project-file modification.
  • Primary action: Remove direct internet exposure; broker access through monitored secure gateways; validate logic and project files before resuming trusted operation.
  • Hunt / validate: Compare PLC configurations, IP settings, passwords, ladder logic and project files against known-good baselines; review cellular modem, HMI and engineering-workstation telemetry for unexpected connections or changes.

The July 30 FBI/EPA alert remains the controlling public federal assessment identified by cutoff and is retained as RED carry-forward because the condition represents confirmed cyber-physical disruption, not merely an old vulnerability. Since July 27, utilities in at least seven states reported incidents involving internet-facing PLCs. Attackers changed device IP addresses and passwords, causing loss of visibility and—in some cases—control. At least one organization found modified PLC project files after discovering ladder-logic discrepancies across multiple sites. Reported physical effects include loss of water pressure and flooding; pressure loss can create a pathway for untreated groundwater intrusion. Similar third-party network configurations across several victims may have multiplied exposure.

Evidence: confirmed operational incidents reported to FBI/EPA.
Attribution: unknown publicly.
Confidence: high.
Uncertainty: total victim count, actor identity, persistence mechanisms and whether additional PLC families are being targeted remain unknown publicly.
Sources: FBI and EPA — “Malicious Cyber Actors Targeting Water and Wastewater Sector Internet-Facing Programmable Logic Controllers, Causing Operational Disruptions,” July 30, 2026.

RED — Virtualization control plane | Global — Successful vCenter exploitation establishes persistent remote access

Quick reference

  • CVE / severity: CVE-2026-59310 | CVSS 9.8 Critical
  • Attack path: Network access to the vCenter Syslog service; directory traversal leading to arbitrary code execution.
  • Exploitation: Incident-response evidence indicates successful compromise, not just scanning.
  • Primary action: Patch immediately and assess vulnerable, reachable vCenter appliances for compromise.
  • Hunt / validate: Unauthorized cron entries, reverse_ssh, unexplained process execution and outbound connections from vCenter. reverse_ssh alone is not proof of malicious activity.

Broadcom disclosed CVE-2026-59310 on July 29 alongside CVE-2026-59309, a separate vCenter authentication bypass; both carry CVSS 9.8 ratings and have no workaround. New incident-response reporting materially changes the defensive posture. QUIRSO says it investigated successful compromise consistent with CVE-2026-59310, followed by a malicious cron job using the open-source reverse_ssh utility for persistence. The first identified compromised systems contacted attacker infrastructure on August 3. Researchers reported as many as 361 unique victim IP addresses across 47 countries, with Germany, the United States, Turkey, Iran and France among the most represented locations. An IP count is not an organizational victim count. Separate scanning against CVE-2026-59309 has been observed, but investigators say there is insufficient evidence to tie that scanning to the CVE-2026-59310 intrusion set.

Broadcom’s current fixed versions include 9.1.0.0300 for the 9.1 line, 9.0.2.0100 for 9.0, and 8.0 U3k or 8.0 U2f for vCenter 8.0; VMware Cloud Foundation 5.x uses the documented asynchronous patch route.

Evidence: successful compromise reported from incident response; vendor-confirmed vulnerability and patches.
Attribution: unknown; researchers describe a suspected APT actor but have not publicly identified one.
Confidence: high on exploitation; low on attribution.
Uncertainty: number of distinct organizations compromised, campaign objective, persistence beyond reported cron/reverse SSH, and relationship—if any—to CVE-2026-59309 scanning.
Sources: Broadcom — “VMSA-2026-0006”; QUIRSO research as reported by The Hacker News — “Attackers Exploit VMware vCenter Vulnerability to Gain Persistent Remote Access,” August 12, 2026.

RED — Endpoint privilege / defense-sector espionage | Global — Lazarus used Windows AFD zero-day to deploy a kernel rootkit

Quick reference

  • CVE: CVE-2026-68820
  • Component: Windows Ancillary Function Driver for WinSock, AFD.sys.
  • Exploitation: Confirmed zero-day use before Microsoft’s August 11 patch.
  • Impact: Local privilege escalation to SYSTEM followed by kernel-rootkit deployment.
  • Primary action: Patch and investigate; the vulnerability is a post-entry privilege-escalation mechanism, not the initial-access vector.
  • Hunt / validate: Operation Dream Job artifacts including modified PDF-viewer delivery, SecurityPDF, Troy, MISTPEN and FudModule indicators published by Check Point.

Check Point Research tied exploitation to the DPRK-linked Lazarus group’s Operation Dream Job campaign, with a particular focus on defense organizations in Europe and India. The actor used malicious recruiting lures and a modified PDF viewer to establish execution, then exploited CVE-2026-68820 to gain SYSTEM privileges and deploy a new FudModule kernel-mode rootkit designed to interfere with endpoint visibility. Microsoft fixed the vulnerability on August 11 following responsible disclosure. Because the exploit operates after initial execution, defenders hunting only for the CVE will miss the beginning and end of the intrusion chain.

Evidence: confirmed zero-day exploitation observed in intrusions.
Attribution: Check Point assesses the activity as DPRK-linked Lazarus; attribution is the researcher’s public assessment, not an attribution embedded in Microsoft’s CVE record.
Confidence: high.
Uncertainty: total victim population and duration/breadth of exploitation outside the observed campaign.
Sources: Check Point Research — “Shattering the Dream – When a Job Offer Becomes a Zero-Day Attack,” August 11, 2026; Microsoft — August 2026 security update for CVE-2026-68820.

RED — Edge/VPN availability | Global — Cisco confirms active exploitation capable of reloading ASA and FTD appliances

Quick reference

  • CVE / severity: CVE-2026-20349 | CVSS 8.6
  • Exploitation: Cisco-confirmed active exploitation in August 2026.
  • Prerequisite: Vulnerable ASA/FTD software with an affected SSL-listening remote-access configuration enabled.
  • Impact: Unauthenticated remote denial of service through unexpected appliance reload.
  • Primary action: Apply Cisco hotfixes; no workaround exists.
  • Hunt / validate: Correlate unexpected reloads with Remote Access SSL VPN HTTP activity; Cisco Snort rules 46897 and 59654 can support detection where applicable. A reload alone does not prove exploitation.

The vulnerability affects the Remote Access SSL VPN service and can be triggered with a crafted HTTP request. Relevant configurations include SSL VPN/WebVPN, IKEv2 remote-access VPN with client services, and FTD Zero Trust Network Access. Cisco confirms that Firewall Management Center itself is not affected. The consequence is availability rather than code execution, but repeated forced reloads of perimeter devices can interrupt remote operations, emergency access and incident-response connectivity. Cisco PSIRT explicitly states that it became aware of active exploitation in August.

ASA hotfixes include 89.16.4.50, 89.18.4.50, 9.20.4.235, 9.22.3.191, 9.23.1.211 and 9.24.1.221. FTD fixed hotfix lines include 7.0.9.1, 7.2.11.1, 7.4.7.1, 7.6.4.1, 7.7.11.1 and 10.0.0.1.

Evidence: vendor-confirmed active exploitation.
Attribution: unknown.
Confidence: high.
Uncertainty: campaign scale, motivation and whether exploitation is targeted or broadly opportunistic.
Sources: Cisco — “Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software Remote Access SSL VPN Denial of Service Vulnerability,” August 11, 2026.

RED — Data/application control plane | Global — Metabase unauthenticated SQL injection is actively exploited

Quick reference

  • CVE / severity: CVE-2026-72898 | Critical
  • Exploitation: Metabase-confirmed active exploitation.
  • Attack path: Unauthenticated SQL injection into the Metabase application database.
  • Impact: Administrative access, configuration changes, access to stored connected-database credentials and data.
  • Primary action: Upgrade to an explicitly listed fixed build; if the endpoint was publicly accessible, execute Metabase’s compromise-response steps.
  • Hunt / validate: Requests to /api/session/reset_password, unexpected administrators or API keys, suspicious session activity and anomalous warehouse/query activity. Endpoint probing alone does not establish compromise.

Metabase lists patched releases x.58.24, x.59.21, x.60.17, x.61.11, x.62.9 and x.63.5. The vendor says an unauthenticated attacker can inject arbitrary SQL into the application database and potentially obtain administrator access, alter application configuration, steal credentials for connected databases and read/export accessible data. Metabase explicitly confirms active exploitation. If immediate upgrading is impossible, the vendor’s temporary workaround is to block /api/session/reset_password. Where that endpoint was publicly accessible, remediation extends beyond patching: revoke active sessions, inspect API keys and administrators, rotate connected-database credentials, and review both Metabase and warehouse activity.

Evidence: vendor-confirmed active exploitation.
Attribution: unknown.
Confidence: high.
Uncertainty: exploitation volume and frequency of successful pivots into connected databases.
Sources: Metabase — “SQL injection using an unauthenticated endpoint leading to admin access,” August 6, 2026.

RED — CI/CD / software supply chain | Global — TeamCity exploitation threatens build provenance and downstream trust

Quick reference

  • CVE: CVE-2026-63077
  • Exploitation: JetBrains has received reports of both active and attempted exploitation.
  • Attack path: Unauthenticated HTTP(S) access through the agent polling protocol.
  • Impact: Arbitrary OS-command execution with TeamCity server-process privileges; possible access to credentials, build configuration and downstream artifacts.
  • Primary action: Upgrade to 2025.11.7 or 2026.1.3, or install the security patch plugin.
  • Hunt / validate: com.thoughtworks.xstream.converters.ConversionException; unexpected build agents, especially names beginning with scan; patched systems may log ForbiddenClassException when an exploit attempt is blocked. None of those artifacts alone proves successful compromise.

A compromised CI/CD server is not an ordinary application breach. TeamCity can possess source-repository credentials, cloud and deployment secrets, artifact access and privileged paths into production. Consequently, investigation must cover not just the server but also builds, secrets and artifacts touched during the vulnerable period. JetBrains specifically warns that the exception and agent artifacts it describes are investigation leads rather than definitive proof.

Evidence: vendor-reported active and attempted exploitation.
Attribution: unknown.
Confidence: high.
Uncertainty: number of successful compromises and whether any maliciously altered artifacts have propagated downstream.
Sources: JetBrains — “CVE-2026-63077: Additional Guidance Following Reports of Active Exploitation,” August 7, 2026.

AMBER — Enterprise application / identity boundary | Global — SharePoint PoC is being fired at targets, but attempts are not yet proof of compromise

Quick reference

  • CVE / severity: CVE-2026-55040 | CVSS 9.1 authentication bypass; CVE-2026-63520 | CVSS 8.1 remote code execution.
  • Exploit status: Rapid7 publicly demonstrated the authentication bypass and the complete two-flaw unauthenticated RCE chain. Honeypots are now recording CVE-2026-55040 PoC exploitation attempts.
  • What is not confirmed: Microsoft’s advisory had not marked CVE-2026-55040 as exploited at the reviewed cutoff; CVE-2026-63520 is not reported exploited.
  • Primary action: Apply the July CVE-2026-55040 fix and August CVE-2026-63520 fix across affected SharePoint farms.
  • Hunt / validate: Review SharePoint/IIS authentication and administrative activity for anomalous bearer-token use, impersonated identities and unexpected privileged operations; distinguish PoC traffic from successful access.

Rapid7’s technical research shows that CVE-2026-55040 allows a remote unauthenticated attacker to forge authentication material and operate as a SharePoint site user or administrator. Rapid7 also demonstrated that this bypass can be chained with CVE-2026-63520, an unsafe .NET type-instantiation flaw, to achieve unauthenticated remote code execution. The second stage was fixed in August.

The important August 12–13 change is that Defused Cyber honeypots recorded exploitation attempts using Rapid7’s CVE-2026-55040 PoC. SecurityWeek reports that Microsoft’s advisory had not yet identified the flaw as exploited and that CVE-2026-63520 had no reported exploitation. Therefore this edition keeps SharePoint at AMBER, despite urgent patching need: the evidence shows active hostile use of exploit material, but scanning or honeypot attempts are not automatically successful compromise.

Evidence: demonstrated authentication bypass and full RCE chain; reported in-the-wild exploitation attempts against CVE-2026-55040; no confirmed exploitation of CVE-2026-63520 by cutoff.
Attribution: unknown.
Confidence: high on exploitability and observed attempts; moderate on real-world victim compromise.
Uncertainty: whether successful CVE-2026-55040 compromise has occurred outside instrumented targets and how quickly actors will reconstruct or weaponize the complete RCE chain.
Sources: Rapid7 — “Microsoft SharePoint JWT Token Authentication Bypass — CVE-2026-55040,” August 11, 2026; Rapid7 — “Rapid7 and Microsoft disclose CVE-2026-63520,” August 11, 2026; SecurityWeek — “SharePoint Vulnerability Exploited Shortly After PoC Release,” August 12, 2026.

AMBER — Security management / web edge | Global — Fortinet authentication weaknesses require configuration-aware triage

Quick reference

  • FortiWeb: CVE-2026-26035, Fortinet advisory score 8.8.
  • FortiManager: CVE-2026-70468, Fortinet advisory displays 7.3 High; current NVD/CNA data reports an 8.1 base score. Preserve that scoring distinction rather than silently conflating the two.
  • Exploitation: Fortinet does not identify known exploitation in the cited advisories.
  • Primary action: Patch and first determine whether the required vulnerable configurations exist.
  • Hunt / validate: For FortiWeb, review unexpected successful administrative GUI/CLI authentications where remote RADIUS wildcard administration was enabled. For FortiManager, review abnormal FGFM device identity/certificate activity where the prerequisite CLI setting existed.

CVE-2026-26035 affects FortiWeb 8.0.0–8.0.2, 7.6.0–7.6.6, 7.4.0–7.4.11, 7.2.0–7.2.12 and 7.0.0–7.0.12. Under the vulnerable remote-administrator wildcard configuration, an unauthenticated remote attacker can authenticate to the GUI or CLI with arbitrary credentials. Fortinet lists fixed releases beginning with 8.0.3, 7.6.7, 7.4.12 and 7.2.13; disabling wildcard administration is the documented workaround.

CVE-2026-70468 affects specified FortiManager and FortiManager Cloud 7.2, 7.4 and 7.6 builds and can weaken FGFM authentication under a specific CLI configuration; exploitation also requires the attacker to possess a valid certificate. This is a management-plane trust problem, but its prerequisites matter and should not be omitted merely because the product is security-critical.

Evidence: vendor-confirmed vulnerabilities and patches; no vendor-confirmed exploitation.
Attribution: not applicable.
Confidence: high.
Uncertainty: population of reachable systems with the required non-default configurations.
Sources: Fortinet PSIRT — “FG-IR-26-158,” August 12, 2026; Fortinet PSIRT — “FGFM Authentication Weakening via CLI Configuration,” FG-IR-26-160, August 12, 2026; NVD/CVE record for CVE-2026-70468.

AMBER — Database infrastructure | Global — PostgreSQL closes 28 security flaws, including multiple code-execution paths

Quick reference

  • Release: PostgreSQL 18.6, 17.11, 16.15, 15.19 and 14.24.
  • Security scope: 28 vulnerabilities plus more than 110 additional bug fixes.
  • Highest-impact classes: Multiple CVSS 8.8 memory-safety, type-confusion and code-execution flaws.
  • Exploitation: No active-exploitation claim in PostgreSQL’s release announcement.
  • Primary action: Deploy the appropriate supported minor release, restart as required, and perform the release-specific GIN/btree_gist/ltree integrity steps where applicable.
  • Hunt / validate: No authoritative exploit IOC set is supplied by the project release; prioritize exposure/role analysis rather than pretending a generic SQL signature proves exploitation.

The August 13 PostgreSQL release closes vulnerabilities including CVE-2026-14664, a regexp heap-buffer overflow capable of arbitrary code execution; CVE-2026-14669, a to_char heap-buffer overflow; CVE-2026-14676, a pg_stat_statements heap-buffer overflow; CVE-2026-16239, cursor-lifecycle type confusion leading to arbitrary code execution; and several other high-impact defects. Exact prerequisites vary by flaw and should be evaluated individually rather than treating all 28 as equivalent unauthenticated RCE.

A lineage detail matters operationally: PostgreSQL states that 18.5 was not shipped because of a regression. Although individual vulnerability records may identify 18.5 as the nominal 18.x fixed level, the shipped current security update is 18.6. The release also documents integrity checks after updating for GIN metadata and limited btree_gist and extreme ltree cases.

Evidence: project-confirmed vulnerabilities and security releases.
Attribution: not applicable.
Confidence: high.
Uncertainty: which flaws will acquire practical public exploits and whether any were privately exploited before publication.
Sources: PostgreSQL Global Development Group — “PostgreSQL 18.6, 17.11, 16.15, 15.19, 14.24 and 19 Beta 3 Released!,” August 13, 2026.

AMBER — Firewall management plane | Global — SonicWall GMS unauthenticated flaws threaten centralized security administration

Quick reference

  • CVE: CVE-2026-66147 — unauthenticated command injection; CVE-2026-66145 — unauthenticated code-injection/arbitrary-file-write class weakness.
  • Affected scope: SonicWall GMS 9.5.1 and earlier in the vendor advisory.
  • Fixed release: 9.5.2.
  • Exploitation: No authoritative active-exploitation confirmation identified by cutoff.
  • Primary action: Upgrade exposed or operational GMS instances and restrict the management plane.
  • Hunt / validate: Review management-server process ancestry, unexpected file creation and outbound connections where the vulnerable Dispatcher/management services were reachable; these are hunt concepts, not vendor-published IOCs.

The key risk is not merely arbitrary code execution on another server. GMS centrally manages firewall infrastructure and therefore sits across a privileged trust relationship with security devices. A successful compromise can require downstream validation of managed-device configuration, credentials and administrative changes. Without evidence of exploitation, however, the correct status remains AMBER, not RED.

Evidence: vendor-confirmed vulnerabilities and fixed release; no verified active exploitation identified by cutoff.
Attribution: not applicable.
Confidence: high on vulnerability and remediation; moderate on absence of exploitation because public reporting can lag private incidents.
Uncertainty: internet exposure of vulnerable GMS deployments and availability of independent exploit code.
Sources: SonicWall PSIRT — “SonicWall GMS Security Affected By Multiple Vulnerabilities,” August 11, 2026.

Defensive Posture Changes

Restore OT process integrity before restoring confidence

The water-sector incidents should alter recovery doctrine. If an attacker changed passwords, IP configuration or PLC project files, restoring network connectivity or resetting a password does not prove that the process controller is trustworthy. Compare logic and project files to known-good baselines, inspect the path used to manage the PLC, and verify that the process can be controlled safely before normal operations resume. Maintain manual-operation capability where the physical process permits it.

Treat management planes as compromise multipliers

vCenter, TeamCity, Metabase, FortiManager and SonicWall GMS each sit above or beside systems that matter more than the management server itself. Incident scope should therefore be based on reachable trust, not only on host artifacts. Ask what credentials the system held, what infrastructure it could administer, what code or artifacts it could alter, and what downstream systems trusted its assertions.

For vCenter specifically, successful compromise can undermine confidence in a virtualization control plane that governs hosts, virtual machines, networking and storage. Recovery should include validation of privileged identities, scheduled tasks, appliance persistence, outbound communications and administrative changes—not merely installation of the Broadcom patch.

Threat-hunting hooks must remain evidence, not theater

This edition deliberately does not invent generic Event IDs or pseudo-Sigma rules where vendor telemetry does not support them. Useful hunting starts with grounded artifacts:

  • Water OT: configuration changes, password/IP changes, altered project files and ladder-logic divergence.
  • vCenter: unauthorized cron entries plus reverse_ssh, unexpected outbound communications or process execution. reverse_ssh alone is insufficient.
  • Windows/Lazarus: the published Operation Dream Job delivery chain and Check Point’s FudModule/SecurityPDF/Troy indicators.
  • Cisco ASA/FTD: unexplained reloads correlated with SSL VPN traffic and Cisco Snort rules 46897/59654.
  • Metabase: exposed reset-password endpoint traffic correlated with session, administrator, API-key and database activity.
  • TeamCity: XStream conversion exceptions and unauthorized scan* agents, interpreted with timestamps and surrounding server activity.
  • SharePoint: suspicious authentication/impersonation behavior associated with the JWT bypass, distinguished from simple PoC probes.

The rule is simple: an indicator should begin an investigation, not end one.

Availability exploitation belongs in continuity planning

Cisco CVE-2026-20349 illustrates why CVSS labels do not capture operational consequence by themselves. A remotely induced firewall/VPN reload may not yield code execution, yet repeated interruption of remote-access infrastructure can isolate staff, disrupt emergency administration and complicate response to a concurrent incident. Critical sites should validate failover and alternative management paths before an outage forces them to discover whether those assumptions were correct.

Database security updates can carry integrity work after the patch

PostgreSQL’s August release includes explicit post-update checks for certain GIN, btree_gist and ltree conditions. Maintenance plans should include those integrity steps rather than closing the change ticket as soon as new binaries start successfully.

Regional and Sector Pulse

North America — RED

The clearest region-specific safety issue is the U.S. water-sector PLC campaign: at least seven states have reported incidents, with documented physical-process effects including pressure loss and flooding. That evidence justifies RED independent of any CVE score or threat-actor identity.

The vCenter campaign also includes U.S. victim IP addresses among the highest observed geographic concentrations, but those IP counts should not be converted into claims about the number or sectors of affected U.S. organizations.

Europe / UK — RED

Check Point’s current Lazarus investigation identifies a particular focus on European defense targets, while the vCenter exploitation dataset includes Germany and France among the most represented observed victim-IP geographies. Neither finding establishes that every European deployment is under targeted nation-state attack, but both raise the priority of exposed defense, aerospace, virtualization and supplier control planes.

No separate UK-specific compromise claim is supported by the evidence reviewed for this edition.

Indo-Pacific — RED

India is explicitly identified in Check Point’s latest Operation Dream Job targeting, including defense-sector organizations. This is campaign victimology, not simply global Windows vulnerability exposure.

SharePoint PoC exploitation attempts have also been observed from multiple Asia-Pacific source regions, but source geography is not actor attribution and honeypot attempts are not proof of victim compromise.

Middle East / Africa — WATCH

QUIRSO’s vCenter dataset includes Iranian victim IP addresses among the higher observed concentrations, but public evidence does not establish the sectors involved or actor intent. Treat this as global product exploitation with regional presence, not a validated Middle East-specific campaign.

No separate Africa-specific operational incident met the evidentiary threshold for elevation.

Latin America / Caribbean — WATCH

Check Point’s broader Operation Dream Job victimology extends into South America, including Brazil, but the public research does not establish that CVE-2026-68820 was necessarily used against every geography represented in the campaign. No separate Latin American cyber-physical incident met the threshold for promotion in this edition.

Vulnerability and Supplier Watchlist

Rockwell Automation / Allen-Bradley MicroLogix 1100 and 1400

Issue: Direct internet exposure is being actively abused to alter PLC configuration and disrupt water operations.
Affected scope: Internet-reachable MicroLogix 1100/1400 PLCs; FBI notes that similar defensive considerations should be applied to other PLC environments.
Fixed release: Not a conventional single-CVE patch condition; remove direct exposure, broker remote access securely and validate known-good configuration.
Severity: Confirmed cyber-physical operational effect.
Status: RED — active attacks have caused loss of control, pressure loss and flooding.

VMware vCenter

Issue: CVE-2026-59310 directory traversal/RCE; related CVE-2026-59309 authentication bypass.
Affected scope: Vulnerable vCenter releases with network access available to an attacker.
Fixed release: 9.1.0.0300; 9.0.2.0100; 8.0 U3k or U2f; documented asynchronous fixes for applicable VCF environments.
Severity: CVSS 9.8 for both CVEs.
Status: RED — successful exploitation of CVE-2026-59310 is reported from incident response.

Microsoft Windows AFD.sys

Issue: CVE-2026-68820 local privilege escalation used as a zero-day.
Affected scope: Applicable supported Windows systems; attacker requires an initial execution foothold.
Fixed release: Microsoft August 11, 2026 security updates.
Severity: Actively exploited.
Status: RED — observed SYSTEM escalation and kernel-rootkit deployment in a DPRK-linked defense campaign.

Cisco Secure Firewall ASA / FTD

Issue: CVE-2026-20349 unauthenticated Remote Access SSL VPN denial of service.
Affected scope: Vulnerable releases where affected SSL-listening remote-access features are configured.
Fixed release: Branch-specific ASA/FTD hotfixes published by Cisco.
Severity: CVSS 8.6.
Status: RED — Cisco confirms active exploitation; no workaround.

Metabase

Issue: CVE-2026-72898 unauthenticated SQL injection leading to administrative access.
Affected scope: Vulnerable 58.x through 63.x branches described by Metabase.
Fixed release: x.58.24, x.59.21, x.60.17, x.61.11, x.62.9, x.63.5.
Severity: Critical.
Status: RED — vendor-confirmed active exploitation and explicit post-compromise guidance.

JetBrains TeamCity On-Premises

Issue: CVE-2026-63077 unauthenticated command execution.
Affected scope: Unpatched TeamCity On-Premises; TeamCity Cloud requires no customer action.
Fixed release: 2025.11.7 or 2026.1.3; security patch plugin available for supported older deployments.
Severity: Critical.
Status: RED — JetBrains reports active and attempted exploitation.

Microsoft SharePoint Server

Issue: CVE-2026-55040 authentication bypass plus CVE-2026-63520 RCE; demonstrated chain provides unauthenticated RCE.
Affected scope: Applicable on-premises SharePoint Server releases covered by Microsoft/Rapid7 advisories.
Fixed release: Apply both the July CVE-2026-55040 servicing update and the August CVE-2026-63520 servicing update appropriate to the SharePoint release.
Severity: CVSS 9.1 and 8.1 respectively.
Status: AMBER — public PoC is appearing in exploitation attempts; successful compromise through CVE-2026-55040 and exploitation of CVE-2026-63520 were not authoritatively confirmed by cutoff.

Fortinet FortiWeb

Issue: CVE-2026-26035 improper authentication under vulnerable remote-administrator wildcard configuration.
Affected scope: FortiWeb 8.0.0–8.0.2, 7.6.0–7.6.6, 7.4.0–7.4.11, 7.2.0–7.2.12 and 7.0.0–7.0.12.
Fixed release: 8.0.3, 7.6.7, 7.4.12, 7.2.13 or later appropriate supported branch; disable wildcard as documented workaround.
Severity: Fortinet advisory score 8.8.
Status: AMBER — potentially unauthenticated administrative access, but configuration-dependent and not reported exploited by Fortinet.

Fortinet FortiManager / FortiManager Cloud

Issue: CVE-2026-70468 FGFM authentication weakening under a specific CLI configuration and certificate prerequisite.
Affected scope: FortiManager/FortiManager Cloud 7.6.1, 7.4.3–7.4.5 and 7.2.5–7.2.9.
Fixed release: Follow Fortinet’s fixed-branch guidance in FG-IR-26-160.
Severity: High; Fortinet advisory displays 7.3, while current NVD/CNA data lists an 8.1 CVSS v3.1 base score.
Status: AMBER — management-plane trust risk with restrictive prerequisites and no vendor-confirmed exploitation.

PostgreSQL

Issue: August 13 security release closes 28 vulnerabilities, including multiple memory-safety and arbitrary-code-execution conditions.
Affected scope: Varies by CVE across supported PostgreSQL 14–18 releases.
Fixed release: 18.6, 17.11, 16.15, 15.19 and 14.24.
Severity: Multiple CVSS 8.8 issues.
Status: AMBER — significant infrastructure patch requirement without an authoritative active-exploitation claim.

SonicWall Global Management System

Issue: Multiple vulnerabilities including CVE-2026-66147 and CVE-2026-66145 affecting the centralized firewall-management platform.
Affected scope: GMS 9.5.1 and earlier according to SonicWall’s advisory.
Fixed release: 9.5.2.
Severity: Critical/high-consequence management-plane weaknesses.
Status: AMBER — unauthenticated compromise paths are serious, but active exploitation was not verified by cutoff.

Outlook and Uncertainty

Next 24 hours

Watch vCenter first for broader incident-response reporting, additional persistence indicators, vendor acknowledgement of exploitation and government catalog action. The current evidence already supports successful compromise; what remains unclear is scale and actor identity.

Watch SharePoint for the distinction that matters most: movement from exploit traffic seen by honeypots to confirmed successful victim compromise, and any evidence that actors have weaponized CVE-2026-63520 as the second-stage RCE. That development would immediately change the status from AMBER to RED.

Watch FortiWeb, FortiManager and SonicWall GMS for public exploit material or credible incident evidence. Their privileged management roles make first confirmed exploitation disproportionately important.

Watch PostgreSQL for practical exploit demonstrations against the most accessible of the newly disclosed code-execution flaws, and for project clarification if vulnerability metadata around the unshipped 18.5 version produces scanner or inventory confusion.

Watch the water sector for a new federal victim count, actor attribution, additional affected PLC families or evidence of ongoing process disruption. The absence of a newer public federal bulletin does not mean the operational problem has ended.

What is not known

Public evidence does not yet establish:

  • who is behind the water-sector PLC attacks;
  • how many distinct organizations were compromised through CVE-2026-59310;
  • who operates the vCenter campaign or whether CVE-2026-59309 scanning is connected;
  • the full victim count in the Lazarus CVE-2026-68820 campaign;
  • the scale or objective of Cisco CVE-2026-20349 exploitation;
  • how often Metabase compromise has led to connected-database compromise;
  • whether TeamCity exploitation has produced poisoned downstream artifacts;
  • whether observed CVE-2026-55040 exploit attempts have succeeded against real organizations;
  • whether attackers have reconstructed and deployed the CVE-2026-63520 RCE stage;
  • whether the new Fortinet, PostgreSQL or SonicWall vulnerabilities are already being exploited privately.

Absence of public IOCs, attribution or victim counts is not evidence of absence.

Trigger for escalation

SharePoint moves to RED on reliable evidence of successful CVE-2026-55040 compromise, Microsoft/CISA confirmation of exploitation, or real-world exploitation of CVE-2026-63520.

FortiWeb, FortiManager or SonicWall GMS move to RED upon vendor/government confirmation of exploitation or incident-response evidence establishing compromise of production management planes.

PostgreSQL moves toward RED if practical exploitation establishes a broadly reachable path to OS-level code execution under common production privilege models, particularly if active use is observed.

The existing RED items do not need stronger vulnerability scores. Their next escalation trigger is environment-specific evidence of exposure or compromise. At that point the response must move from vulnerability management to containment, evidence preservation, credential rotation, integrity verification, re-imaging or trust reconstruction as the affected architecture requires.

Jonathan Brown is a cybersecurity researcher and investigative journalist at bordercybergroup.com.

If you would like to support our work — useful, well-researched, ad-free cybersecurity intelligence — subscribe, comment, or buy us a coffee! Thanks.