Thursday, August 13, 2026 | Jonathan Brown

🔴 EMERGENCY / IMMEDIATE ACTION

Lazarus exploited Microsoft’s Windows AFD zero-day against defense and aerospace targets

CVE-2026-68820 | Exploited in Wild: YES | Access: Local privilege escalation | Target: Windows AFD.sys

Microsoft patched CVE-2026-68820 on August 11 after Check Point Research discovered the DPRK-linked Lazarus Group exploiting the Windows Ancillary Function Driver for WinSock as a zero-day. Check Point says the activity belongs to Operation Dream Job and has particularly targeted defense, aerospace, and aviation organisations in Europe and India.

The distinction between initial access and escalation is important. CVE-2026-68820 does not remotely compromise Windows by itself. In the observed attack chain, victims were lured into running trojanized software associated with fraudulent employment opportunities. Malware then exploited AFD.sys to obtain SYSTEM privileges and deploy a new version of Lazarus’ FudModule kernel rootkit, which was used to impair endpoint-detection visibility.

Check Point identified DLL sideloading involving a malicious libmupdf.dll, MISTPEN malware, and the subsequent FudModule deployment. Defenders in exposed sectors should patch Windows, then hunt systems that were vulnerable during the exploitation window for suspicious recruiter-themed downloads, unexpected libmupdf.dll placement beside signed PDF-viewer executables, privilege transitions to SYSTEM, and anomalous kernel-level interference with endpoint-security tooling.

Watch for: Additional victims or evidence that actors beyond Lazarus obtained working exploitation capability before Microsoft’s August patch.

Sources: Microsoft Security Response Center, CVE-2026-68820, August 11, 2026; Check Point Research, “Shattering the Dream – When a Job Offer Becomes a Zero-Day Attack,” August 11, 2026; CISA Known Exploited Vulnerabilities Catalog, August 2026.

Water utilities in at least seven states suffered confirmed PLC disruption

CVE: None | Exploited in Wild: YES | Impact: Physical operations degraded | Target: Internet-facing Rockwell MicroLogix PLCs

The FBI and EPA say water and wastewater utilities in at least seven states have reported malicious access to internet-facing operational-technology devices since July 27, with some attacks degrading water operations. The agencies specifically observed attacks against Rockwell Automation and Allen-Bradley MicroLogix 1100 and 1400 programmable logic controllers.

The actors remotely changed PLC IP addresses and passwords, causing loss of monitoring and control. At least one victim identified modified PLC project files and ladder-logic discrepancies across multiple sites. Operational consequences reported to the FBI included loss of pressure and flooding. The agencies have not publicly attributed this specific campaign to a named actor.

This warrants higher priority than an ordinary vulnerability disclosure because physical processes were affected. Utilities should remove PLCs from direct internet exposure, mediate remote administration through controlled gateways, restrict controller communications with access-control lists, and preserve the ability to operate manually. Hunt specifically for unexplained PLC IP or password changes, discrepancies between running ladder logic and known-good project files, and unusual communications involving HMIs, cellular modems, engineering workstations, or PLC-connected networks.

Watch for: Attribution, disclosure of additional affected states, or evidence that attackers deliberately manipulated process logic rather than primarily disrupting controller availability.

Sources: FBI and EPA, “Malicious Cyber Actors Targeting Water and Wastewater Sector Internet-Facing Programmable Logic Controllers, Causing Operational Disruptions,” July 30, 2026.

Attackers are now exploiting the VMware vCenter RCE flaw

CVE-2026-59310 | CVSS: 9.8 | Exploited in Wild: YES, third-party observed | Target: VMware vCenter Syslog server

Broadcom patched CVE-2026-59310 on July 29, describing it as a critical directory-traversal vulnerability that allows an unauthenticated attacker with network access to vCenter to execute arbitrary code. Incident-response firm QUIRSO is now reporting exploitation against web-accessible vCenter systems. Broadcom itself has not yet added an exploitation statement to its advisory.

QUIRSO’s reporting, as relayed by SecurityWeek, describes path-traversal activity followed by deployment of reverse_ssh and cron-based persistence. The company associated more than 360 IP addresses across 47 countries with systems communicating with attacker infrastructure, but explicitly cautions that those IP addresses cannot be equated directly with individual victim organisations.

Because vCenter is a virtualization management plane, successful compromise can expose administration of hosts and workloads well beyond the vulnerable appliance itself. Patch affected vCenter branches immediately, restrict management-plane reachability, and inspect previously exposed servers for unexpected cron entries, reverse_ssh or equivalent tunneling utilities, unusual Syslog-service activity, and new outbound connections from vCenter.

Watch for: Broadcom confirmation of exploitation, CISA KEV inclusion, or reliable attribution of the current campaign.

Sources: Broadcom, VMSA-2026-0006.1, updated August 3, 2026; SecurityWeek, “Critical VMware vCenter Vulnerability in Attackers’ Crosshairs,” August 13, 2026; Rapid7, VMware vCenter vulnerability analysis, July 30, 2026.

🟠 HIGH-PRIORITY EXPOSURE

Metabase confirms active exploitation of a maximum-severity SQL-injection flaw

CVE-2026-72898 | CVSS: 10.0 | Exploited in Wild: YES | Access: Unauthenticated network | Target: Self-hosted Metabase

Metabase confirmed active exploitation of CVE-2026-72898, and CISA added the vulnerability to its Known Exploited Vulnerabilities catalog on August 11. The flaw allows an unauthenticated remote attacker to inject SQL through the password-reset functionality and potentially obtain Metabase administrator access.

From there, Metabase warns that attackers may change application configuration, steal stored database credentials, query connected databases, and export accessible data. Patched releases are available across the supported release lines; if immediate upgrading is impossible, Metabase recommends temporarily blocking /api/session/reset_password.

Previously exposed servers require compromise review, not simply patch installation. Revoke active sessions, inspect API keys and administrator accounts, rotate credentials for connected databases, and review warehouse logs plus Metabase activity and query history for unexplained access. Requests to the password-reset endpoint from unexpected external sources are an obvious retrospective hunt point.

Watch for: Evidence of stolen database credentials being reused against systems connected to compromised Metabase instances.

Sources: Metabase GitHub Security Advisory GHSA-vwf4-m7j8-wcjf, August 6, 2026; CISA, “CISA Adds Three Known Exploited Vulnerabilities to Catalog,” August 11, 2026.

N-central attackers used managed endpoints to establish persistent Cloudflare tunnels

CVE-2026-18556 / CVE-2026-18577 | CVSS: 8.2 | Exploited in Wild: YES | Target: N-able N-central RMM

N-able’s August 10 incident update confirms that attackers obtained unauthenticated remote administrative access to N-central and then used the platform’s Take Control capability to reach managed endpoints. Continued investigation identified a related attack path after the first fix, leading N-able to release Hotfix 2, build 2026.3.1.10, on August 6.

The attacker registered Cloudflare tunnel services on managed endpoints so access could persist after N-central access was revoked. N-able says only a limited number of customers are known to be affected, but warns that applying Hotfix 2 does not remove attackers already present. Systems patched only after several days of exposure should therefore be treated as potentially compromised.

N-able has provided unusually useful hunt artifacts. Look for a file named svchost.exe in a user’s Documents directory, a registered service named Cloudflared, unusual Take Control sessions, unexplained account creation or password resets, and unexpected outbound activity from managed endpoints. Those indicators are starting points, not proof that a clean system was never compromised.

Watch for: N-able’s promised root-cause analysis and evidence of additional downstream compromise across MSP-managed customer environments.

Sources: N-able, “N-central Security Update – August 10, 2026,” August 10, 2026; CISA Known Exploited Vulnerabilities Catalog, August 2026.

TeamCity exploitation puts CI/CD secrets and release integrity at risk

CVE-2026-63077 | Exploited in Wild: YES | Access: Unauthenticated HTTP(S) | Target: TeamCity On-Premises

JetBrains says CVE-2026-63077 allows an unauthenticated attacker with HTTP or HTTPS access to a TeamCity On-Premises server to bypass authentication checks and execute operating-system commands with the privileges of the TeamCity process. JetBrains subsequently received reports of both active and attempted exploitation, while CISA added the flaw to KEV on August 5.

The fixed versions are TeamCity 2025.11.7 and 2026.1.3; JetBrains also provides a security patch plugin for TeamCity 2017.1 and later where immediate upgrade is impossible. TeamCity Cloud does not require customer remediation for this issue.

Treat exposed servers as potential supply-chain compromise points. Examine TeamCity command execution and process creation, unexpected agent activity, configuration changes, new users or access tokens, repository credential use, signing activity, and builds produced during the vulnerable period. Rotate secrets accessible from the server and verify sensitive release artifacts before continuing to trust them.

Watch for: Confirmed theft of signing material, altered builds, or downstream software compromise originating from exploited TeamCity servers.

Sources: JetBrains, “Critical Security Issue Affecting TeamCity On-Premises,” July 27, 2026, updated August 7; CISA KEV notice, August 5, 2026; Rapid7 technical analysis, August 2026.

Progress LoadMaster command injection has entered CISA’s exploited catalog

CVE-2026-8037 | Exploited in Wild: YES | Access: Unauthenticated network | Target: Progress LoadMaster

CISA has added CVE-2026-8037 to the Known Exploited Vulnerabilities catalog. Progress describes the vulnerability as command injection affecting LoadMaster functionality and capable of allowing unauthenticated remote command execution in susceptible deployments.

Load balancers and application-delivery controllers occupy unusually privileged positions between users, applications, and internal infrastructure. Successful compromise may therefore create opportunities to manipulate traffic, steal configuration or credentials, or pivot toward systems behind the appliance.

Operators should apply Progress’ fixed software, limit administrative and API reachability, and retrospectively review exposed appliances for unexpected commands, processes, accounts, configuration changes, or outbound traffic. Public evidence reviewed for this edition does not yet establish the responsible actor or exploitation scale.

Watch for: Technical reporting describing the exploitation chain, post-compromise tooling, or victim sectors that led to the KEV designation.

Sources: Progress, “LoadMaster Critical Security Bulletin – June 2026 – CVE-2026-8037, CVE-2026-33691,” updated July 31, 2026; CISA Known Exploited Vulnerabilities Catalog, August 2026.

Langflow exploitation turns AI orchestration into an enterprise-access problem

CVE-2026-9198 | Exploited in Wild: YES | Access: Unauthenticated | Target: IBM Langflow / Langflow OSS

CISA added CVE-2026-9198 to KEV on August 4. The vulnerability allows an unauthenticated attacker to exploit exposed Langflow functionality and reach code-execution capability in affected deployments.

The concern is not simply compromise of an AI interface. Langflow deployments may hold credentials or connections to model APIs, databases, vector stores, cloud services, automation systems, and other enterprise resources. Compromise of the orchestration layer can therefore inherit whatever privileges those connectors possess.

Identify internet-accessible Langflow systems, apply the vendor remediation, inspect host and application activity for unexplained code execution or token creation, rotate credentials reachable from the instance, and reduce connector permissions where workflows have accumulated unnecessary authority.

Watch for: Evidence that Langflow exploitation is being used specifically to steal cloud, database, or model-provider credentials.

Sources: IBM/CVE record for CVE-2026-9198, July 2026; CISA, “CISA Adds Three Known Exploited Vulnerabilities to Catalog,” August 4, 2026.

🟡 PATCH, HARDENING & STRATEGIC WATCH

Cisco confirms active exploitation of a Secure Firewall SSL-VPN denial-of-service flaw

CVE-2026-20349 | CVSS: 8.6 | Exploited in Wild: YES | Impact: Device reload / DoS | Target: ASA and FTD remote-access services

Cisco disclosed CVE-2026-20349 on August 11 and says its Product Security Incident Response Team became aware of active exploitation during August. An unauthenticated remote attacker can send a crafted HTTP request to affected Remote Access SSL VPN services and force an ASA or FTD device to reload.

Exposure depends on configuration. Vulnerable services include affected SSL VPN deployments, certain IKEv2 remote-access configurations with client services, and FTD Zero Trust Network Access. Cisco says Secure Firewall Management Center is not affected. There are no workarounds; hotfixes are available.

This is availability disruption, not remote code execution, but repeated firewall reloads can interrupt remote access and perimeter services. Review appliance logs for unexplained reloads and crafted HTTP activity against remote-access interfaces, and use Cisco’s released Snort coverage where applicable.

Watch for: Evidence that the flaw is being used systematically to disrupt particular industries or as cover for parallel intrusion activity.

Sources: Cisco, “Secure Firewall ASA and Secure FTD Software Remote Access SSL VPN Denial of Service Vulnerability,” August 11, 2026.

Jenkins fixes an agent-to-controller boundary failure with controller-code-execution potential

CVE-2026-70426 | Severity: Critical | Exploited in Wild: Not reported | Access: Compromised agent or Agent/Connect permission | Target: Jenkins controller

Jenkins disclosed CVE-2026-70426 on August 5. The Remoting library failed to apply the JEP-200 deserialization class filter on a fallback path, allowing malicious agent processes, code already executing on agents, or users with Agent/Connect permission to bypass the filter and potentially execute code on the Jenkins controller.

That prerequisite matters. This is not an unauthenticated internet-to-controller RCE. But where build agents execute less-trusted code, third-party jobs, or externally influenced pipelines, the flaw weakens an important trust boundary between worker systems and the central CI/CD controller.

Jenkins 2.576 and LTS 2.568.2 contain the fix. Defenders should update and review unexpected agent registrations or reconnections, anomalous serialized Remoting traffic, controller-side processes originating from agent activity, and agents running code that should not possess controller-level influence.

Watch for: Public exploit development or observed attempts to pivot from compromised build agents into Jenkins controllers.

Sources: Jenkins Security Advisory 2026-08-05, August 5, 2026.

Fortinet patches configuration-dependent authentication weaknesses in FortiWeb and FortiManager

CVE-2026-26035 / CVE-2026-70468 | Exploited in Wild: NO reported exploitation | Target: FortiWeb and FortiManager

Fortinet disclosed new authentication weaknesses this week affecting FortiWeb and FortiManager. CVE-2026-26035 can allow unauthenticated access to FortiWeb when a Remote RADIUS administrator is configured using the vulnerable wildcard option. Fortinet rates the issue CVSS 8.8 and explicitly lists it as not known to be exploited.

CVE-2026-70468 affects FortiManager and FortiManager Cloud under a specific CLI configuration and can allow a remote attacker with the required certificate conditions to impersonate a managed FortiGate. The configuration requirements mean these are not equal-risk exposures across every installation.

Verify whether the vulnerable features are actually enabled, apply Fortinet’s fixed releases, disable unnecessary wildcard authentication, and keep management interfaces isolated from untrusted networks. Review administrator authentication and device-registration events for activity inconsistent with expected RADIUS users or FortiGate identities.

Watch for: Public exploit development or Fortinet changing either advisory’s exploitation status.

Sources: Fortinet PSIRT FG-IR-26-158 and FG-IR-26-160, August 2026.

SonicWall’s discontinued GMS platform contains unauthenticated command injection

CVE-2026-66147 | Exploited in Wild: Not reported | Access: Unauthenticated network | Target: SonicWall Global Management System

SonicWall disclosed multiple vulnerabilities in its Global Management System on August 11, including CVE-2026-66147, an unauthenticated command-injection flaw in the Dispatcher Service. GMS 9.5.1 and earlier is affected, and the product has reached end of life.

The management-plane role increases the consequence of compromise even without evidence of exploitation. A GMS server can occupy an administrative relationship with security infrastructure, making an abandoned but still reachable installation a more serious asset than an ordinary unsupported application.

Operators still using GMS should follow SonicWall’s migration or remediation guidance, remove unnecessary external reachability, and inspect exposed systems for unknown commands, files, accounts, or outbound connections before assuming that retirement alone resolves earlier exposure.

Watch for: Exploitation reports targeting GMS installations that remain reachable after end of life.

Sources: SonicWall PSIRT, SNWLID-2026-0011, August 11, 2026.

Taiwan reports an unusual AI-assisted campaign against government systems

CVE: Not applicable | Exploitation: Confirmed campaign | Attribution: Not publicly confirmed | Target: Taiwanese government networks

Taiwan’s Ministry of Digital Affairs said on August 13 that government systems were targeted in July by what it described as an unusual AI-assisted cyberattack originating overseas. Reuters reports that the operation combined human activity with AI-agent techniques and that Taiwanese authorities detected and contained the activity. Taiwan did not publicly attribute the incident to China in the statement reviewed for this edition.

The significance is not that “AI hacked Taiwan autonomously.” The more defensible assessment is that adversaries are incorporating agentic systems into reconnaissance and intrusion workflows while human operators continue to direct campaigns. That may increase the speed and breadth with which attackers enumerate systems, test attack paths, and adapt after failures.

For defenders, the useful signal is tempo. Government and critical-infrastructure SOCs should watch for unusually rapid multi-stage enumeration, repeated tool changes across the same source infrastructure, and coordinated identity, web-application, and network probing that may indicate automation operating across traditional detection silos.

Watch for: Technical disclosure from Taiwan establishing the attack chain, compromised agencies, tooling, or attribution evidence.

Sources: Reuters, “Taiwan says it was targeted last month in AI-driven hacking campaign,” August 13, 2026; Taiwan Ministry of Digital Affairs statements cited by Reuters.

Jonathan Brown is a cybersecurity researcher and investigative journalist at bordercybergroup.com.

If you would like to support our work — useful, well-researched, ad-free cybersecurity intelligence — subscribe, comment, or buy us a coffee! Thanks.