The trailing ~48 hours (August 13–15, 2026) were defined by exploitation catching up to recent patches rather than by fresh disclosures. Every item below was confirmed against a primary source — a vendor advisory, a national CERT bulletin, original incident-response research, or a company’s own breach notice — and dated on that source’s page.

Max-severity SAP Commerce Cloud RCE exploited three days after patch day

SAP · August 14, 2026

CVE-2026-58231, an improper-authorization flaw in the Data Hub Adapter extension of SAP Commerce Cloud, is being probed in the wild three days after SAP shipped a fix. SAP scored it CVSS 10.0 as CNA (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H, CWE-94); NVD has not yet issued its own assessment. Affected products are COM_CLOUD 2211 and 2211-JDK21, patched via SAP Note 3771065 on the August 11 Security Patch Day. Threat intelligence firm Defused reported the first exploitation attempts against its honeypots on August 14. The CVE is not in the CISA KEV catalog, and Defused states no public proof-of-concept exists.

“First exploitation attempts against CVE-2026-58231 (unauth RCE in SAP Commerce Cloud, CVSS 10.0) is now hitting our honeypots – 3 days after patch day. This vulnerability has no public PoC and is not known to be exploited.” — Defused

Source: SAP Note 3771065 · NVD · BleepingComputer

vCenter exploitation campaign attributed to a Chinese-speaking actor, with ESXi ransomware in the chain

QUIRSO · August 14, 2026

German DFIR firm QUIRSO published a follow-up to its earlier survey of CVE-2026-59310, the CVSS 9.8 directory-traversal-to-RCE flaw in the vCenter Syslog Server that Broadcom disclosed in VMSA-2026-0006 on July 29 and revised on August 3. The new report adds a full incident-response case study: unauthenticated RCE, cron-based execution, an open-source reverse_ssh implant for C2, rogue adminuser accounts created on every ESXi host, and a Babuk-derived ESXi ransomware payload that also encrypted ESXi logs. QUIRSO counts 361 victim IPs across 47 countries, with first callbacks on August 3 — five days after disclosure. It also reports possible exploitation of the related CVE-2026-59309, a CVSS 9.8 authentication bypass in VMware Directory Service, beginning August 1. Fixed builds are vCenter 9.1.0.0300, 9.0.2.0100, and 8.0 U3k or 8.0 U2f; Broadcom lists no workarounds. Neither CVE is in KEV.

“QUIRSO assesses with moderate confidence that the exploitation campaign targeting CVE-2026–59310 is operated by a Chinese-speaking threat actor, probably working in a UTC+8 environment.” — QUIRSO GmbH

Source: Broadcom VMSA-2026-0006 · QUIRSO · BleepingComputer

macOS Screen Sharing authentication bypass abused to drop Monero miners

NCSC-NL · August 12, 2026

The Netherlands’ National Cyber Security Centre updated advisory NCSC-2026-0280 to report in-the-wild abuse of CVE-2026-65400, an authentication bypass in macOS Screen Sharing that lets a network attacker authenticate over VNC (TCP 5900) without valid credentials. Apple patched it on August 6 in macOS Tahoe 26.6.1, Sequoia 15.7.9, and Sonoma 14.8.9, describing it as “an authentication issue… addressed with improved state management” and crediting Alfredo Pesoli (@__rev) via Bynario Atlas. Apple assigns no CVSS and NVD has not scored it; the only published score is CISA-ADP’s 7.1 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N), which NCSC-NL matches. Some outlets have circulated a 9.8 figure that no primary source supports. Exploit code is public, root was obtained on every affected host observed, and the CVE is not in KEV. Where patching is not immediate, disabling Screen Sharing under General → Sharing removes exposure.

“The NCSC has received a notification indicating that active abuse of this vulnerability has been observed on multiple systems on which port 5900 was accessible from the Internet.” — NCSC-NL, advisory NCSC-2026-0280

Source: Apple HT148170 · NCSC-NL NCSC-2026-0280 · BleepingComputer

Trezor customer data exposed through a two-hop supply chain rooted in the Metabase zero-day

Trezor · August 13, 2026

Hardware wallet maker Trezor disclosed that 13,689 customers had data exposed after its fulfilment provider ShipMonk was breached. ShipMonk attributes its own compromise to exploitation of Metabase, the analytics platform hit by CVE-2026-72898 — a CVSS 10.0 SQL injection zero-day granting unauthenticated admin access, which CISA added to the KEV catalog on August 11. The chain therefore runs Metabase → ShipMonk → Trezor. Trezor says its own systems were not touched and that private keys, wallet backups, recovery seeds, and customer funds are unaffected. ShipMonk notified Trezor on August 10; Trezor disclosed publicly three days later.

“The incident affects 11,742 customers with full exposure (name, email, phone number, shipping address) and 1,947 customers with partial exposure (name, city, email).” — Trezor

Source: Trezor · CISA KEV alert · BleepingComputer

Have I Been Pwned puts a number on the RingCentral extortion leak: 1.6 million accounts

Have I Been Pwned · August 13, 2026

Have I Been Pwned indexed the RingCentral breach, deriving 1.6 million unique email addresses from the archive ShinyHunters published after the company declined to pay. Exposed fields are email addresses, names, phone numbers, and physical addresses; HIBP records no passwords. The figure comes from attacker-leaked data, not from RingCentral, which has published no count. RingCentral’s own security bulletin of July 28 attributes the intrusion to a social engineering campaign against its systems, states that the core platform was not impacted, and has not confirmed how access was obtained or attributed the incident to any group.

“In July 2026, the cloud-based business communications platform RingCentral was the target of a ShinyHunters ‘pay or leak’ extortion campaign.” — Have I Been Pwned

Source: Have I Been Pwned · RingCentral security bulletin · BleepingComputer

Still developing

Windows privilege escalation from a researcher on a disclosure campaign — Microsoft · August 11–12, 2026. Microsoft’s August Patch Tuesday closed “LegacyHive,” CVE-2026-62832, a CVSS 7.8 link-following flaw (CWE-59) in the Windows User Profile Service that a researcher using the handle Nightmare Eclipse had published a proof-of-concept for hours after July’s Patch Tuesday. CISA’s SSVC record lists exploitation as none and the CVE is not in KEV. The same researcher then released “ShieldBreak,” claimed as a bypass of Microsoft’s earlier RoguePlanet fix for a Microsoft Defender race condition tracked as CVE-2026-50656, said to yield SYSTEM on fully patched Windows 11 and Server 2025. The bypass claim is the researcher’s and has not been confirmed by Microsoft.
Source: MSRC · BleepingComputer · SecurityWeek

Lazarus exploited the WinSock driver zero-day against defence firms — Check Point · August 12, 2026. Check Point Research tied CVE-2026-68820, the use-after-free in the Windows Ancillary Function Driver for WinSock (afd.sys) that Microsoft patched on August 11 as actively exploited, to a new Operation Dream Job wave running since early July. The chain delivered an updated FudModule kernel rootkit alongside a backdoor tracked as Troy. Microsoft scored the flaw 7.0 as CNA, and CISA added it to KEV on August 11 with a remediation deadline of August 25.
Source: MSRC · Check Point Research · BleepingComputer

This brief covers the trailing ~48 hours (August 13–15, 2026).

Primary sources:

• SAP Security Note 3771065 — CVE-2026-58231
• NVD — CVE-2026-58231
• Broadcom VMSA-2026-0006 — CVE-2026-59309, CVE-2026-59310
• QUIRSO — Global Exploitation of CVE-2026-59310
• Apple — macOS Tahoe 26.6.1 security content
• NCSC-NL — NCSC-2026-0280
• Trezor — customer data exposed in shipping provider incident
• CISA — KEV additions, August 11, 2026
• Have I Been Pwned — RingCentral
• RingCentral — security bulletin
• MSRC — CVE-2026-62832
• MSRC — CVE-2026-68820
• Check Point Research — Shattering the Dream

This brief covers the trailing ~48 hours (August 9–11, 2026). Every item below was verified against its primary source — vendor advisory, CISA publication, or the original research — and dated from that source.

Microsoft’s August Patch Tuesday fixes ~400 flaws, including an actively exploited Windows zero-day

Microsoft MSRC · August 11, 2026

Microsoft’s August 2026 Patch Tuesday addresses roughly 400 vulnerabilities (counts across trackers range from 394 to 421), including 42 rated Critical. One flaw is under active exploitation: CVE-2026-68820, a use-after-free in the Ancillary Function Driver for WinSock (afd.sys) that attackers are using to elevate privileges to SYSTEM. A second zero-day, CVE-2026-72971 in the Windows Container Isolation FS Filter Driver (unionfs.sys), was publicly disclosed before patching but is assessed as less likely to be exploited. Patch the afd.sys bug first — WinSock EoP flaws are a recurring favorite for ransomware operators post-compromise.

Source: Microsoft MSRC update guide (CVE-2026-68820) · BleepingComputer · SecurityWeek

CISA, FBI, NSA and South Korean police publish joint #StopRansomware advisory on Gunra

CISA (AA26-222A) · August 10, 2026

A joint advisory from CISA, the FBI, NSA, the DoD Cyber Crime Center, the U.S. Secret Service, and South Korea’s National Police Agency details the Gunra ransomware-as-a-service operation, a Conti-derived variant that emerged in 2025 and expanded to RaaS in 2026, targeting government, healthcare, and critical infrastructure. Key mitigations: patch known exploited vulnerabilities on internet-facing systems (especially VPN gateways and exposed RDP), maintain offline immutable backups, and segment networks. The advisory ships with STIX-format indicators of compromise.

“The actors leverage a double-extortion model, both encrypting data and threatening to publish exfiltrated data to a dedicated leak site (DLS) if the ransom is not paid.” — CISA advisory AA26-222A

Source: CISA AA26-222A · Joint advisory PDF

Microsoft: Storm-1175 deploys new StormEncryptor ransomware, likely via N-able N-central flaw

Microsoft Threat Intelligence · August 10, 2026

Microsoft Threat Intelligence reports that Storm-1175, a China-based former Medusa ransomware affiliate, is deploying a previously unseen C++ ransomware family dubbed StormEncryptor (files renamed .encrypted, ransom note !!!README_FIRST!!!.txt, three-day deadline). Intrusions were likely preceded by exploitation of CVE-2026-18577 (CVSS 8.2), the N-able N-central authentication bypass added to CISA’s KEV catalog on August 3; post-compromise tooling includes AnyDesk/SimpleHelp, Advanced IP Scanner, and Mimikatz LSASS dumping. N-able has patched the flaw (builds 2026.3.1.7 and later, with Hotfix 2 superseding the original fix) and published IoCs for self-hosted servers.

“This threat actor is known to rapidly move from initial access to data exfiltration and ransomware deployment, often within a few days.” — Microsoft Threat Intelligence

Source: Microsoft Threat Intelligence · N-able security update · BleepingComputer

Kimsuky built a self-hosted LLM lab on its own attack servers, Genians finds

Genians Security Center · August 10, 2026

South Korean security firm Genians published research on North Korea’s Kimsuky group (“Operation GitPower”) documenting what it describes as the first observed case of a state-sponsored APT running self-hosted large language model environments — Ollama, GPT4All, and Msty with retrieval-augmented generation — directly on its attack infrastructure. The offline setup lets the group analyze stolen documents, generate decoy files, and assist malware development without sending data to cloud AI services that might detect or log the activity. The campaign uses AI-generated lure documents and GitHub/GitLab-based C2 to deliver payloads including a modified AsyncRAT.

“The evidence identified to date remains focused on the use and integration of existing AI technologies rather than independent model training. It is therefore necessary to continue monitoring changes in the scope of AI use and the evolution of related attack techniques.” — Genians Security Center

Source: Genians threat intelligence report · The Record

Still developing

Metabase zero-day exploited in the wild for unauthenticated admin access

Metabase (GHSA-vwf4-m7j8-wcjf) · August 6, 2026

Metabase disclosed a CVSS 10.0 unauthenticated SQL injection in the /api/session/reset_password endpoint affecting all versions from x.58.0 onward; no CVE has been assigned yet. Exploitation grants full administrator access, including stored credentials for every connected database. Patched releases are available for each branch (x.58.24 through x.63.5); block the reset_password endpoint if you can’t upgrade immediately, and rotate connected-database credentials if the endpoint was publicly reachable.

“Metabase has confirmed active exploitation of this vulnerability. Please upgrade your Metabase instance ASAP.” — Metabase security advisory

Source: Metabase advisory · The Hacker News

WordPress 7.0.3 patches pre-auth login-page XSS with a path to PHP code execution

WordPress · August 6, 2026

CVE-2026-64638 (CVSS 8.9, “XSS2Shell”) is a pre-authentication cross-site scripting flaw in the WordPress login error page affecting every version, chainable to PHP code execution on the server when an administrator interacts with an attacker-controlled page. The fix shipped in WordPress 7.0.3 and was backported to every branch still receiving security updates (back to 4.7). No in-the-wild exploitation or public PoC had been reported at disclosure.

Source: Hadrian research · The Hacker News

“Payroll Pirates” AiTM phishing hijacks Microsoft 365 accounts to hunt payroll and finance mailboxes

Arctic Wolf Labs · August 7, 2026

Arctic Wolf documented a widespread adversary-in-the-middle phishing campaign — overlapping Microsoft’s Storm-2755 “Payroll Pirates” cluster — that steals Microsoft 365 session tokens via voicemail-themed lures, bypassing MFA, then uses Microsoft Graph to enumerate payroll, HR, and finance staff. Compromised sessions are refreshed by automation at roughly eight-hour intervals through geographically matched residential proxies, with hundreds of organizations targeted across the U.S., Canada, and Europe.

“The campaign uses residential proxies to disguise malicious sign-ins as ordinary consumer traffic. Automated activity maintains compromised sessions at approximately eight-hour intervals.” — Arctic Wolf Labs

Source: Arctic Wolf Labs · The Hacker News

This brief covers the trailing ~48 hours (August 9–11, 2026).
Primary sources: Microsoft MSRC · CISA AA26-222A · Microsoft Threat Intelligence · N-able · Genians · Metabase · Arctic Wolf Labs

This brief covers the trailing ~48 hours (August 5–7, 2026). Every item below was verified against its primary source — vendor advisory, CISA KEV entry, or original research — before inclusion.

Hackers begin exploiting JetBrains TeamCity RCE (CVE-2026-63077); CISA adds it to KEV

CISA / JetBrains · August 5, 2026

Threat actors are actively exploiting CVE-2026-63077 (CVSS 9.8), a deserialization-of-untrusted-data flaw in JetBrains TeamCity On-Premises that allows unauthenticated remote code execution via HTTP/S requests. CISA added the bug to its Known Exploited Vulnerabilities catalog on Wednesday, roughly a week after disclosure, giving federal agencies three days to patch under BOD 26-04. Fixes are available in TeamCity 2025.11.7 and 2026.1.3, plus a security patch plugin for 2017.1+.

“An unauthenticated attacker could exploit the vulnerability via the TeamCity agent polling protocol.” — JetBrains

Source: CISA KEV catalog · SecurityWeek

CISA flags exploited Langflow, Apache Tomcat, and N-able N-central flaws; Tomcat attacks tied to AI-driven campaign

CISA / Palo Alto Networks Unit 42 · August 5, 2026

CISA added three actively exploited vulnerabilities to the KEV catalog: CVE-2026-9198 (CVSS 9.8), an unauthenticated code-injection RCE in Langflow fixed in version 1.10.1; CVE-2026-34486 (CVSS 7.5), an EncryptInterceptor bypass in Apache Tomcat fixed in 11.0.21, 10.1.54, and 9.0.117; and CVE-2026-18556 (CVSS 8.2), an authentication bypass in N-able N-central whose incomplete fix spawned CVE-2026-18577, itself added to KEV earlier in the week. Unit 42 attributes exploitation of the Tomcat flaw to a Zhuhai-based, Chinese-speaking actor using DeepSeek via the Hermes Agent framework as an autonomous offensive operator. Federal agencies have until August 7 to remediate.

“This actor attempted to exploit over 460 targets, leveraging a mix of autonomous and manual techniques.” — Palo Alto Networks Unit 42

Source: CISA alert · The Hacker News

ChainDrop supply-chain attack infects 440 npm packages with Mini Shai-Hulud worm

Microsoft / JFrog / Socket · August 5, 2026

More than 2,200 malicious versions of 440 npm packages were published in the ChainDrop campaign, which began with the compromise of a maintainer account in the keyv and cacheable namespaces — packages with a combined 500+ million weekly downloads. The self-propagating worm, a descendant of Shai-Hulud 2.0, steals npm, GitHub, cloud, and Vault credentials, republishes poisoned package versions, uses Ethereum-based C2 (EtherHiding), and installs a dead-man’s switch that wipes itself if the stolen GitHub token is revoked. Affected developers should treat machines as compromised, rebuild CI runners, and rotate credentials.

“Once executed, the malware searches developer workstations and continuous integration and continuous delivery (CI/CD) environments for NPM, GitHub, cloud, and infrastructure credentials.” — Microsoft

Source: Microsoft · JFrog · SecurityWeek

Cisco ships critical Catalyst SD-WAN hardening release: three CVSS 9.9 flaws, no workarounds

Cisco PSIRT · August 5, 2026

Cisco’s August 5 advisory bundle addresses five vulnerability classes in Catalyst SD-WAN Software, three rated CVSS 9.9: CVE-2026-20303 (improper input validation/path traversal), CVE-2026-20304 (improper access control), and CVE-2026-20310 (improper link resolution), plus CVE-2026-20312 (8.8) and CVE-2026-20313 (7.7). All deployment types are affected, there are no workarounds, and fixed releases start at 20.9.10 through 26.1.2. The flaws were found internally and are not known to be exploited; the same publication window also included critical IOS XE and FMC fixes.

“These vulnerabilities were found during internal security testing using existing testing processes as well as frontier AI models.” — Cisco PSIRT advisory

Source: Cisco advisory · SecurityWeek

CVSS 10.0 authorization bypass in Paperclip AI agent platform allowed unauthenticated RCE (CVE-2026-41679)

Oasis Security · August 6, 2026

Oasis Security disclosed CVE-2026-41679 (CVSS 10.0), a missing authorization check in Paperclip, an AI agent orchestration platform. On default authenticated-mode deployments, a remote attacker could self-register without email verification, self-approve a CLI authorization challenge for board-level API access, then import a crafted company bundle whose .paperclip.yaml deploys an agent that executes host commands as the server process. Patched in v2026.416.0 along with two related bugs, including a DNS-rebinding-on-loopback flaw enabling code execution on developer machines; no exploitation in the wild has been reported.

“A network attacker could create an account and sign in immediately, without an invitation or control of a verified mailbox.” — Oasis Security

Source: Oasis Security technical report (PDF) · SecurityWeek

This brief covers the trailing ~48 hours (August 5–7, 2026). Primary sources: CISA KEV catalog, CISA KEV alert, Cisco PSIRT, Microsoft Security Blog, JFrog Research, Socket, Unit 42, Oasis Security.