A critical VMware vCenter flaw that Broadcom patched in late July is now under active exploitation in a global campaign. Tracked as CVE-2026-59310 and scored 9.8, it is a directory-traversal bug in the vCenter Syslog server that lets an unauthenticated attacker with network access run code, turning a logging service into a route onto the host. Incident responders at QUIRSO found a single actor exploiting it from around August 3, using path traversal to drop a cron job that launches the open-source reverse_ssh tool for persistent remote access. More than 360 compromised systems across 47 countries have been identified, and patching alone will not remove an existing foothold.
Metabase warned that a critical zero-day in its open-source business intelligence platform was exploited in the wild for data theft. Scored 10.0 and tracked only as GHSA-vwf4-m7j8-wcjf with no CVE assigned, so scanners relying on the national database will not flag it, the flaw is an unauthenticated SQL injection in the password-reset endpoint. A remote attacker with no credentials injects SQL into the application database, gains administrator access, and can steal the stored credentials for every database the instance connects to, then read and export their data. Metabase Cloud was attacked from around August 3 and is already patched; self-hosted versions 1.58 and later must upgrade.
CISA added a critical Progress Kemp LoadMaster flaw to its Known Exploited Vulnerabilities catalog after reports of active exploitation. Tracked as CVE-2026-8037 and scored 9.6, it is a command injection bug that lets an unauthenticated attacker run arbitrary commands on the load balancer appliance through unsanitized input in several command endpoints. watchTowr traced it to improper handling of user input in a quote-escaping function. Telemetry recorded 792 exploitation attempts over 41 days from 65 addresses across 18 countries, with activity as recent as early August. Federal agencies were directed to patch by August 10, a useful signal of urgency for everyone else.
N-able is warning that attackers exploited an authentication bypass in N-central, the remote monitoring and management platform used by managed service providers and IT teams to administer customer endpoints. The flaw, CVE-2026-18556, allows unauthenticated administrative account takeover, and N-able's initial fix in one release proved incomplete: it found another way to exploit the same weakness, tracked as CVE-2026-18577, that widened the affected range. After taking over a server, attackers used its remote-control feature to reach managed endpoints and installed Cloudflare tunnels as services, which kept access alive even after the route through the N-central server was cut. Build 2026.3.1.7 is the first unaffected version.
Resecurity reports that the INC ransomware operation has become the dominant group exploiting two SonicWall SMA1000 VPN appliance flaws, accelerating its attacks since early August. The pair, CVE-2026-15409 and CVE-2026-15410, were exploited as zero-days before SonicWall patched them in mid-July, and can be chained to gain root on the appliance and extract credentials, session databases, and one-time-password data. Many appliances remain unpatched or already compromised, leaving footholds attackers can reuse. Victims listed recently span private and government organizations across several countries, and some reported follow-up emails and phone calls from people claiming to help with the ransomware.
Cisco has patched a flaw in Secure Firewall Management Center that attackers were already exploiting to log into devices. Tracked as CVE-2026-20316, it stems from static credentials for a low-privilege account built into the software, letting an unauthenticated remote attacker sign in and read sensitive data. Cisco scored it 5.3 but rated it High because the access can be chained with other flaws to escalate privileges. In the same cycle it patched CVE-2026-20079, a separate critical authentication bypass that reaches root, and shipped one set of hot fixes with a shared indicator suggesting the two could be combined. There are no workarounds.
Arista patched a critical vulnerability in on-premises VeloCloud Orchestrator, the console that configures and manages VeloCloud SD-WAN deployments, that is already being exploited. Tracked as CVE-2026-16812 and scored 10.0, it is an unauthenticated operating-system command injection that lets a remote attacker reach privileged functionality meant only for internal use. Arista warns successful exploitation can compromise the confidentiality, integrity, and availability of the orchestrator and everything it manages. There is no configuration that prevents exposure, since the web interface is reachable by default. CISA added it to its exploited-vulnerabilities catalog. Hosted and Dedicated deployments were fixed before the advisory and are not affected.
Check Point has fixed an actively exploited flaw in SmartConsole, the graphical admin panel used to manage its security products. CVE-2026-16232, rated 9.3, is an authentication bypass letting an unauthenticated remote attacker obtain a login token and authenticate with administrator privileges, after which they can alter security configuration and policy on a Security Management or Multi-Domain Management server. Exploitation requires the management server to be reachable from the internet with no restrictions on trusted GUI clients. The same update fixes a second critical authentication bypass and a Gaia Portal issue letting read-only users run commands as root.
VulnCheck reports active exploitation of a path traversal flaw in Windmill, an open source platform for building internal tools, jobs, and workflows. CVE-2026-29059 lets an unauthenticated attacker read arbitrary files through the log file endpoint, and while observed attempts included reading the password file, the higher value target is the superadmin secret. Where that is configured, an attacker can authenticate as a super administrator and run arbitrary code through the job preview API. VulnCheck counted roughly 170 exposed instances across 24 countries, including deployments reachable through a proxy path rather than directly.
Attackers began exploiting a critical Microsoft SharePoint flaw within days of a working proof-of-concept appearing publicly. CVE-2026-50522 is a deserialization of untrusted data issue rated 9.8 that lets a remote attacker run code on on-premises SharePoint without authentication, and Microsoft patched it in the July updates while marking exploitation as more likely rather than confirmed. Offensive security firm watchTowr reports active attacks against on-premises deployments, with attackers pulling SharePoint machine keys in a single request. Those keys let an attacker forge authentication tokens and impersonate users, so access survives patching. It is the third SharePoint flaw to see exploitation this month.
TrustStrike Labs