Adobe patched a critical flaw in its Commerce and Magento e-commerce platforms that lets an unauthenticated attacker hijack customer accounts, and security firm Sansec reports its web application firewall is already blocking exploitation attempts. Tracked as CVE-2026-71362 and scored 9.1, the incorrect-authorization bug stems from the platform failing to bind a customer identity to an account session, so an attacker with only network access to the public storefront can switch an active session to another customer and read their private data. It needs no account, administrator rights, or user interaction. Adobe ships the fix as isolated patch files, so administrators must be on the latest point release first.
Adobe released Priority 1 updates for ColdFusion and Campaign Classic, led by a critical operating-system command injection flaw in ColdFusion scored 10.0 that could give an attacker arbitrary code execution. Tracked as CVE-2026-48362, it is accompanied by an eval-injection flaw scored 9.9 and an authorization flaw that can cause a denial of service. ColdFusion application servers are a long-standing target for attackers because they are widely internet-exposed and often run with broad access. Adobe is not aware of exploitation yet but urges installation within 72 hours given the priority rating. The Campaign Classic updates apply only to on-premises and hybrid on-premises deployments.
Red Hat disclosed a critical flaw in its Advanced Cluster Management for Kubernetes that lets a user with only namespace-level edit rights escalate to full cluster administrator. Tracked as CVE-2026-10090 and scored 9.9, the bug is in the application subscription controller: a low-privileged user can create a channel pointing to a Helm repository they control, then a subscription referencing it, and the controller deploys the chart using its own elevated permissions without checking the requester's authorization. It is a confused-deputy problem that crosses the namespace-to-cluster boundary. Because namespace edit access is often granted broadly to developers, many multi-tenant clusters could be exposed, and no fix was available at disclosure.
Cisco warned that public proof-of-concept code exists for two vulnerabilities in ClamAV, the widely used open-source antivirus engine, that a remote unauthenticated attacker can use to crash the scanning process and disrupt protection. Tracked as CVE-2026-20337 and CVE-2026-20338, the flaws are rated high severity on Windows because ClamAV runs there in a privileged security context, and medium on macOS and Linux where it runs with lower privileges. There are no workarounds, and Cisco is rolling out fixes in August across its Secure Endpoint Connector products, which embed ClamAV. Because ClamAV is bundled into many mail and file-scanning products, exposure extends well beyond Cisco.
Metabase warned that a critical zero-day in its open-source business intelligence platform was exploited in the wild for data theft. Scored 10.0 and tracked only as GHSA-vwf4-m7j8-wcjf with no CVE assigned, so scanners relying on the national database will not flag it, the flaw is an unauthenticated SQL injection in the password-reset endpoint. A remote attacker with no credentials injects SQL into the application database, gains administrator access, and can steal the stored credentials for every database the instance connects to, then read and export their data. Metabase Cloud was attacked from around August 3 and is already patched; self-hosted versions 1.58 and later must upgrade.
CISA added a critical Progress Kemp LoadMaster flaw to its Known Exploited Vulnerabilities catalog after reports of active exploitation. Tracked as CVE-2026-8037 and scored 9.6, it is a command injection bug that lets an unauthenticated attacker run arbitrary commands on the load balancer appliance through unsanitized input in several command endpoints. watchTowr traced it to improper handling of user input in a quote-escaping function. Telemetry recorded 792 exploitation attempts over 41 days from 65 addresses across 18 countries, with activity as recent as early August. Federal agencies were directed to patch by August 10, a useful signal of urgency for everyone else.
Cisco released fixes for twelve flaws in Catalyst SD-WAN and IOS XE software, including three rated 9.9 and a command-injection issue rated 9.8. The three critical SD-WAN flaws, CVE-2026-20303, CVE-2026-20304, and CVE-2026-20310, stem from improper input validation, access control, and file-path handling in software that centrally controls a network. Cisco found them through internal testing that included frontier AI models and is not aware of exploitation, but there are no workarounds, so patching is the only remediation. Cisco also patched a management-controller flaw with public exploit code that lets a low-privileged user reach root.
Tencent researchers disclosed SCTPhantom, a use-after-free flaw in the Linux kernel's SCTP networking code that lets a local user gain root and, in some configurations, escape a container to the host. Tracked as CVE-2026-64564, the bug is in the protocol's dynamic address reconfiguration handling and traces to code introduced around 2008, making it roughly 18 years old. It is local rather than remote and needs SCTP reachable on the target, which limits exposure, but where those conditions hold the researchers gained root on several major distributions. It was found by an AI-assisted kernel research pipeline, the latest long-dormant kernel bug surfaced that way this year.
WordPress patched a pre-authentication reflected cross-site scripting flaw in the login screen that researchers showed can chain into PHP code execution and full server takeover, naming the chain XSS2Shell. Tracked as CVE-2026-64638 and scored 8.9, the cross-site scripting bug affects all WordPress versions and needs no login to trigger. On its own it runs script in a visitor's browser, but when a logged-in administrator is lured to an attacker-controlled page, the chain can reach code execution on the server. Because WordPress runs a large share of the web, a flaw affecting every version and needing no authentication has broad reach.
HashiCorp, Veeam, and Django patched critical flaws the same week, led by a top-severity bug in HashiCorp's Terraform MCP Server, which connects AI assistants to Terraform. Tracked as CVE-2026-16498 and scored 10.0, it is a cross-tenant flaw in the server's multi-user HTTP mode: its cache looked up clients by session identifier alone, without binding a cached client to the token that created it, so anyone who obtained another user's session ID could run Terraform actions with that user's credential. Only the shared HTTP deployment is affected, not local single-user mode. Veeam separately fixed an unauthenticated console flaw exposing agent credentials, and Django a code-execution bug in spatial queries.
TrustStrike Labs