Executive assessment
Today's brief leads with Multiple vulnerabilities in Cisco Identity Services Engine. All 11 selected findings retain their own technical scope, action, observed status, and evidence limits.
Finding 01 — Multiple vulnerabilities in Cisco Identity Services Engine
What changed: CVE coverage: CVE-2026-20190, CVE-2026-20148, CVE-2026-20147, CVE-2026-20181. The cited advisories disclose: Missing Authentication for Critical Function Information Disclosure Vulnerability; PatchUpdateListener Directory Traversal Information Disclosure Vulnerability; invokeScript Command Injection Remote Code Execution Vulnerability; zipFiles Directory Traversal Remote Code Execution Vulnerability.
Technical evidence: CVE-2026-20147; CVSS v3.1 9.9; weakness ['CWE-77']; technical confidence High.
Why it matters: The Critical priority moves this beyond routine tracking and requires exposure validation, remediation, and compromise assessment.
Observed status: Observed in-the-wild exploitation status is unknown.
Action: Map CVE-2026-20147 to owned assets, confirm the affected and fixed versions in the cited source, deploy the applicable remediation, and retain evidence of the exposure decision.
Evidence limits: exploitation status unknown
fixed version or patch state unknown
affected product not structured
[Evidence source: www.zerodayinitiative.com](<http://www.zerodayinitiative.com/advisories/ZDI-26-580/>)
Finding 02 — Still active: Adobe Commerce Bug Targeted Immediately After Disclosure
Coverage status: First reported 2026-08-13; ongoing coverage.
What changed: The first exploitation attempts targeting CVE-2026-71362 were observed shortly after Adobe released patches. .
Technical evidence: CVE-2026-71362; CVSS v3.1 9.1; weakness ['CWE-863']; technical confidence High.
Why it matters: The Critical priority moves this beyond routine tracking and requires exposure validation, remediation, and compromise assessment.
Observed status: Observed in-the-wild exploitation status is unknown.
Action: Map CVE-2026-71362 to owned assets, confirm the affected and fixed versions in the cited source, deploy the applicable remediation, and retain evidence of the exposure decision.
Evidence limits: exploitation status unknown
fixed version or patch state unknown
[Evidence source: www.securityweek.com](<https://www.securityweek.com/adobe-commerce-bug-targeted-immediately-after-disclosure/>)
Finding 03 — Still active: Critical VMware vCenter RCE flaw exploited for reverse SSH access
Coverage status: First reported 2026-08-13; ongoing coverage.
What changed: A recently patched critical vulnerability (CVE-2026-59310) in VMware vCenter Syslog Server is being exploited in an active campaign to deploy a reverse SSH tool for persistence and remote access. [...].
Technical evidence: CVE-2026-59310; CVSS v3.1 9.8; weakness ['CWE-22']; technical confidence High.
Why it matters: Reported active exploitation elevates this above routine patching: validate exposure immediately, remediate, and assess for prior compromise.
Observed status: The cited source reports active in-the-wild exploitation; independent corroboration (CISA KEV or grounded vendor data) is not yet available.
Action: Map CVE-2026-59310 to owned assets, confirm the affected and fixed versions in the cited source, deploy the applicable remediation, and retain evidence of the exposure decision.
Evidence limits: exploitation status unknown
fixed version or patch state unknown
affected product not structured
[Evidence source: www.bleepingcomputer.com](<https://www.bleepingcomputer.com/news/security/critical-vmware-vcenter-rce-flaw-exploited-for-reverse-ssh-access/>)
Finding 04 — NGINX HTTP Dav Module Alias Directive Integer Underflow Remote Code Execution Vulnerability
What changed: This vulnerability allows remote attackers to execute arbitrary code on affected installations of NGINX. Authentication is not required to exploit this vulnerability.
Technical evidence: CVE-2026-27654; CVSS v3.1 8.2; weakness ['CWE-122']; technical confidence High.
Why it matters: The High priority moves this beyond routine tracking and requires exposure validation, remediation, and compromise assessment.
Observed status: Observed in-the-wild exploitation status is unknown.
Action: Map CVE-2026-27654 to owned assets, confirm the affected and fixed versions in the cited source, deploy the applicable remediation, and retain evidence of the exposure decision.
Evidence limits: exploitation status unknown
fixed version or patch state unknown
affected product not structured
[Evidence source: www.zerodayinitiative.com](<http://www.zerodayinitiative.com/advisories/ZDI-26-578/>)
Finding 05 — Norton Utilities Ultimate NortonUtilitiesSvc Link Following Local Privilege Escalation Vulnerability
What changed: This vulnerability allows local attackers to escalate privileges on affected installations of Norton Utilities Ultimate. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
Technical evidence: CVE-2024-13962; CVSS v3.1 7.8; weakness ['CWE-59']; technical confidence High.
Why it matters: The High priority moves this beyond routine tracking and requires exposure validation, remediation, and compromise assessment.
Observed status: Observed in-the-wild exploitation status is unknown.
Action: Map CVE-2024-13962 to owned assets, confirm the affected and fixed versions in the cited source, deploy the applicable remediation, and retain evidence of the exposure decision.
Evidence limits: exploitation status unknown
fixed version or patch state unknown
affected product not structured
[Evidence source: www.zerodayinitiative.com](<http://www.zerodayinitiative.com/advisories/ZDI-26-567/>)
Finding 06 — BlackBerry QNX KEV File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability
What changed: This vulnerability allows remote attackers to execute arbitrary code on affected installations of BlackBerry QNX. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.
Technical evidence: CVE-2026-40272; CVSS v3.1 7; weakness ['CWE-1284']; technical confidence High.
Why it matters: The High priority moves this beyond routine tracking and requires exposure validation, remediation, and compromise assessment.
Observed status: Observed in-the-wild exploitation status is unknown.
Action: Map CVE-2026-40272 to owned assets, confirm the affected and fixed versions in the cited source, deploy the applicable remediation, and retain evidence of the exposure decision.
Evidence limits: exploitation status unknown
fixed version or patch state unknown
affected product not structured
[Evidence source: www.zerodayinitiative.com](<http://www.zerodayinitiative.com/advisories/ZDI-26-566/>)
Finding 07 — Gen Digital CCleaner Link Following Local Privilege Escalation Vulnerability
What changed: This vulnerability allows local attackers to escalate privileges on affected installations of Gen Digital CCleaner. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
Technical evidence: CVE-2026-12410; CVSS v3.1 7.8; weakness ['CWE-59']; technical confidence High.
Why it matters: The High priority moves this beyond routine tracking and requires exposure validation, remediation, and compromise assessment.
Observed status: Observed in-the-wild exploitation status is unknown.
Action: Map CVE-2026-12410 to owned assets, confirm the affected and fixed versions in the cited source, deploy the applicable remediation, and retain evidence of the exposure decision.
Evidence limits: exploitation status unknown
fixed version or patch state unknown
affected product not structured
[Evidence source: www.zerodayinitiative.com](<http://www.zerodayinitiative.com/advisories/ZDI-26-565/>)
Finding 08 — Argo Workflows: ArtifactGC.PodSpecPatch bypasses Strict/Secure template reference allow-list (Incomplete fix for CVE-2026-31892).
What changed: Argo Workflows: ArtifactGC.PodSpecPatch bypasses Strict/Secure template reference allow-list (Incomplete fix for CVE-2026-31892). CVE coverage: CVE-2026-54526.
Technical evidence: CVE-2026-54526; CVSS v4.0 8.9; weakness ['CWE-284']; technical confidence High.
Why it matters: The High priority moves this beyond routine tracking and requires exposure validation, remediation, and compromise assessment.
Observed status: Observed in-the-wild exploitation status is unknown.
Action: Map CVE-2026-54526 to owned assets, confirm the affected and fixed versions in the cited source, deploy the applicable remediation, and retain evidence of the exposure decision.
Evidence limits: exploitation status unknown
fixed version or patch state unknown
affected product not structured
[Evidence source: github.com](<https://github.com/advisories/GHSA-48p8-g2fx-3wwm>)
Finding 09 — NVIDIA Transformers4Rec load_model_trainer_states_from_checkpoint Deserialization of Untrusted Data Remote Code Execution Vulnerability
What changed: This vulnerability allows remote attackers to execute arbitrary code on affected installations of NVIDIA Transformers4Rec. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.
Technical evidence: CVE-2026-24232; CVSS v3.1 4.3; weakness ['CWE-502']; technical confidence High.
Why it matters: The Medium priority requires exposure validation and scheduled remediation through normal change control.
Observed status: Observed in-the-wild exploitation status is unknown.
Action: Map CVE-2026-24232 to owned assets, confirm the affected and fixed versions in the cited source, deploy the applicable remediation, and retain evidence of the exposure decision.
Evidence limits: exploitation status unknown
fixed version or patch state unknown
affected product not structured
[Evidence source: www.zerodayinitiative.com](<http://www.zerodayinitiative.com/advisories/ZDI-26-564/>)
Finding 10 — Nightmare Eclipse Drops Windows Zero-Day Exploit ‘ShieldBreak’
What changed: Dropped on Patch Tuesday, the exploit allows any user to spawn a shell with System privileges. .
Why it matters: Reported active exploitation elevates this above routine patching: validate exposure immediately, remediate, and assess for prior compromise.
Observed status: The cited source reports active in-the-wild exploitation; independent corroboration (CISA KEV or grounded vendor data) is not yet available.
Action: Review the cited source, validate exposure of the affected technology in owned environments, apply available vendor guidance, and retain evidence of the exposure decision.
Evidence limits: grounded severity unavailable
exploitation status unknown
fixed version or patch state unknown
affected product not structured
[Evidence source: www.securityweek.com](<https://www.securityweek.com/nightmare-eclipse-drops-windows-zero-day-exploit-shieldbreak/>)
Finding 11 — Microsoft patches LegacyHive Windows zero-day vulnerability
What changed: Microsoft has released security patches to address a Windows zero-day vulnerability known as "LegacyHive," disclosed after the July 2026 Patch Tuesday. [...].
Why it matters: Reported active exploitation elevates this above routine patching: validate exposure immediately, remediate, and assess for prior compromise.
Observed status: The cited source reports active in-the-wild exploitation; independent corroboration (CISA KEV or grounded vendor data) is not yet available.
Action: Review the cited source, validate exposure of the affected technology in owned environments, apply available vendor guidance, and retain evidence of the exposure decision.
Evidence limits: grounded severity unavailable
exploitation status unknown
fixed version or patch state unknown
affected product not structured
[Evidence source: www.bleepingcomputer.com](<https://www.bleepingcomputer.com/news/microsoft/microsoft-patches-legacyhive-windows-zero-day-vulnerability/>)