Executive assessment
No new findings met the reporting bar today. The 14 item(s) below are ongoing coverage of previously reported issues, still active and unresolved.
Finding 01 — Still active: Multiple vulnerabilities in Cisco Identity Services Engine
Coverage status: First reported 2026-08-14; ongoing coverage.
What changed: CVE coverage: CVE-2026-20190, CVE-2026-20148, CVE-2026-20147, CVE-2026-20181. The cited advisories disclose: Missing Authentication for Critical Function Information Disclosure Vulnerability; PatchUpdateListener Directory Traversal Information Disclosure Vulnerability; invokeScript Command Injection Remote Code Execution Vulnerability; zipFiles Directory Traversal Remote Code Execution Vulnerability.
Technical evidence: CVE-2026-20147; CVSS v3.1 9.9; weakness ['CWE-77']; technical confidence High.
Why it matters: The Critical priority moves this beyond routine tracking and requires exposure validation, remediation, and compromise assessment.
Observed status: Observed in-the-wild exploitation status is unknown.
Action: Map CVE-2026-20147 to owned assets, confirm the affected and fixed versions in the cited source, deploy the applicable remediation, and retain evidence of the exposure decision.
Evidence limits: exploitation status unknown
fixed version or patch state unknown
affected product not structured
[Evidence source: www.zerodayinitiative.com](<http://www.zerodayinitiative.com/advisories/ZDI-26-580/>)
Finding 02 — Still active: Critical VMware vCenter RCE flaw exploited for reverse SSH access
Coverage status: First reported 2026-08-14; ongoing coverage.
What changed: A recently patched critical vulnerability (CVE-2026-59310) in VMware vCenter Syslog Server is being exploited in an active campaign to deploy a reverse SSH tool for persistence and remote access. [...].
Technical evidence: CVE-2026-59310; CVSS v3.1 9.8; weakness ['CWE-22']; technical confidence High.
Why it matters: Reported active exploitation elevates this above routine patching: validate exposure immediately, remediate, and assess for prior compromise.
Observed status: The cited source reports active in-the-wild exploitation; independent corroboration (CISA KEV or grounded vendor data) is not yet available.
Action: Map CVE-2026-59310 to owned assets, confirm the affected and fixed versions in the cited source, deploy the applicable remediation, and retain evidence of the exposure decision.
Evidence limits: exploitation status unknown
fixed version or patch state unknown
affected product not structured
[Evidence source: www.bleepingcomputer.com](<https://www.bleepingcomputer.com/news/security/critical-vmware-vcenter-rce-flaw-exploited-for-reverse-ssh-access/>)
Finding 03 — Still active: Adobe Patches Three CVSS 10.0 ColdFusion and Campaign Classic Flaws
Coverage status: First reported 2026-08-13; ongoing coverage.
What changed: Adobe has shipped updates to address multiple critical security vulnerabilities impacting ColdFusion, Commerce, and Campaign Classic that, if successfully exploited, could result in arbitrary code execution and privilege escalation. The most severe of the flaws are listed below - CVE-2026-48362 (CVSS score: 10.0) - An operating system command injection vulnerability in ColdFusion that could.
Technical evidence: CVE-2026-48362; CVSS v3.1 10; weakness ['CWE-78']; technical confidence High.
Why it matters: The Critical priority moves this beyond routine tracking and requires exposure validation, remediation, and compromise assessment.
Observed status: Observed in-the-wild exploitation status is unknown.
Action: Map CVE-2026-48362 to owned assets, confirm the affected and fixed versions in the cited source, deploy the applicable remediation, and retain evidence of the exposure decision.
Evidence limits: exploitation status unknown
fixed version or patch state unknown
affected product not structured
[Evidence source: thehackernews.com](<https://thehackernews.com/2026/08/adobe-patches-three-cvss-100-coldfusion.html>)
Finding 04 — Still active: Adobe Commerce Bug Targeted Immediately After Disclosure
Coverage status: First reported 2026-08-14; ongoing coverage.
What changed: The first exploitation attempts targeting CVE-2026-71362 were observed shortly after Adobe released patches. .
Technical evidence: CVE-2026-71362; CVSS v3.1 9.1; weakness ['CWE-863']; technical confidence High.
Why it matters: The Critical priority moves this beyond routine tracking and requires exposure validation, remediation, and compromise assessment.
Observed status: Observed in-the-wild exploitation status is unknown.
Action: Map CVE-2026-71362 to owned assets, confirm the affected and fixed versions in the cited source, deploy the applicable remediation, and retain evidence of the exposure decision.
Evidence limits: exploitation status unknown
fixed version or patch state unknown
[Evidence source: www.securityweek.com](<https://www.securityweek.com/adobe-commerce-bug-targeted-immediately-after-disclosure/>)
Finding 05 — Still active: SAP Commerce Cloud Flaw Could Let Unauthenticated Attackers Execute Arbitrary Code
Coverage status: First reported 2026-08-13; ongoing coverage.
What changed: SAP has released patches to address a maximum-severity security flaw impacting Commerce Cloud (Data Hub Adapter) that could result in arbitrary code execution. The vulnerability, assigned the CVE identifier CVE-2026-58231, is rated 10.0 on the CVSS scoring system.
Technical evidence: CVE-2026-58231; CVSS v3.1 10; weakness ['CWE-94']; technical confidence High.
Why it matters: The Critical priority moves this beyond routine tracking and requires exposure validation, remediation, and compromise assessment.
Observed status: Observed in-the-wild exploitation status is unknown.
Action: Map CVE-2026-58231 to owned assets, confirm the affected and fixed versions in the cited source, deploy the applicable remediation, and retain evidence of the exposure decision.
Evidence limits: exploitation status unknown
fixed version or patch state unknown
affected product not structured
[Evidence source: thehackernews.com](<https://thehackernews.com/2026/08/sap-commerce-cloud-flaw-could-let.html>)
Finding 06 — Still active: NGINX HTTP Dav Module Alias Directive Integer Underflow Remote Code Execution Vulnerability
Coverage status: First reported 2026-08-14; ongoing coverage.
What changed: This vulnerability allows remote attackers to execute arbitrary code on affected installations of NGINX. Authentication is not required to exploit this vulnerability.
Technical evidence: CVE-2026-27654; CVSS v3.1 8.2; weakness ['CWE-122']; technical confidence High.
Why it matters: The High priority moves this beyond routine tracking and requires exposure validation, remediation, and compromise assessment.
Observed status: Observed in-the-wild exploitation status is unknown.
Action: Map CVE-2026-27654 to owned assets, confirm the affected and fixed versions in the cited source, deploy the applicable remediation, and retain evidence of the exposure decision.
Evidence limits: exploitation status unknown
fixed version or patch state unknown
affected product not structured
[Evidence source: www.zerodayinitiative.com](<http://www.zerodayinitiative.com/advisories/ZDI-26-578/>)
Finding 07 — Still active: Norton Utilities Ultimate NortonUtilitiesSvc Link Following Local Privilege Escalation Vulnerability
Coverage status: First reported 2026-08-14; ongoing coverage.
What changed: This vulnerability allows local attackers to escalate privileges on affected installations of Norton Utilities Ultimate. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
Technical evidence: CVE-2024-13962; CVSS v3.1 7.8; weakness ['CWE-59']; technical confidence High.
Why it matters: The High priority moves this beyond routine tracking and requires exposure validation, remediation, and compromise assessment.
Observed status: Observed in-the-wild exploitation status is unknown.
Action: Map CVE-2024-13962 to owned assets, confirm the affected and fixed versions in the cited source, deploy the applicable remediation, and retain evidence of the exposure decision.
Evidence limits: exploitation status unknown
fixed version or patch state unknown
affected product not structured
[Evidence source: www.zerodayinitiative.com](<http://www.zerodayinitiative.com/advisories/ZDI-26-567/>)
Finding 08 — Still active: BlackBerry QNX KEV File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability
Coverage status: First reported 2026-08-14; ongoing coverage.
What changed: This vulnerability allows remote attackers to execute arbitrary code on affected installations of BlackBerry QNX. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.
Technical evidence: CVE-2026-40272; CVSS v3.1 7; weakness ['CWE-1284']; technical confidence High.
Why it matters: The High priority moves this beyond routine tracking and requires exposure validation, remediation, and compromise assessment.
Observed status: Observed in-the-wild exploitation status is unknown.
Action: Map CVE-2026-40272 to owned assets, confirm the affected and fixed versions in the cited source, deploy the applicable remediation, and retain evidence of the exposure decision.
Evidence limits: exploitation status unknown
fixed version or patch state unknown
affected product not structured
[Evidence source: www.zerodayinitiative.com](<http://www.zerodayinitiative.com/advisories/ZDI-26-566/>)
Finding 09 — Still active: Gen Digital CCleaner Link Following Local Privilege Escalation Vulnerability
Coverage status: First reported 2026-08-14; ongoing coverage.
What changed: This vulnerability allows local attackers to escalate privileges on affected installations of Gen Digital CCleaner. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
Technical evidence: CVE-2026-12410; CVSS v3.1 7.8; weakness ['CWE-59']; technical confidence High.
Why it matters: The High priority moves this beyond routine tracking and requires exposure validation, remediation, and compromise assessment.
Observed status: Observed in-the-wild exploitation status is unknown.
Action: Map CVE-2026-12410 to owned assets, confirm the affected and fixed versions in the cited source, deploy the applicable remediation, and retain evidence of the exposure decision.
Evidence limits: exploitation status unknown
fixed version or patch state unknown
affected product not structured
[Evidence source: www.zerodayinitiative.com](<http://www.zerodayinitiative.com/advisories/ZDI-26-565/>)
Finding 10 — Still active: Argo Workflows: ArtifactGC.PodSpecPatch bypasses Strict/Secure template reference allow-list (Incomplete fix for CVE-2026-31892).
Coverage status: First reported 2026-08-14; ongoing coverage.
What changed: Argo Workflows: ArtifactGC.PodSpecPatch bypasses Strict/Secure template reference allow-list (Incomplete fix for CVE-2026-31892). CVE coverage: CVE-2026-54526.
Technical evidence: CVE-2026-54526; CVSS v4.0 8.9; weakness ['CWE-284']; technical confidence High.
Why it matters: The High priority moves this beyond routine tracking and requires exposure validation, remediation, and compromise assessment.
Observed status: Observed in-the-wild exploitation status is unknown.
Action: Map CVE-2026-54526 to owned assets, confirm the affected and fixed versions in the cited source, deploy the applicable remediation, and retain evidence of the exposure decision.
Evidence limits: exploitation status unknown
fixed version or patch state unknown
affected product not structured
[Evidence source: github.com](<https://github.com/advisories/GHSA-48p8-g2fx-3wwm>)
Finding 11 — Still active: NVIDIA Transformers4Rec load_model_trainer_states_from_checkpoint Deserialization of Untrusted Data Remote Code Execution Vulnerability
Coverage status: First reported 2026-08-14; ongoing coverage.
What changed: This vulnerability allows remote attackers to execute arbitrary code on affected installations of NVIDIA Transformers4Rec. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.
Technical evidence: CVE-2026-24232; CVSS v3.1 4.3; weakness ['CWE-502']; technical confidence High.
Why it matters: The Medium priority requires exposure validation and scheduled remediation through normal change control.
Observed status: Observed in-the-wild exploitation status is unknown.
Action: Map CVE-2026-24232 to owned assets, confirm the affected and fixed versions in the cited source, deploy the applicable remediation, and retain evidence of the exposure decision.
Evidence limits: exploitation status unknown
fixed version or patch state unknown
affected product not structured
[Evidence source: www.zerodayinitiative.com](<http://www.zerodayinitiative.com/advisories/ZDI-26-564/>)
Finding 12 — Still active: Malicious LiteLLM Releases Tied to Trivy Hack May Have Exposed 2,100+ Organizations
Coverage status: First reported 2026-08-13; ongoing coverage.
What changed: Two malicious LiteLLM releases sat on PyPI for about 40 minutes in March carrying credential-stealing code capable of harvesting cloud keys, SSH keys, Kubernetes tokens, database passwords, and other secrets from systems that installed them. Threat intelligence firm CloudSEK now says a dataset it obtained, built from roughly 434,000 files the attackers captured, maps potential exposure to more.
Why it matters: The cited reporting affects widely deployed technology, so exposure validation and source verification need explicit ownership.
Observed status: The cited source reports an active supply-chain compromise; exposure depends on use of the affected packages rather than exploitation of a single vulnerability.
Action: Review the cited source, validate exposure of the affected technology in owned environments, apply available vendor guidance, and retain evidence of the exposure decision.
Evidence limits: grounded severity unavailable
exploitation status unknown
fixed version or patch state unknown
affected product not structured
[Evidence source: thehackernews.com](<https://thehackernews.com/2026/08/malicious-litellm-releases-tied-to.html>)
Finding 13 — Still active: Microsoft patches LegacyHive Windows zero-day vulnerability
Coverage status: First reported 2026-08-14; ongoing coverage.
What changed: Microsoft has released security patches to address a Windows zero-day vulnerability known as "LegacyHive," disclosed after the July 2026 Patch Tuesday. [...].
Why it matters: Reported active exploitation elevates this above routine patching: validate exposure immediately, remediate, and assess for prior compromise.
Observed status: The cited source reports active in-the-wild exploitation; independent corroboration (CISA KEV or grounded vendor data) is not yet available.
Action: Review the cited source, validate exposure of the affected technology in owned environments, apply available vendor guidance, and retain evidence of the exposure decision.
Evidence limits: grounded severity unavailable
exploitation status unknown
fixed version or patch state unknown
affected product not structured
[Evidence source: www.bleepingcomputer.com](<https://www.bleepingcomputer.com/news/microsoft/microsoft-patches-legacyhive-windows-zero-day-vulnerability/>)
Finding 14 — Still active: Lazarus Exploits Windows Zero-Day to Gain SYSTEM Access and Deploy Backdoor
Coverage status: First reported 2026-08-13; ongoing coverage.
What changed: The North Korean threat actor known as Lazarus Group has been attributed to the zero-day exploitation of a newly patched security flaw impacting Microsoft Windows to deliver a never-before-seen backdoor targeting defense and aerospace companies across France, Germany, Brazil, and India. The activity, per Check Point Research, is part of Operation Dream Job, a long-running cyber espionage and.
Why it matters: Reported active exploitation elevates this above routine patching: validate exposure immediately, remediate, and assess for prior compromise.
Observed status: The cited source reports active in-the-wild exploitation; independent corroboration (CISA KEV or grounded vendor data) is not yet available.
Action: Review the cited source, validate exposure of the affected technology in owned environments, apply available vendor guidance, and retain evidence of the exposure decision.
Evidence limits: grounded severity unavailable
exploitation status unknown
fixed version or patch state unknown
affected product not structured
[Evidence source: thehackernews.com](<https://thehackernews.com/2026/08/lazarus-exploits-windows-zero-day-to.html>)