🛡️ Cybersecurity Vulnerability Watch

Week of: 2026-08-09 to 2026-08-15 Reporting window: Most recently completed Sunday–Saturday (excludes the in-progress week).

1. Top Action Item

Patch SAP Commerce Cloud now — CVE-2026-58231 (CVSS 10.0) is being actively exploited days after SAP shipped the fix. The flaw lets an unauthenticated attacker abuse a default authentication client and submit requests due to insufficient authorization checks and input validation, giving a maximum-severity foothold in the platform. If you cannot patch within 48 hours, isolate externally reachable Commerce Cloud instances and audit for unauthorized access using that default client.

2. Exploited This Week

SAP Commerce Cloud — CVE-2026-58231

• Source: The Hacker News
• Link: The Hacker News
• Severity: Critical — CVSS 10.0
• What's happening: Active exploitation attempts are underway against the maximum-severity flaw, which lets an unauthenticated attacker abuse a default authentication client due to insufficient authorization checks and input validation.
• Fix: Apply SAP's patch for CVE-2026-58231 immediately; audit for unauthorized access in the interim.

Apple macOS Screen Sharing — CVE-2026-65400

• Source: The Hacker News
• Link: The Hacker News
• Severity: Critical — CVSS 9.8
• What's happening: The Netherlands National Cyber Security Centre (NCSC-NL) warns the critical authentication flaw in Screen Sharing is being exploited in the wild on internet-exposed Macs to install a Monero cryptocurrency miner.
• Fix: Install the patched macOS release; disable Screen Sharing if not required and avoid exposing it to the internet.

VMware vCenter Server — CVE-2026-59310

• Source: Dark Reading
• Link: Dark Reading
• Severity: Critical (see source)
• What's happening: A global threat campaign is exploiting the critical vCenter flaw; exploitation began earlier this month.
• Fix: Apply VMware's patch, but note that patching may not fully mitigate the threat — investigate vCenter infrastructure for signs of prior compromise.

GeoServer — zero-day (no CVE assigned yet)

• Source: The Hacker News
• Link: The Hacker News
• Severity: High — SQL injection leading to remote code execution (see source)
• What's happening: Active exploitation attempts target an unpatched SQL injection zero-day in the open-source GeoServer platform, first disclosed on August 12, 2026; it can lead to RCE.
• Fix: No patch available yet — restrict network access to GeoServer instances, apply compensating controls, and monitor for exploitation.

3. Critical Patch Roundup

Microsoft August 2026 Patch Tuesday — 421 CVEs, 62 critical

• Source: Cisco Talos
• Link: Cisco Talos
• Severity: 62 vulnerabilities marked "critical"
• What's happening: Microsoft's monthly release covers a wide range of products and is the largest patch wave of the cycle.
• Fix: Deploy the August 2026 Windows/Office updates as part of your normal patch cycle.

Microsoft Edge (Chromium-based) — CVE-2026-72970

• Source: Microsoft MSRC
• Link: Microsoft MSRC
• Severity: Remote code execution — severity see source
• What's happening: Heap-based buffer overflow in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
• Fix: Update Microsoft Edge to the latest version.

Chromium (Chrome / Edge) — CVE-2026-19556 through CVE-2026-19560

• Source: Microsoft MSRC
• Link: Microsoft MSRC
• Severity: See source
• What's happening: Five use-after-free vulnerabilities in V8, Blink, HTML, Extensions, and TabStrip; Microsoft Edge ingests these Chromium fixes.
• Fix: Update Microsoft Edge and Google Chrome to the latest releases.

Fortinet — FortiWeb Remote Radius Type Admin Authentication (FG-IR-26-158)

• Source: Fortinet FortiGuard
• Link: Fortinet FortiGuard
• Severity: High — CVSS 8.8
• What's happening: An improper authentication flaw in specifically configured RADIUS admin groups may let a remote unauthenticated attacker log into the FortiWeb GUI/CLI with a random username and password.
• Fix: Apply the FortiGuard-released fix; review RADIUS admin group configuration.

Fortinet — FortiManager FGFM Authentication Weakening (FG-IR-26-160)

• Source: Fortinet FortiGuard
• Link: Fortinet FortiGuard
• Severity: High — CVSS 7.3
• What's happening: An authentication bypass via alternate path/channel may allow a remote unauthenticated attacker with a valid certificate to impersonate any managed FortiGate through crafted FGFM requests when a specific CLI option is set.
• Fix: Apply the FortiGuard-released fix and audit FGFM configuration.

Fortinet — FortiClient Windows kernel driver heap overflow (FG-IR-26-156)

• Source: Fortinet FortiGuard
• Link: Fortinet FortiGuard
• Severity: High — CVSS 7.3
• What's happening: A heap overflow from missing size validation in a kernel driver may let an unauthenticated attacker who can alter or craft DNS responses execute arbitrary code on the targeted host.
• Fix: Apply the FortiGuard-released fix for FortiClient Windows.

4. Home / SOHO Impact

• Update your Mac. Apple has patched CVE-2026-65400 in Screen Sharing, and it is already being exploited on internet-exposed Macs to install a Monero miner. Apply the macOS update, and turn Screen Sharing off if you don't use it.
• Update Chrome and Edge. The latest Chromium release fixes five use-after-free bugs plus an Edge remote-code-execution flaw — install the new versions as soon as they appear.
• Beware of fake job interviews. Researchers found 3,000+ recruitment-themed phishing URLs using fake interview scheduling pages and Browser-in-the-Browser windows to steal Google/Facebook credentials and relay MFA prompts in real time.
• Take Apple's spyware warnings seriously. Apple notified users in 110 countries that they may be targeted by mercenary spyware — if you received a notification, treat the device as potentially compromised.
• Retire old Android devices. The Kimwolf v7 botnet is targeting Android IoT devices with HTTP/2 DDoS capabilities — replace or disconnect aging Android phones and devices on your home network.

5. Enterprise Impact

• GeoServer zero-day is actively exploited with no patch — SQL injection leading to RCE. Restrict network access, put instances behind a WAF/allowlist, and hunt for exploitation attempts; watch for a CVE assignment and vendor fix.
• vCenter CVE-2026-59310 patching alone may not be enough — the global campaign means assume prior compromise; perform a forensic review of vCenter/vSphere and check for persistence before and after patching.
• SAP Commerce Cloud CVE-2026-58231 — apply the patch urgently and audit for abuse of default authentication clients; review logs for unauthenticated access.
• Fortinet appliances need attention — prioritize FortiWeb (CVSS 8.8) admin authentication bypass, FortiManager (CVSS 7.3) FGFM impersonation, and FortiClient Windows (CVSS 7.3) kernel driver RCE fixes.
• Microsoft Patch Tuesday released 421 CVEs including 62 critical — treat this as a priority within your normal cadence, especially the Edge/Chromium RCE and use-after-free fixes.
• Watch for post-exploitation browser session hijacking — a new technique abuses the Chrome DevTools Protocol inside running Chrome/Edge processes on Windows to steal cookies and sessions. Enforce least privilege and monitor for remote-debugging activity.
• Salesforce/ServiceNow tenants targeted by the "City-Forum" data theft campaign since March 2025 — review connected apps, OAuth grants, and third-party access.
• Mustang Panda (HoneyMyte) is deploying an updated CoolClient backdoor with a signed Windows kernel rootkit; Kaspersky reports victims in Myanmar, Mongolia, and Pakistan — hunt accordingly if you operate in those regions.

6. What To Patch First

1. SAP Commerce Cloud — CVE-2026-58231 (exploited, CVSS 10.0)
2. VMware vCenter Server — CVE-2026-59310 (exploited, critical)
3. Apple macOS — CVE-2026-65400 (exploited, CVSS 9.8)
4. GeoServer — unpatched zero-day (exploited; mitigation: restrict/isolate)
5. Microsoft August 2026 Patch Tuesday — 421 CVEs, 62 critical (widely deployed)
6. Microsoft Edge — CVE-2026-72970 (remote code execution)
7. Google Chrome / Microsoft Edge Chromium — CVE-2026-19556 through CVE-2026-19560 (use-after-free, widely deployed)
8. FortiWeb — FG-IR-26-158 (CVSS 8.8, authentication bypass)
9. FortiManager / FortiManager Cloud — FG-IR-26-160 (CVSS 7.3, authentication bypass)
10. FortiClient Windows — FG-IR-26-156 (CVSS 7.3, kernel driver RCE)

Sources

• SAP Commerce Cloud CVE-2026-58231 Targeted in Exploitation Attempts Days After Patch — https://thehackernews.com/2026/08/sap-commerce-cloud-cve-2026-58231.html
• Apple macOS Screen Sharing Flaw Exploited on Internet-Exposed Macs to Install Monero Miner — https://thehackernews.com/2026/08/apple-macos-screen-sharing-flaw.html
• Global Threat Campaign Hits Critical VMware vCenter Flaw — https://www.darkreading.com/vulnerabilities-threats/global-threat-campaign-critical-vmware-vcenter-flaw
• GeoServer Zero-Day Targeted in Active Exploitation Attempts, Can Lead to RCE — https://thehackernews.com/2026/08/unpatched-geoserver-zero-day-targeted.html
• Microsoft Patch Tuesday for August 2026 — Snort rules and prominent vulnerabilities — https://blog.talosintelligence.com/microsoft-patch-tuesday-for-august-2026/
• CVE-2026-72970 Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability — https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-72970
• Chromium: CVE-2026-19560 Use after free in Blink — https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-19560
• Broken access control in the RADIUS type admin group (FG-IR-26-158) — https://fortiguard.fortinet.com/psirt/FG-IR-26-158
• FGFM Authentication Weakening via CLI Configuration (FG-IR-26-160) — https://fortiguard.fortinet.com/psirt/FG-IR-26-160
• Heap overflow in kernel driver due to missing size validation (FG-IR-26-156) — https://fortiguard.fortinet.com/psirt/FG-IR-26-156
• Chrome DevTools Technique Enables Authenticated Session Hijacking in Live Windows Browsers — https://thehackernews.com/2026/08/chrome-devtools-technique-enables.html
• CTM360 Uncovers Over 3,000 Recruitment Phishing URLs Using Browser-in-the-Browser (BitB) Credential Traps — https://thehackernews.com/2026/08/ctm360-uncovers-over-3000-recruitment.html
• Apple Warns Users in 110 Countries They May Be Targets of Mercenary Spyware — https://thehackernews.com/2026/08/apple-warns-users-in-110-countries-they.html
• Kimwolf v7: An Evolution of the Kimwolf Botnet — https://unit42.paloaltonetworks.com/kimwolf-v7-botnet-malware/
• Long-running Data Theft Campaign Targeting Salesforce, ServiceNow — https://www.darkreading.com/cyberattacks-data-breaches/long-running-data-theft-campaign-salesforce-servicenow
• Mustang Panda Adds Signed Windows Rootkit to CoolClient Backdoor for Stealth — https://thehackernews.com/2026/08/mustang-panda-adds-signed-windows.html