Active Exploitation, Ransomware, and Espionage on One Attack Surface

Executive Summary

This week placed edge infrastructure and enterprise platforms squarely in the crosshairs, as zero-day exploitation, opportunistic vulnerability abuse, and state-sponsored espionage converged across a single reporting window. The Cybersecurity and Infrastructure Security Agency (CISA) expanded its Known Exploited Vulnerabilities catalog with four new entries, spanning analytics, operating system, network security, and load balancing products. The additions included a Metabase SQL injection vulnerability, a Microsoft Windows Ancillary Function Driver for WinSock flaw actively exploited as a zero-day, a Cisco Secure Firewall denial-of-service vulnerability, and a Progress Kemp LoadMaster command injection flaw. Beyond the catalog additions, active exploitation surfaced across several other high-value enterprise targets. Threat actors weaponized an authentication bypass vulnerability in Microsoft SharePoint following the rapid release of proof-of-concept code, exploited a directory-traversal flaw in Broadcom VMware vCenter Server to deploy persistence through malicious cron jobs and reverse SSH tooling, and probed an incorrect authorization vulnerability in Adobe Commerce and Magento e-commerce platforms capable of hijacking customer accounts without authentication. The week also delivered pointed reminders that nation-state and ransomware operators remain relentless and increasingly sophisticated. A joint advisory from CISA, the FBI, and international partners warned of Gunra ransomware exploiting internet-facing Fortinet FortiOS and FortiProxy appliances to breach critical infrastructure sectors through a double extortion model. In parallel, the North Korea-affiliated Lazarus Group exploited a Windows zero-day to gain SYSTEM-level access as part of its long-running Operation Dream Job campaign, luring defense and aerospace targets through fake recruiter outreach before deploying a chain of loaders, rootkits, and backdoors.

1. Trending / Critical Vulnerabilities

This week’s vulnerability activity underscored continued targeting of application delivery controllers, enterprise firewalls and VPN gateways, virtualization management platforms, collaboration and e-commerce web servers, open-source analytics applications, and core operating system components, reflecting sustained adversary interest in internet-facing and enterprise-critical technologies that facilitated unauthenticated remote code execution, authentication bypass, privilege escalation, and full system compromise. CISA expanded its Known Exploited Vulnerabilities (KEV) Catalog with four new entries, including CVE-2026–8037 in Progress Kemp LoadMaster, CVE-2026–20349 in Cisco Secure Firewall ASA and FTD, CVE-2026–68820 in the Microsoft Windows Ancillary Function Driver for WinSock, and CVE-2026–72898 in Metabase, confirming active exploitation across load balancing, network security, kernel, and analytics technologies. According to eSentire, the LoadMaster command injection flaw drew exploitation attempts on June 29, 2026, the same day functional proof-of-concept code appeared, abusing single-quote escaping expansion and a JSON-based heap-spraying primitive within the escape_quotes() function to smuggle command content into a shell command executed through system() at the /accessv2 endpoint and achieve unauthenticated remote code execution. The Cisco flaw, confirmed under active exploitation in August 2026, allowed an unauthenticated remote attacker to reload affected devices into a denial-of-service condition through a crafted HTTP request to the Remote Access SSL VPN service, with no workarounds available and hot fixes issued across multiple ASA and FTD release trains. Check Point Research attributed exploitation of the WinSock use-after-free flaw to a renewed Lazarus Operation Dream Job campaign against the defense, aerospace, and aviation sectors, chaining DLL sideloading through a trojanized signed PDF viewer, the MISTPEN downloader, an in-memory privilege escalation module, the ForestTiger backdoor, and the FudModule rootkit to elevate to SYSTEM and disable EDR visibility. The Metabase SQL injection flaw, disclosed on August 6, 2026 as a zero-day exploited against Metabase Cloud, abused an undocumented user-id key at the /api/session/reset_password endpoint that reached a HoneySQL query as unparameterized raw SQL, granting administrator access and exposure of stored database credentials, with public proof-of-concept code emerging by August 10, 2026 and roughly 2,500 exposed instances appearing in Shodan. Beyond the KEV additions, Defused reported exploitation of the Microsoft SharePoint authentication bypass flaw, CVE-2026–55040, against honeypots ahead of any confirmed in-the-wild flagging, with Shadowserver tracking over 8,500 exposed servers and public proof-of-concept code available. According to QUIRSO, a suspected advanced persistent threat actor exploited the Broadcom VMware vCenter Server directory-traversal flaw, , beginning Aug CVE-2026–59310 ust 3, 2026, five days after disclosure, deploying a malicious cron job and reverse_ssh for persistence across as many as 361 victim IP addresses in 47 countries. Sansec reported that the Shield web application firewall blocked exploitation attempts against the Adobe Commerce and Magento incorrect authorization flaw, CVE-2026–71362, which permitted an unauthenticated attacker to switch a customer session to another account and access private customer data without existing credentials or user interaction.

2. Exploit Activity and Mass Scanning Observed on Cytellite Sensors

Cytellite observations during this period highlighted continued exploitation and emerging security risks across enterprise communications platforms, content management systems, web server management interfaces, web application frameworks, networking devices, AI and developer platforms, enterprise business applications, secure remote access gateways, printing services, and IP surveillance systems, reflecting sustained adversary interest in technologies capable of enabling remote code execution, authentication bypass, unauthorized access, and infrastructure compromise. Vulnerabilities observed under active exploitation and added to the CISA KEV Catalog included CVE-2025–57819 in Sangoma FreePBX, CVE-2025–55182 in Meta React Server Components, CVE-2025–3248 in Langflow, CVE-2025–31324 in SAP NetWeaver Visual Composer Metadata Uploader, CVE-2025–22457 in Ivanti Connect Secure, Policy Secure, and ZTA Gateways, and CVE-2024–7029 in AVTECH SECURITY Corporation IP cameras, all of which provided pathways for authentication bypass, remote code execution, unrestricted file upload, stack-based buffer overflow, and command injection. Additional exploitation activity targeted CVE-2025–34037 in Linksys E-Series Routers and CVE-2024–47176 in OpenPrinting CUPS, demonstrating continued attacker focus on exposed services and network devices despite the absence of KEV designation. Beyond exploited flaws, critical severity issues were disclosed in CVE-2026–63030 affecting WordPress Core through an interpretation conflict and CVE-2026–27944 affecting Nginx UI through missing authentication for a critical function, alongside a high severity sensitive information disclosure flaw, CVE-2025–30208, in Vite.

3. Vulnerabilities Abused by Malware

Recent threat activity highlighted the convergence of ransomware and state-aligned espionage against internet-facing appliances and core operating system components. According to CISA, the FBI, and South Korean and United States partners, Gunra ransomware targeted critical infrastructure worldwide by exploiting Fortinet FortiOS and FortiProxy flaws, CVE-2024–55591 and CVE-2025–24472, for initial access before double extortion, listing 51 victims since April 2025. Separately, Check Point Research detailed North Korea-affiliated Lazarus Group exploiting CVE-2026–68820, a WinSock privilege escalation zero-day, against defense and aerospace firms in France, Germany, Brazil, and India under Operation Dream Job, using fake recruiter lures and trojanized PDF viewers to deploy the MISTPEN downloader, ForestTiger backdoor, and FudModule rootkit for SYSTEM-level access and EDR evasion. Microsoft patched the flaw in the August 2026 Patch Tuesday updates, and it was recently added to the CISA KEV catalog.

4. OSS Trending vulnerabilities observed this week

This week’s open-source threat activity highlighted critical vulnerabilities affecting AI model-serving runtimes, Python Git interface libraries, web application frameworks, operating system kernels, and cloud development UI components, reinforcing persistent risks associated with insecure open-source components, exposed services, and software supply chain dependencies. Notable issues included CVE-2026–7482 in the Go ecosystem affecting Ollama, where a heap out-of-bounds read flaw risked memory disclosure and potential service disruption, CVE-2026–67323 in the PyPI ecosystem affecting GitPython, introducing a command injection flaw that could undermine intended access controls and lead to system compromise, and CVE-2026–66066 in the RubyGems ecosystem affecting Action Pack, where an arbitrary file read vulnerability exposed applications to unauthorized access of sensitive files. Additional vulnerabilities included CVE-2026–43499 in the Ubuntu ecosystem affecting the Linux kernel, stemming from a use-after-free weakness that risked memory corruption and potential privilege escalation, and CVE-2025–4318 in the npm ecosystem affecting AWS Amplify Studio, introducing an input validation issue in UI component properties that could permit injection of unintended code or expressions.

5. Pre-NVDs vulnerabilities observed this week

This week’s early vulnerability disclosures revealed multiple security issues across remote application delivery clients, content management systems, security monitoring platforms, network transport libraries, geospatial mapping servers, and e-commerce payment integrations, highlighting emerging risks across enterprise environments, backend services, and open-source software components. Notable findings included CVE-2026–13121 affecting Parallels RAS Client, where an exposed dangerous method or function flaw could permit unintended invocation of sensitive operations, and CVE-2026–32639 in Winter CMS, which introduced a broken access control vulnerability capable of granting unauthorized access to restricted functionality. Additional disclosures included CVE-2026–48162 in Wazuh, where an arbitrary file read flaw could allow attackers to access sensitive files on affected systems, and CVE-2026–57497 in webtransport-go, which exposed the library to a memory exhaustion vulnerability with potential for denial of service. CVE-2026–69228 affecting ArcGIS also introduced a missing authentication for critical function vulnerability that could allow an unauthorized actor to reach protected operations without credentials, alongside CVE-2026–73475 in Commerce PayPal, where a missing authorization flaw could enable access to resources beyond an actor’s intended permissions, impacting affected deployments.

Conclusion

The past week reinforced that adversaries continue to converge on internet-facing infrastructure and widely deployed enterprise platforms, chaining zero-days, authentication bypasses, and injection flaws into footholds that grant administrative control and long-term access. The parallel activity of a nation-state actor like Lazarus and opportunistic ransomware operators like Gunra illustrated that both targeted espionage and broad exploitation now unfold within the same narrow window, leaving defenders little room to react. Organizations that prioritize timely patching, reduce unnecessary internet exposure, and maintain continuous monitoring remained best positioned to limit their risk against these compounding threats. Sustained attention to authoritative sources such as the CISA KEV catalog offered a practical foundation for prioritizing remediation against the vulnerabilities most likely to be weaponized. Loginsoft Vulnerability Intelligence (LOVI) continues to track these developments as they emerge, delivering structured, timely, and actionable intelligence that helps security teams stay ahead of the threats that matter most.

For more details, check out the full report.