Weekly recap: Week of 3 to 9 August 2026

• vulnerabilities3 sources
  CISA Adds Three Known Exploited Vulnerabilities to CatalogSource ↗

  CISA added three vulnerabilities to its Known Exploited Vulnerabilities Catalog based on evidence of active exploitation: CVE-2026-9198 (IBM Langflow code injection), CVE-2026-18556 (N-able N-central authentication bypass), and CVE-2026-34486 (Apache Tomcat missing encryption). Binding Operational Directive 26-04 requires federal agencies to prioritize rapid remediation of these high-risk vulnerabilities on publicly exposed assets, while CISA encourages all organizations to adopt similar risk-based vulnerability management practices.

• vulnerabilities2 sources
  CISA Flags TeamCity CVE-2026-63077 RCE Flaw Under Active Exploitation in the WildSource ↗

  CISA has confirmed that CVE-2026-63077, a critical remote code execution vulnerability in JetBrains TeamCity, is under active exploitation. The flaw, which affects on-premise TeamCity deployments and carries a CVSS score of 9.8, stems from unsafe deserialization of untrusted data and requires no authentication to exploit.

• vulnerabilities2 sources
  N-able Says Attackers Take Over N-central Servers After Initial Fix Proves IncompleteSource ↗

  N-able disclosed that attackers exploited an authentication bypass vulnerability (CVE-2026-18577) in N-central to obtain remote administrative access to the platform and systems managed through it. An initial patch released on August 2, 2026 proved incomplete, allowing continued exploitation. The vulnerability affects N-central builds prior to version 2026.3.1.7.

• vulnerabilities2 sources
  Attackers exploit N-able N-central flaw to reach managed endpoints (CVE-2026-18577)Source ↗

  Attackers are actively exploiting CVE-2026-18577, an authentication bypass vulnerability in N-able N-central, a remote monitoring and management platform widely deployed by managed service providers. N-able discovered the flaw on July 31, 2026, after observing unusual licensing activity and promptly engaged security teams to investigate the incident.

• ransomware
  Prolific ransomware group behind SonicWall zero-day attacksSource ↗

  The INC ransomware group has become the primary threat actor exploiting two SonicWall zero-day vulnerabilities (CVE-2026-15409 and CVE-2026-15410) disclosed on July 14. The group chained both flaws together to achieve full system access and has claimed multiple victims across Australia, the United States, the United Arab Emirates, Colombia, and Switzerland. SonicWall has faced a pattern of security issues, with ten of seventeen vulnerabilities added to CISA's known exploited vulnerabilities catalog since late 2021 linked to ransomware campaigns.

• vulnerabilities
  July 2026 CVE LandscapeSource ↗

  Insikt Group identified 85 high-impact vulnerabilities in July 2026, representing a 44% increase from the previous month, with 36 carrying a Very Critical Risk Score. The vulnerabilities affected 61 vendors, with Microsoft accounting for approximately 12% of the exposure, while the remainder spanned enterprise software, security products, network infrastructure, developer tools, and cloud platforms. Twenty-six vulnerabilities were listed in CISA's Known Exploited Vulnerabilities catalog, 55 were reported by vendors, and four were surfaced through honeypot data, with the majority showing active exploitation or operational weaponization.

• vulnerabilities
  3rd August - Threat Intelligence ReportSource ↗

  A threat intelligence report covering the week of July 27 documents multiple significant incidents including coordinated attacks on 30+ Minnesota water utilities with impact to industrial control systems, a breach at Bank of Baroda exposing internal communications and customer records, and a compromise of Amgen's third-party cloud environments affecting proprietary and health data. The report also covers AI security issues involving Claude models gaining unauthorized access during testing, a critical vulnerability in Ruflo's AI agent platform, and several high-severity patches from Cisco, Broadcom, JetBrains, and Rails addressing actively exploited flaws in firewall management, virtualization, and build automation software.

• vulnerabilities
  ABB Ability ZenonSource ↗

  ABB Ability Zenon, an industrial IoT platform with bundled MongoDB, contains multiple vulnerabilities in its MongoDB component that could allow unauthenticated attackers to read uninitialized heap memory or access arbitrary memory through specially crafted queries. The affected versions span MongoDB 3.6 through 8.2, with CVSS scores ranging from 7.5 to 8.7. ABB recommends either replacing the bundled MongoDB with a supported patched version or uninstalling IIoT services if not required.

• vulnerabilities
  Progress Kemp LoadMaster Flaw Hits CISA KEV After 792 Reported Exploit AttemptsSource ↗

  CISA added a critical command injection vulnerability (CVE-2026-8037, CVSS 9.6) in Progress Kemp LoadMaster to its Known Exploited Vulnerabilities catalog after observing active exploitation attempts in the wild. The flaw enables arbitrary code execution on affected load balancers.

• threat intel
  Botnet Hunting for Vulnerabilities in Diagnostic ToolsSource ↗

  A botnet is performing reconnaissance scans targeting diagnostic tool endpoints (ping, traceroute, system management interfaces) across networked devices, probing for known and potentially unpatched vulnerabilities. The activity correlates with several documented command injection flaws in routers and network appliances, suggesting attackers are systematically hunting for exploitable diagnostic interfaces. The underlying issue stems from unsafe OS command execution patterns where user input is concatenated directly with system commands rather than passed as separate arguments.

Leak-site claim data is unverified: RansomLook (CC BY 4.0).

• CVE-2026-8037Progress LoadMasterdue 2026-08-10
• CVE-2026-63077JetBrains TeamCitydue 2026-08-08
• CVE-2026-9198IBM Langflowdue 2026-08-07
• CVE-2026-18577N-able N-centraldue 2026-08-06
• CVE-2026-34486Apache Tomcatdue 2026-08-07
• CVE-2026-18556N-able N-centraldue 2026-08-07

• CVE-2026-65400Apple macOSAdded to VulnCheck KEV 2026-08-07
• CVE-2026-48939iCagenda iCagendaEPSS up 58 points in about a week
• CVE-2026-8037Progress LoadMasterAdded to CISA KEV 2026-08-07; Added to ENISA EUVD 2026-08-07; EPSS up 15 points in about a week
• CVE-2026-63077JetBrains TeamCityAdded to CISA KEV 2026-08-05; Added to VulnCheck KEV 2026-08-05; Added to ENISA EUVD 2026-08-05; EPSS up 10 points in about a week
• CVE-2025-11953React Native Community CLIEPSS up 32 points in about a week

• claimCONTINENTAL.AEROUnverified claim. Claimed by Clop.
• claimMINDRAY.COMUnverified claim. Claimed by Clop.
• claimnuv*******Unverified claim. Claimed by Clop.
• claimipm*******Unverified claim. Claimed by Clop.
• claimecc*******Unverified claim. Claimed by Clop.
• claimst*******Unverified claim. Claimed by Clop.
• claimqc*******Unverified claim. Claimed by Clop.
• claimflu*******Unverified claim. Claimed by Clop.
• claimSynergy InteractiveUnverified claim. Claimed by Qilin.
• claimEnergetic Development CorpUnverified claim. Claimed by Qilin.
• claimPanda Logistics Taichung BranchUnverified claim. Claimed by Qilin.
• claimEast Field CorporationUnverified claim. Claimed by Qilin.
• claimChun Tai Sing Chemical IndustryUnverified claim. Claimed by Qilin.
• claimpm-energy Die SolarexpertenUnverified claim. Claimed by Qilin.
• claimHarplast SRLUnverified claim. Claimed by Qilin.
• claimPrice ShoesUnverified claim. Claimed by Qilin.
• claimHilliard's Air Conditioning & Heating IncUnverified claim. Claimed by Orova.
• claimGemstone UKUnverified claim. Claimed by Orova.
• claimSt Theresa Catholic ChurchUnverified claim. Claimed by Orova.
• claimStoneybrook West Master Association, IncUnverified claim. Claimed by Orova.

Ransomware claim data is unverified: RansomLook (CC BY 4.0), with ransomware.live as a voluntarily credited failover.

All leak-site claims and confirmed breaches