vFeed Threat Intelligence Newsletter — August 2026
Welcome to the vFeed August 2026 edition of our Cybersecurity and Vulnerability Newsletter.
Key Highlights During the Month
- CVE Volume Hits 11,940: August 2026 recorded 11,940 new CVEs — a ↓ 12.4% decline from July’s 13,630, but still one of the busiest summer months on record. At ~385 CVEs per day, defenders continue to face a relentless disclosure pipeline. Year-to-date, vFeed has correlated 107,842 vulnerabilities, tracking 19.4% above the same period in 2025 (90,325).
- Critical Vulnerabilities Surge to 1,542: Critical vulnerabilities (CVSS 9.0+) hit 1,542 in August — up sharply from July’s 1,318 as vendor coordinated-disclosure calendars aligned with Patch Tuesday, Oracle CPU, and Adobe out-of-band bulletins. The month recorded 74 perfect 10.0 CVSS scores, spanning Adobe Campaign Classic, Microsoft Azure, Oracle Fusion Middleware, SAP Commerce Cloud, Siemens SIMATIC IoT2050, and multiple WordPress supply-chain backdoors.
- WordPress Supply-Chain Compromises Escalate: The MonsterInsights Pro S3 bucket compromise (CVE-2026-11976, CVSS 10.0) and two outright malicious plugins — Premium SEO (CVE-2026-14812) and Link Factory (CVE-2026-15413) — mark a decisive shift from opportunistic plugin bugs to deliberate supply-chain implants targeting the WordPress ecosystem.
- Metabase Pre-Auth SQLi Reaches EPSS 99.8th Percentile: CVE-2026-72898 (Metabase
/reset_passwordSQL injection) sits atop the EPSS forecast at 0.9422 — active exploitation is virtually certain. Two additional Metabase SQLi flaws (CVE-2026-72899) and SPIP RCEs (CVE-2026-77806, CVE-2026-77647) were confirmed exploited in the wild in August. - Microsoft Cloud Identity Under Fire: A cluster of CVSS 10.0 identity/authorization flaws — Entra ID deserialization (CVE-2026-69836), Azure SQL improper authentication (CVE-2026-56162), Azure Arc reference confusion (CVE-2026-65816, CVE-2026-69555), Exchange Online SSRF (CVE-2026-65801), and Teams missing-authorization (CVE-2026-65667) — expose the tenant boundary itself, not just workloads inside it.
Vulnerability Trends in August
| Metric | May ’26 | Jun ’26 | Jul ’26 | Aug ’26 | MoM |
|---|---|---|---|---|---|
| New CVEs | 12,905 | 14,110 | 13,630 | 11,940 | ↓ 12.4% |
| Modified CVEs | 14,220 | 15,880 | 17,410 | 16,744 | ↓ 3.8% |
| Critical (CVSS 9.0+) | 1,205 | 1,412 | 1,318 | 1,542 | ↑ 17.0% |
| Perfect 10.0 scores | 48 | 61 | 55 | 74 | ↑ 34.5% |
| CVSS4 scores recorded | 2,105 | 2,438 | 2,690 | 3,347 | ↑ 24.4% |
| EPSS > 50th percentile | 3,850 | 4,120 | 3,995 | 4,208 | ↑ 5.3% |
Three signals stand out. First, aggregate CVE volume dipped but severity concentrated: the perfect-10.0 count jumped 34.5% even as total disclosures fell, a sign that fewer but more consequential advisories dominated August. Second, CVSS4 adoption crossed a milestone — 3,347 CVSS4 vectors (~28% of new CVEs) reflect broader vendor migration from CVSS3.1. Third, the modified-CVE volume remains elevated (16,744), indicating heavy retroactive rescoring — several 2024 and 2025 CVEs (notably CVE-2024-27253 IBM DOORS Next, CVE-2024-58376 Renovate) were re-evaluated upward this month.
Vulnerability Landscape
vFeed’s threat intelligence dataset now tracks over 248,500 known exploits reported from sources including GitHub, Metasploit, ExploitDB, and PacketStorm. In August, 2,146 unique CVEs out of 11,940 (~17.9%) were published with one or more exploit proof-of-concepts available.
The top exploit sources for August:
| Exploit Source | Unique CVEs Covered |
|---|---|
| ExploitDB | 412 |
| GitHub PoC | 1,678 |
| Metasploit | 89 |
| Talos | 54 |
| Saint | 31 |
GitHub PoC repositories continue to dominate the exploit-publication landscape, accounting for ~78% of first-observed PoCs in August. Notably, the DrayTek VigorSwitch/VigorAP cluster (20+ CVEs disclosed with root-level command injection) had public PoCs available on GitHub within 48 hours of NVD publication. SPIP RCEs (CVE-2026-77806, CVE-2026-77647) were exploited in the wild before patches were widely deployed — a reminder that EPSS-driven prioritization must be paired with active KEV monitoring.
Platform Impacts
Microsoft — 187 CVEs
| Severity | Count |
|---|---|
| Critical | 41 |
| High | 96 |
| Medium | 46 |
| Low | 4 |
August’s Patch Tuesday (2026-08-12) delivered one of the heaviest identity-plane cycles of the year, with multiple CVSS 10.0 flaws in Azure-connected services published two days ahead of Microsoft’s usual disclosure cadence.
- CVE-2026-69836 — Microsoft Entra ID: deserialization of untrusted data allowing unauthenticated network-based RCE (CVSS 10.0). Tenant-wide impact.
- CVE-2026-56162 — Azure SQL Database: improper authentication, unauthorized privilege elevation over the network (CVSS 10.0).
- CVE-2026-62836 — Azure SQL Managed Instance: improper communication-channel restriction, network-based privilege elevation (CVSS 10.0).
- CVE-2026-63508 — Microsoft Planetary Computer Pro: missing authentication for critical function (CVSS 10.0).
- CVE-2026-65667 — Microsoft Teams: missing authorization, network-based privilege elevation (CVSS 10.0).
- CVE-2026-65770 — Azure Managed Instance for Apache Cassandra: argument injection, network RCE (CVSS 10.0).
- CVE-2026-65801 — Exchange Online: SSRF enabling privilege elevation (CVSS 10.0).
- CVE-2026-69502 — Azure SQL Database: SSRF, network-based privilege elevation (CVSS 10.0).
- CVE-2026-62893 — Windows Deployment Services: use-after-free network RCE (CVSS 9.8).
- CVE-2026-63520 / 63514 / 64901 / 65665 / 66805 — SharePoint deserialization/input-validation cluster (all CVSS 8.1–8.8).
Linux Kernel
vFeed tracked 228 Linux kernel CVEs in August. Six named vulnerabilities stood out this month:
| Name | CVE | Subsystem | Type | Key Risk |
|---|---|---|---|---|
| geneve GRO OOB read | CVE-2026-72408 | drivers/net/geneve | KASAN slab-OOB in ipv6_gro_complete | Attacker-supplied GRO hint dispatch beyond header, remote |
| geneve inner-offset validation | CVE-2026-72407 | drivers/net/geneve | Concurrent gro_hint flip | Out-of-bounds completion, remote |
| ipv4 fib error-route bypass | CVE-2026-72421 | net/ipv4/fib | Multi-table lookup logic bug | Silent bypass of unreachable routes |
| SCTP ASCONF UAF | CVE-2026-64564 | net/sctp | Double-free of transport | Remote DoS/RCE potential (CVSS 9.8) |
| veth XDP frag length | CVE-2026-74612 | drivers/net/veth | data_len desync leaking shinfo | Kernel pointer disclosure via UDP |
| UDP tunnel UAF | CVE-2026-74705 | net/ipv4/udp | UAF after pskb pull | Tunnel-path memory corruption |
August was a bad month for the networking stack: five of the six named kernel CVEs sit in net/ and are reachable from untrusted network peers. CVE-2026-64564 (SCTP double-free during ASCONF DEL-IP processing) is the standout — CVSS 10.0 and unauthenticated. Distros running kernel LTS 6.6 and 6.12 should prioritize backports.
WordPress — Authentication Bypass Dominates
94 CVEs in August, with 41 carrying known exploits — an exploit-to-disclosure ratio of 43.6%. Critical highlights:
- CVE-2026-11976 — MonsterInsights Pro S3 bucket compromise; malicious
class-system-check.phpin versions 10.2.0 and 10.2.2, AES-256-GCM keyed backdoor with the attacker retaining bucket write access (CVSS 10.0). - CVE-2026-14812 — Premium SEO WordPress plugin: outright malicious plugin shipping an unauthenticated backdoor that creates hidden admin accounts (CVSS 10.0).
- CVE-2026-15413 — Link Factory plugin: Ed25519-signed operator backdoor at
/wp-json/link-factory/v1/(CVSS 10.0). - CVE-2026-16940 — Custom Fields plugin: unauthenticated arbitrary file deletion → full site takeover via
wp-config.php(CVSS 10.0). - CVE-2026-18051 — W3 Total Cache: unauthenticated arbitrary file write,
.htaccessoverwrite (CVSS 10.0). - CVE-2026-15826 — User Profile Builder: authentication bypass via type confusion, admin takeover (CVSS 9.8, EPSS 89.6th %ile).
- CVE-2026-15748 — Forminator Forms: unauthenticated arbitrary file upload (CVSS 9.8).
- CVE-2026-19598 — Pods CCT plugin: unauthenticated privilege escalation to Administrator via broken AJAX guard (CVSS 9.8).
- CVE-2026-64638 / CVE-2026-65640 — WordPress core: reflected XSS-to-RCE on the login screen and Postscript-upload RCE via Imagick/Ghostscript (both patched in 7.0.3/7.0.4).
Cloud Vulnerabilities and Attack Chains
vFeed tracked 112 cloud-specific CVEs in August across Azure, AWS, GCP, Kubernetes, and container technologies. Notable disclosures:
- CVE-2026-69836 — Entra ID unauthenticated deserialization RCE (CVSS 10.0).
- CVE-2026-56162 / 62836 / 69502 — Azure SQL Database & Managed Instance auth/SSRF cluster (all CVSS 10.0).
- CVE-2026-65816 / 69555 — Azure Arc reference-resolution and authorization flaws (CVSS 10.0).
- CVE-2026-65770 — Azure Managed Instance for Apache Cassandra command injection (CVSS 10.0).
- CVE-2026-54745 — Kubeflow Pipelines unauthenticated SSRF via
/_proxy/reaching cloud metadata endpoints (CVSS 10.0). - CVE-2026-64849 — MLflow webhook SSRF:
_validate_webhook_url()validated only pre-redirect URLs, allowing metadata-service pivots (CVSS 9.3). - CVE-2026-82329 — JFrog Artifactory default-config authentication weakness → admin (CVSS 9.8).
- CVE-2026-82456 — argocd-mcp binds every interface without caller credentials → Argo CD tenant takeover (CVSS 10.0).
The attack-chain pattern this month is clear: AI/ML platform middleware (MLflow, Kubeflow, MCP servers, PraisonAI, ToolUniverse, MindsDB, Xinference, Prompty) is being probed and weaponized at scale. In nearly every case, the chain runs: unauthenticated HTTP interface → attacker-controlled tool/webhook invocation → cloud metadata access or code execution as the platform service account. Cloud defenders should treat any LLM-orchestration service as a pre-auth attack surface until proven otherwise.
Top Weaknesses
Overall — All August CVEs
| CWE | Weakness | Count | % of Total |
|---|---|---|---|
| CWE-79 | Cross-site Scripting | 1,187 | 9.9% |
| CWE-89 | SQL Injection | 764 | 6.4% |
| CWE-78 | OS Command Injection | 612 | 5.1% |
| CWE-352 | Cross-Site Request Forgery | 498 | 4.2% |
| CWE-121/122 | Buffer Overflow (stack/heap) | 471 | 3.9% |
| CWE-287 | Improper Authentication | 402 | 3.4% |
| CWE-22 | Path Traversal | 388 | 3.2% |
| CWE-306 | Missing Authentication for Critical Function | 341 | 2.9% |
| CWE-502 | Deserialization of Untrusted Data | 289 | 2.4% |
| CWE-284 | Improper Access Control | 267 | 2.2% |
Critical Only (CVSS 9.0+)
| CWE | Weakness | Critical Count |
|---|---|---|
| CWE-78 | OS Command Injection | 218 |
| CWE-89 | SQL Injection | 176 |
| CWE-306 | Missing Authentication for Critical Function | 142 |
| CWE-287 | Improper Authentication | 138 |
| CWE-502 | Deserialization of Untrusted Data | 121 |
| CWE-434 | Unrestricted File Upload | 98 |
| CWE-918 | Server-Side Request Forgery | 87 |
| CWE-77 | Command Injection (generic) | 74 |
| CWE-284 | Improper Access Control | 66 |
| CWE-94 | Code Injection | 58 |
The critical-only distribution tells a different story than the overall list: injection (CWE-78/89/77/94) and authentication failures (CWE-287/306) together account for ~55% of all critical CVEs in August. SSRF (CWE-918) surged into the critical top ten, driven by the Azure/Adobe/MLflow/Kubeflow cluster. Deserialization (CWE-502) remains a persistent top-five killer — SharePoint, Entra ID, GiveWP, HPC Pack, and SIMULIA Execution Engine all shipped CVSS 9+ deser flaws.
Hardware / IoT / Firmware
vFeed tracked 546 hardware, IoT, and firmware CVEs in August. Standout entries:
- CVE-2026-58115 — Siemens SIMATIC IoT2050 Advanced: unauthenticated Node-RED HTTP interface → unauth RCE as root (CVSS 10.0).
- CVE-2026-19188 — Haiwell IoT Cloud HMI Gateway:
cmdPingSocket.io event OS command injection as root (CVSS 10.0). - CVE-2026-74843 — Wavlink WN531P3/WN535M1: stack overflow via
HTTP_COOKIEinexport_pingortrace.cgi, public exploit (CVSS 10.0). - CVE-2026-71921 — DrayTek VigorSwitch: pre-auth command injection in
setget.cgipassfield (CVSS 9.8). - CVE-2026-71914 — DrayTek VigorAP: unauth command injection in
dray_apmUDP handler (CVSS 9.8). - CVE-2026-71945 – 71956 — D-Link DWR-M961 (HW C1): 12+ command-injection sinks across
boafrm/*interfaces (all CVSS 9.8). - CVE-2026-74233 — Zbtlink infosrvd UDP/9992: unauth command injection with hardcoded-salt/wildcard-MAC auth bypass (CVSS 9.8).
- CVE-2026-71961 — Cudy WR3000: MQTT-broker-reachable root command injection (CVSS 8.8).
- CVE-2026-77537 / 77550 / 77554 — Ubiquiti UniFi Protect, UniFi OS, and UniFi Talk: network-adjacent command injection and CRLF auth bypass (all CVSS ~10.0).
- CVE-2026-19977 — EFM ipTIME A3004T session-validation bypass; vendor unresponsive, exploit public (CVSS 10.0).
The scale of the DrayTek and D-Link disclosures — 30+ device CVEs with public PoCs and root-level impact — makes August one of the worst months for SMB and edge networking gear in recent memory. Coupled with UniFi’s three CVSS 10.0 advisories, defenders operating branch, MSP, or MDU environments should assume compromise pathways exist and prioritize firmware rollouts.
Critical Exploitable Vulnerabilities — August 2026
Pay attention to these critical vulnerabilities with known exploits and high EPSS scores.
| CVE | Target | CVSS | EPSS %ile | Exploit | CWE |
|---|---|---|---|---|---|
| CVE-2026-72898 | Metabase /reset_password SQLi | 10.0 | 99.84 | Public PoC | CWE-89 |
| CVE-2026-60004 | Gitea diffpatch API RCE | 9.8 | 99.73 | Public PoC | CWE-94 |
| CVE-2026-18577 | N-able N-central auth bypass | 8.1 | 98.93 | Public PoC | CWE-287 |
| CVE-2026-18556 | N-able N-central auth bypass (base) | 7.4 | 98.54 | Public PoC | CWE-287 |
| CVE-2026-73570 | Zimbra ZCS SNMP RCE | 8.9 | 98.21 | ITW | CWE-78 |
| CVE-2026-64638 | WordPress login-screen XSS→RCE | 9.6 | 98.15 | Public PoC | CWE-79 |
| CVE-2026-77806 | SPIP X-Spip-Filtre RCE (ITW) | 9.8 | 90.30 | ITW exploit | CWE-94 |
| CVE-2026-77647 | SPIP <?php/var_export RCE (ITW) | 9.8 | 84.46 | ITW exploit | CWE-94 |
| CVE-2026-65400 | Apple Screen Sharing auth bypass | 9.8 | 95.26 | Public PoC | CWE-287 |
| CVE-2026-82329 | JFrog Artifactory default-config admin | 9.8 | 94.19 | Public PoC | CWE-287 |
| CVE-2026-15748 | Forminator Forms unauth file upload | 9.8 | 91.08 | Public PoC | CWE-434 |
| CVE-2026-19478 | GitLab GraphQL unauth data delete | 9.1 | 92.64 | Public PoC | CWE-284 |
| CVE-2026-48362 | Adobe ColdFusion OS command injection | 10.0 | 90.51 | Public PoC | CWE-78 |
| CVE-2026-47864 | Spring Integration Java deser RCE | 9.8 | 90.02 | Public PoC | CWE-502 |
Actionable Recommendations
1. Patch Metabase, SPIP, Zimbra, and Gitea this week. CVE-2026-72898 (Metabase, EPSS 99.84th), CVE-2026-77806/77647 (SPIP, exploited in the wild), CVE-2026-73570 (Zimbra SNMP RCE), and CVE-2026-60004 (Gitea) are the four vulnerabilities most likely to be weaponized before month-end. All four have public PoCs or observed in-the-wild activity. If you cannot patch Metabase immediately, block /reset_password at the WAF and rotate all connected database credentials.
2. Treat every AI/ML platform middleware as a pre-auth attack surface. CVE-2026-73678 (MindsDB), CVE-2026-48168 (PraisonAI), CVE-2026-81096 (ToolUniverse), CVE-2026-61539 (Xinference), CVE-2026-73299 (Prompty), CVE-2026-82456 (argocd-mcp), and CVE-2026-81735 (UI-TARS-desktop MCP) all share the same anti-pattern: HTTP-listening tool servers bound to 0.0.0.0 with no authentication. Audit every MCP/agent server for bind address, auth requirement, and network exposure. Segment them behind mesh mTLS or private-network-only reachability.
3. Emergency-scope Microsoft cloud identity patches. The August identity-plane cluster (Entra ID CVE-2026-69836, Azure SQL CVE-2026-56162/62836/69502, Azure Arc CVE-2026-65816/69555, Exchange Online CVE-2026-65801, Teams CVE-2026-65667) affects the tenant boundary itself. Review Conditional Access telemetry for anomalous service-principal creation, token replay, and cross-tenant guest additions in the 30 days preceding August’s patches. Rotate application secrets tied to Azure Arc and Entra ID federation.
4. Purge and reinstall compromised WordPress plugins. Remove Premium SEO (CVE-2026-14812) and Link Factory (CVE-2026-15413) plugins from all managed WordPress installations — these are malicious by design, not vulnerable. For MonsterInsights Pro (CVE-2026-11976), replace with a clean 10
5. Add SPIP, Metabase, Gitea, Zimbra, and MLflow to KEV-parity monitoring. CVE-2026-77806 (SPIP) is already exploited in the wild; CVE-2026-60004 (Gitea, EPSS 99.73), CVE-2026-72898 (Metabase, EPSS 99.64), CVE-2026-73570 (Zimbra, EPSS 98.21), and CVE-2026-64849 (MLflow, EPSS 96.76) sit in the highest strata of exploitation likelihood. Prioritize emergency patching
vFeed threat intelligence data feeds continue to embrace NIST NVD 2.0 schema, CISA schemas, CVSS4, and EPSS4 scoring. Our correlated database tracks over 930K affected packages and 74,500 known exploits — providing the context defenders need to prioritize what matters.
May you live in interesting times! 🙂