cybr.cx Daily Digest — August 15, 2026

Critical Vulnerabilities

⚠️ Actively exploited — CVE-2026-72898 | Metabase | No CVSS in NVD feed
Unauthenticated SQL injection in Metabase allows a remote attacker to inject arbitrary SQL directly into the application database, granting full administrator access with no credentials required. From there, attackers can alter configuration, exfiltrate stored credentials, and pivot further. CISA's remediation deadline has already passed (August 14) — if you're running Metabase and haven't patched or isolated it, treat this as an active incident response situation.

⚠️ Actively exploited — CVE-2026-8037 | Progress LoadMaster | No CVSS in NVD feed
An unauthenticated command injection flaw in Progress LoadMaster allows arbitrary OS command execution via unsanitised input across multiple command endpoints. CISA's due date for this one also passed August 10, meaning any unpatched LoadMaster appliance sitting on a network edge is a live target right now. Priority patch or isolate immediately.

⚠️ Actively exploited — CVE-2026-20349 | Cisco ASA / FTD | No CVSS in NVD feed
A heap inspection vulnerability in Cisco's Secure Firewall ASA and FTD platforms allows an unauthenticated remote attacker to trigger an unexpected device reload, resulting in denial of service. Weaponising this against perimeter firewalls is straightforward and impactful — organisations relying on these devices for network segmentation should apply Cisco's advisory patches without delay.

⚠️ Actively exploited — CVE-2026-68820 | Microsoft Windows (AFD/WinSock) | No CVSS in NVD feed
A use-after-free in the Windows Ancillary Function Driver for WinSock enables local privilege escalation by an authenticated attacker. In practice this is a post-exploitation enabler: once an attacker has any foothold on a Windows machine, this becomes a reliable path to SYSTEM. Patch deadline is August 25 — prioritise on any externally accessible or high-value Windows hosts.

CVE-2026-72831 | Grav CMS Flex Objects Plugin (≤ 1.4.6) | CVSS 8.8
Incorrect authorisation in the Flex Objects API means an authenticated user with basic API access can bypass the elevated permission checks enforced by the Users and Groups controllers, potentially escalating privileges or modifying objects they should never touch. If you're running Grav with the Flex Objects plugin, review API key permissions and apply the patch.

CVE-2026-72833 | Grav API Plugin (1.0.6–1.0.11) | CVSS 8.8
A scoped API key on a super-admin Grav account ignores its declared scope restrictions on four super-admin-gated write endpoints, effectively allowing privilege escalation through what should be a limited-access token. Combined with CVE-2026-72831, Grav CMS is having a rough week — patch both, audit API keys, and review who holds super-admin tokens.

CVE-2026-19788 / 19790 / 19811 / 19813 / 19821 / 19823 | Tenda & TOTOLINK Consumer Routers | CVSS 8.8 each
A cluster of stack-based buffer overflows across Tenda (AC1206, G0, AC12, W20E) and TOTOLINK (A800R) routers, all remotely exploitable via their httpd web management interfaces, with public exploits already circulating. These are SOHO and SMB-grade devices that rarely see timely patches and often have their admin interfaces inadvertently exposed. If these devices are in your environment, restrict management interface access to trusted internal IPs at minimum, and replace end-of-life units where firmware updates aren't available.

Headline News

Akira Ransomware Uses Safe Mode to Blind EDR
An Akira ransomware affiliate has been observed using a notably simple but effective technique: rebooting compromised Windows hosts into Safe Mode with Networking to disable endpoint detection and response (EDR) tooling, which typically doesn't load in that environment. The attacker successfully exfiltrated data before the encryption stage failed — a partial win for defenders, but a clear demonstration that data theft now precedes encryption as the primary leverage mechanism. The tactic is not entirely new, but its deployment by an Akira affiliate signals the group is actively refining its tradecraft to neutralise modern endpoint defences. Security teams should consider whether their EDR platforms have Safe Mode protections enabled, and whether Safe Mode access itself can be restricted or audited via policy.

Midnight Blizzard Targeting Hotel Wi-Fi Networks
The Russian state-sponsored threat actor Midnight Blizzard (also tracked as Cozy Bear / APT29) has been observed compromising hotel Wi-Fi infrastructure to intercept credentials and establish footholds against high-value targets staying at those properties. The technique echoes the group's earlier "EvilGinx"-style adversary-in-the-middle playbook but weaponised at the network layer, allowing passive credential harvesting and potential session hijacking against diplomats, executives, and government personnel during travel. Captive portal abuse and DNS manipulation appear to be components of the attack chain. Practitioners advising high-risk clients or travelling personnel should enforce VPN-before-any-traffic policies and treat all hotel or conference Wi-Fi as hostile infrastructure by default.

ShieldBreak Windows Zero-Day Dropped After Disputed Patch
A researcher published a working Windows zero-day — dubbed ShieldBreak — claiming that Microsoft's prior fix for a related vulnerability (RoguePlanet) was incomplete and left a meaningful bypass path open. The disclosure was timed deliberately to coincide with Patch Wednesday, maximising exposure and pressure on Microsoft. The specifics of the bypass suggest the original patch addressed the symptom rather than the underlying logic flaw, a pattern that defenders have seen repeatedly in complex Windows privilege escalation chains. Until Microsoft issues a follow-on fix, practitioners should monitor for exploitation indicators and treat this as an unpatched gap in Windows defences — particularly relevant given the actively exploited WinSock LPE (CVE-2026-68820) already in the KEV list this week.

Schrödinger's Feed

Researchers have demonstrated the first cyclic quantum heat engine operating at temperatures near absolute zero, successfully converting thermal energy into useful work inside a superconducting system. The practical implication is significant: future versions of this engine could operate autonomously inside quantum computers, potentially replacing large numbers of microwave cooling components that currently generate noise and complexity. Reducing that noise floor is one of the central engineering challenges standing between today's error-prone NISQ devices and the fault-tolerant quantum computers that would pose a genuine threat to current cryptographic standards. Practitioners tracking the post-quantum migration timeline should note that every engineering barrier that falls brings that threat horizon measurably closer.

/dev/random

Google has published details on making homomorphic encryption practical for AI inference — which sounds like a routine engineering blog post until you absorb what homomorphic encryption actually does: it lets a model perform computations directly on encrypted data, meaning the AI never sees the plaintext. The trick Google is leaning on is a combination of approximate HE schemes (specifically CKKS) and hardware acceleration to drag the traditionally eye-watering performance overhead down to something approaching usable. In plain terms: you could run a query against an AI model and the model's host learns nothing about your input or the result. Whether "practical" here means "fast enough for production" or "fast enough that we can show a demo without everyone leaving for lunch" remains a question worth investigating — but the cryptographic architecture is genuinely interesting and the benchmark numbers are moving in the right direction.