cybr.cx Daily Digest — August 19, 2026

Critical Vulnerabilities

⚠️ Actively exploited — CVE-2026-33824 | Microsoft IKE Service Extensions | CVSS: N/A
A double-free vulnerability in Microsoft's Internet Key Exchange Service Extensions is being actively exploited right now and carries a CISA KEV remediation deadline of August 21. Successful exploitation enables remote code execution — on network infrastructure, that's about as bad as it gets. Patch or isolate immediately; this is not a wait-for-your-patch-cycle situation.

⚠️ Actively exploited — CVE-2026-59310 | Broadcom VMware vCenter | CVSS: N/A
A path traversal flaw in VMware vCenter is under active exploitation, also due for remediation by August 21. An attacker with network access to vCenter can leverage the traversal to execute arbitrary code — effectively owning your entire virtualisation layer. If vCenter is reachable from anything less than a tightly controlled management network, treat this as an emergency.

⚠️ Actively exploited — CVE-2026-55040 | Microsoft SharePoint | CVSS: N/A
SharePoint's authentication logic can be bypassed by unauthenticated network attackers — CISA KEV-listed with an August 21 deadline. Given SharePoint's role as a document and collaboration hub in most enterprise environments, exploitation could expose sensitive internal data without any credential material. Check your perimeter exposure and apply the patch.

⚠️ Actively exploited — CVE-2026-65400 | Apple macOS | CVSS: N/A
An improper authentication flaw in macOS Screen Sharing allows network-adjacent attackers to authenticate without valid credentials. Apple patched this in macOS Tahoe 26.6.1 (and macOS 15.7.9 / 14.8.9 for older releases) — see the news section for more. The CISA KEV deadline is August 21; apply the update and consider whether Screen Sharing should be enabled at all on systems not explicitly requiring it.

⚠️ Actively exploited — CVE-2025-62593 | Ray (Anyscale) | CVSS: N/A
A code injection flaw in the Ray distributed ML framework is being exploited in the wild and is weaponisable through Firefox and Safari, meaning developers with browser access to a Ray dashboard may already be compromised. CISA's remediation deadline was August 20 — if you haven't moved on this yet, assume exposure. Ray clusters typically have significant compute access, making RCE here a high-value pivot point.

⚠️ Actively exploited — CVE-2026-72898 | Metabase | CVSS: N/A
An unauthenticated SQL injection in Metabase hands attackers direct write access to the application database, yielding administrator privileges and access to any stored credentials or data connections. Actively exploited and long past its CISA KEV deadline — if your Metabase instance is internet-facing and unpatched, assume compromise and investigate.

⚠️ Actively exploited — CVE-2026-68820 | Windows Ancillary Function Driver for WinSock | CVSS: N/A
A use-after-free in the Windows WinSock driver is being actively exploited for local privilege escalation. While an attacker needs existing access, this is exactly the kind of flaw ransomware operators and post-exploitation frameworks chain after initial access. Remediation deadline is August 25; prioritise endpoints and servers already at higher risk.

⚠️ Actively exploited — CVE-2026-20349 | Cisco ASA / FTD | CVSS: N/A
A heap inspection bug in Cisco's Secure Firewall products allows unauthenticated remote attackers to crash devices, causing denial of service. Your firewall rebooting unexpectedly under attacker control is a significant operational and security risk. CISA's deadline has passed — if this isn't patched, it should be.

CVE-2026-75827 | Grav CMS < 2.0.15 | CVSS: 8.8
Grav's Blueprint dynamic-data validation uses an incomplete denylist rather than a proper allowlist, allowing users with page-edit or blueprint-config access to invoke error_log via data directives to append PHP payloads to web-accessible files — achieving remote code execution. If you run Grav and delegate any editing access to untrusted users, upgrade to 2.0.15 now.

CVE-2026-75855 / CVE-2026-75842 | ArcadeDB < 26.8.1 | CVSS: 8.7 / 7.7
Two separate flaws in ArcadeDB: the first allows authenticated root users to write or recursively delete arbitrary files outside the database directory by smuggling ../ sequences into database names via the server API. The second lets any user with read query access exfiltrate arbitrary local files using LOAD CSV FROM file://. Together these represent a significant file system exposure. Upgrade to 26.8.1.

CVE-2026-75898 | RAGFlow < 0.26.3 | CVSS: 8.5
RAGFlow's agent workflow "Invoke" component constructs outbound HTTP requests from user-controlled canvas configuration and template variables without validating the destination URL, creating a classic SSRF condition. In AI pipeline deployments, SSRF can reach cloud metadata services, internal APIs, or other cluster resources. Upgrade to 0.26.3.

CVE-2026-66783 | Red Hat ACM for Kubernetes (submariner-operator) | CVSS: 8.2
Any user with permissions to modify the Submariner Custom Resource can specify an arbitrary, unvalidated container image path, leading to code execution with elevated privileges across the entire cluster. In multi-cluster environments, blast radius is substantial. Apply the Red Hat advisory.

Headline News

Apple Spyware Alerts Hit Unprecedented Scale

Investigators tracking mercenary spyware campaigns are describing the latest wave of Apple threat notifications as unlike anything seen before — both in volume and apparent targeting breadth. Apple's threat notification system, which proactively alerts users suspected of being targeted by state-sponsored spyware, typically fires in small, targeted batches; this time the numbers are described as anomalous. The spike is drawing renewed attention to the persistence and expanding reach of commercial spyware vendors, whose tooling continues to evolve despite legal and government pressure. For enterprise and high-risk user defenders, this is a reminder that endpoint telemetry alone won't catch implants of this sophistication — and that Apple's own notification system may be one of the better early-warning mechanisms available. Investigators haven't yet publicly attributed the campaign to a specific vendor or nation-state actor.

Hacker Claims 3.6 Million Azure Account Records Up for Sale

A threat actor is actively marketing what they claim are employee account databases belonging to multiple Fortune 500 companies, alleging the records were obtained by leveraging compromised credentials against Microsoft Azure infrastructure. The data reportedly includes account details for millions of employees across several major organisations. The method described — credential-based access rather than a platform-level Azure vulnerability — underscores that cloud perimeter hygiene remains a persistent weak point: valid credentials continue to be the path of least resistance into enterprise cloud environments. Practitioners should treat this as a prompt to audit conditional access policies, review MFA enforcement across Azure AD/Entra tenants, and check for credential exposure via threat intelligence feeds. Microsoft has not publicly confirmed the breach claims at time of writing.

macOS Screen Sharing Flaw Was Worse Than the Patch Notes Suggested

The CVE-2026-65400 Screen Sharing authentication bypass — now CISA KEV-listed and actively exploited — received a quiet patch in macOS Tahoe 26.6.1, but detailed research published this week clarifies the actual severity: a network-adjacent attacker could authenticate to Screen Sharing without any valid credentials whatsoever, gaining full graphical control of the target machine. Apple backported the fix to macOS 15.7.9 and 14.8.9, acknowledging that older supported releases were equally vulnerable. The gap between patch release and detailed public disclosure gave some defenders limited runway; with active exploitation confirmed, anyone running macOS with Screen Sharing enabled and not yet updated should treat this as an immediate priority. Practitioners managing fleets should verify patch deployment and audit which systems have Screen Sharing enabled — it's frequently left on as a convenience and forgotten.

Schrödinger's Feed

Eclypses and Sterling have teamed up to deliver quantum-resistant cryptography to US federal government systems — a concrete sign that post-quantum migration is moving from NIST standards documents into production procurement. The partnership targets the kind of sensitive federal infrastructure where "harvest now, decrypt later" attacks by well-resourced adversaries represent a genuine long-term threat. It's a reminder that PQC isn't purely a future concern: adversaries are already hoarding encrypted traffic against the day that sufficiently powerful quantum hardware arrives. Practitioners managing long-lived sensitive data or government-adjacent systems should be mapping their cryptographic inventory now — retrofitting PQC into legacy infrastructure is considerably harder than building it in from the start.

/dev/random

Someone has turned the entire British rail network into a very slow, very long flatbed scanner. By mounting a line-scan camera on a train and synchronising image capture to ground speed, a developer produced a continuous, stitched photograph of thousands of miles of track — essentially treating the railway as a one-dimensional sensor sweep across the landscape. The resulting images reveal everything from track geometry anomalies to forgotten lineside infrastructure in unsettling pixel-perfect detail. It won't replace LiDAR surveys anytime soon, but as a demonstration of creative sensor repurposing it's genuinely hard to argue with — and probably cheaper than the actual scanner.