cybr.cx Daily Digest — August 21, 2026

Critical Vulnerabilities

⚠️ Actively exploited — CVE-2026-72529 | TrueConf Server | CISA KEV
CISA remediation deadline: August 23 — patch immediately. TrueConf Server exposes a completely unauthenticated remote code execution path via port 4307/TCP: no credentials required, just network access and a crafted script. Paired with CVE-2026-72530 (also KEV-listed, same port, code injection to break out of the isolated environment), TrueConf deployments are being actively hammered right now. If you're running TrueConf in any enterprise video-conferencing capacity, take it offline until patched.

⚠️ Actively exploited — CVE-2026-59310 | Broadcom VMware vCenter | CISA KEV
A path traversal vulnerability in vCenter allows any attacker with network access to the management interface to execute arbitrary code — no authentication mentioned. CISA deadline was today (August 21). If you haven't patched yet, assume exposure. vCenter compromises typically pivot fast into full infrastructure takeover; this one deserves emergency-change treatment.

⚠️ Actively exploited — CVE-2026-33824 | Microsoft IKE Service Extensions | CISA KEV
A double-free in Windows' Internet Key Exchange service enables remote code execution — also due today. IKE sits at the perimeter of VPN infrastructure, meaning exploitation could bypass network segmentation entirely. Patch or isolate affected IKE endpoints now.

⚠️ Actively exploited — CVE-2026-55040 | Microsoft SharePoint | CISA KEV
Weak authentication in SharePoint allows unauthenticated network attackers to bypass security controls. SharePoint's reach across enterprise environments — documents, workflows, credentials cached by integrated apps — makes this a high-value target. CISA deadline: today.

⚠️ Actively exploited — CVE-2026-65400 | Apple macOS | CISA KEV
An improper authentication flaw lets network-adjacent attackers connect to macOS Screen Sharing without valid credentials. This is full graphical remote access to the desktop — effectively a zero-credential VNC bypass. Patch or disable Screen Sharing on exposed macOS hosts immediately.

⚠️ Actively exploited — CVE-2026-64849 | MLflow | CISA KEV
An SSRF vulnerability in MLflow allows attackers to probe internal services and cloud metadata endpoints (think IMDSv1 abuse on AWS/GCP/Azure). With MLflow increasingly deployed in production ML pipelines with broad cloud permissions, this is a lateral movement risk as much as a data exposure risk.

⚠️ Actively exploited — CVE-2025-62593 | Ray (Ray-Project) | CISA KEV
A code injection flaw in the Ray distributed computing framework allows RCE, and is reportedly reachable through Firefox and Safari — meaning developer workstations browsing to a malicious page could expose Ray clusters. ML/AI infrastructure teams should treat this as urgent.

CVE-2026-76316 | Splunk Enterprise | CVSS 8.8
The most severe of today's Splunk batch: an unauthenticated attacker who can reach the Splunk management port can plant a malicious SPL pipeline that fires when an administrator opens the Add Data forwarder workflow — a stored, privileged trigger requiring no credentials. Affects versions below 10.4.1, 10.2.5, 10.0.9, and 9.4.14.

CVE-2026-76313 & CVE-2026-76314 & CVE-2026-76315 | Splunk Enterprise | CVSS 8.8 each
Three separate RCE paths for low-privileged users: uploading a malicious knowledge bundle (76313), submitting crafted Splunk Web Manager Configuration content (76314), and a related Manager Configuration arbitrary code execution path (76315). None require admin or power roles. Update to 10.4.2, 10.2.6, 10.0.9, or 9.4.14.

CVE-2026-76253 | Splunk Enterprise | CVSS 8.8
Any user with the schedule_search capability can run SPL at maximum system privilege and read the entire Splunk credential store. In environments that use Splunk's credential store for integration tokens and service account passwords, this is a full secrets dump.

Headline News

Ransomware Affiliate Moonlights as "Recovery" Firm — Collecting Twice

A threat actor operating under the name "Ransom Busters" has been identified as a suspected ransomware affiliate running a parallel scam: contacting victims of ransomware attacks before the incidents become public knowledge, posing as a legitimate data recovery service, and charging fees in exchange for supposed decryption keys and data deletion guarantees. The actor's insider knowledge of the attacks — timing, victim identity, and stolen data — strongly suggests direct affiliation with or access to the ransomware operation itself. For victims, the double-extortion dynamic is now a triple threat: encrypt, leak-threaten, and fraudulently extract recovery payments. Practitioners should advise incident response clients never to engage unsolicited recovery services, and to verify any decryption vendor's legitimacy through established channels before transferring funds.

CareCloud Breach Hits 3.7 Million Patients

U.S. healthcare IT company CareCloud has confirmed that a breach earlier this year exposed data belonging to over 3.7 million individuals, making it one of the larger healthcare data incidents of 2026. The compromised data is likely to include the sensitive personal and medical information typical of healthcare billing and practice management platforms — a rich target for identity fraud and insurance scams. Healthcare remains the highest-value sector for data theft due to the permanence and completeness of medical records compared to financial data. Practitioners supporting healthcare clients should review third-party vendor access to patient data systems and ensure breach notification timelines comply with HIPAA obligations.

Australian Signals Directorate Warns of Active Attacks on N-able N-central RMM

Australia's signals intelligence and cybersecurity agency has issued a warning that attackers are actively exploiting an authentication vulnerability in N-able's N-central remote monitoring and management platform, described as granting "god mode" access to affected deployments. RMM platforms are a perennial high-value target because compromise gives attackers the same privileged, trusted access to managed endpoints that legitimate MSPs use — effectively a skeleton key across every client environment in scope. The pattern mirrors earlier campaigns abusing ConnectWise ScreenConnect and Kaseya VSA. MSPs and any organisation using N-central should treat this as a critical priority: review access logs, enforce MFA, and apply available patches or mitigations without delay.

Schrödinger's Feed

MIT physicists studying a single quantum material have discovered that two distinct electronic phases emerge through fundamentally different mechanisms — one transitioning smoothly, the other nucleating in expanding pockets resembling ice crystal growth. The finding matters because it suggests the path to exotic quantum properties like superconductivity isn't uniform, which has direct implications for how reliably we can engineer quantum materials for cryptographic and computing applications. Understanding these phase transition dynamics could inform the design of more stable qubits — a prerequisite for the fault-tolerant quantum computers that would eventually threaten RSA and ECC at scale. Practitioners implementing post-quantum cryptography migration plans should note that the physics underlying quantum threat timelines is still actively being revised upward in capability estimates.

/dev/random

A developer published a writeup this week on reverse-engineering and reprogramming a $27 smartwatch using Claude as a real-time coding assistant — navigating undocumented firmware, extracting binaries, and patching functionality the manufacturer never intended to expose. The watch's entire "security model" turned out to be the assumption that nobody would bother, which is roughly the security posture of approximately 80% of consumer IoT. What's notable is less the AI angle and more that a $27 device with wireless connectivity and access to biometric data had essentially no meaningful barrier to full firmware modification. The tutorial is simultaneously a fun hardware hacking project and an unintentional threat model for every cheap wearable on your corporate network.