cybr.cx Daily Digest — August 25, 2026

Critical Vulnerabilities

⚠️ Actively exploited — CVE-2026-73570 | Zimbra Collaboration Suite | No CVSS in NVD feed
An unauthenticated OS command injection flaw in Zimbra ZCS allows attackers to craft malicious SMTP requests that execute arbitrary commands as the Zimbra user. No authentication required, remote exploitability, and now confirmed in-the-wild exploitation make this an immediate patch priority for any organisation running ZCS. CISA's remediation deadline has already passed (2026-08-24) — if you haven't patched, assume compromise.

⚠️ Actively exploited — CVE-2026-72529 & CVE-2026-72530 | TrueConf Server
Two companion flaws in TrueConf Server, both reachable over port 4307/TCP. CVE-2026-72529 is a missing authentication vulnerability allowing unauthenticated remote attackers to execute arbitrary scripts; CVE-2026-72530 is a code injection flaw that breaks out of TrueConf's isolated environment to execute arbitrary code on the host. Chaining these two is a trivial path to full host compromise. Both are confirmed exploited in the wild — isolate or take TrueConf deployments offline until patched.

⚠️ Actively exploited — CVE-2026-59310 | VMware vCenter | Broadcom
A path traversal vulnerability in VMware vCenter permits any attacker with network access to vCenter to achieve arbitrary code execution. Given vCenter's central role in virtualisation infrastructure, exploitation here translates rapidly to full data centre control. CISA's deadline was 2026-08-21 — this should already be patched in every environment.

⚠️ Actively exploited — CVE-2026-55040 | Microsoft SharePoint
A weak authentication vulnerability in SharePoint allows unauthenticated network attackers to bypass security controls. SharePoint's prevalence across enterprise environments — including many with internet-facing deployments — makes this a high-value target. Patch immediately; CISA due date was 2026-08-21.

⚠️ Actively exploited — CVE-2026-65400 | Apple macOS
An improper authentication flaw in macOS allows an attacker on the local network to authenticate to Screen Sharing without valid credentials, gaining full graphical access to the target machine. Particularly dangerous in corporate environments where Screen Sharing is enabled for IT support. CISA due date was 2026-08-21.

⚠️ Actively exploited — CVE-2026-33824 | Microsoft IKE Service Extensions
A double-free memory corruption vulnerability in Windows Internet Key Exchange service extensions enables remote code execution. IKE is exposed wherever Windows machines participate in VPN or IPsec — which is most enterprise perimeters. CISA due date has passed (2026-08-21); patch immediately.

⚠️ Actively exploited — CVE-2026-21962 | Oracle HTTP Server / WebLogic Proxy Plug-in
An improper access control flaw affecting Oracle HTTP Server and the WebLogic Server Proxy Plug-in allows unauthorised read, write, and delete access to critical data — up to and including full server access. Oracle middleware running on perimeter infrastructure is a persistent target; this one joined the KEV list yesterday with a 72-hour remediation window expiring 2026-08-27.

⚠️ Actively exploited — CVE-2026-64849 | MLflow
An SSRF vulnerability in MLflow allows attackers to redirect server-side requests to internal services or cloud metadata endpoints (think AWS IMDSv1, GCP metadata API) and read response bodies. AI/ML infrastructure is frequently under-secured and over-trusted; if your MLflow instance is internet-exposed or multi-tenant, treat this as critical.

⚠️ Actively exploited — CVE-2025-62593 | Anyscale Ray
A code injection vulnerability in the Ray distributed computing framework allows remote code execution, with CISA specifically noting exploitability via Firefox and Safari. Ray clusters are routinely used in AI/ML training pipelines, often with broad internal network access. Confirmed exploitation is ongoing.

CVE-2026-76841 | Xinference | CVSS 8.8
Xinference unconditionally enables Hugging Face's trust_remote_code=True across at least six model loader call sites, with no configuration option to disable it before version 2.12.0. Any model loaded through affected endpoints — including reranking and sentence transformer loaders — can execute arbitrary Python at load time. Organisations running Xinference with user-supplied or third-party models should treat this as remote code execution. Upgrade to 2.12.0.

CVE-2026-76847 | act (GitHub Actions local runner) | CVSS 8.8
The local GitHub Actions runner act spins up an HTTP Artifacts V4 backend for workflows using upload/download artifact actions, but the backend's control-plane RPCs never verify that a workflow_run_backend_id belongs to the requesting caller. An attacker with access to the local network during a workflow run can enumerate, download, or delete artifacts from any concurrent run. CI/CD pipeline security is often overlooked; audit act usage, especially in shared build environments.

CVE-2026-76073 | Label Studio | CVSS 8.8
Label Studio's annotation API returns any annotation by primary key without scoping to the requesting user's organisation. Combined with the view's permissions for view, change, and delete operations, this is a horizontal privilege escalation flaw — authenticated users in one organisation can read, modify, or delete annotations belonging to any other. Particularly problematic in multi-tenant or SaaS Label Studio deployments.

CVE-2026-76838 | Hi.Events | CVSS 8.5
Hi.Events validates webhook destination URLs only at registration time using a DNS-resolved allowlist check — but never re-validates at dispatch. An attacker can register a public hostname that resolves to a permitted IP, then update DNS to point it at an internal address, achieving classic SSRF against internal infrastructure. This is a DNS rebinding-style bypass on what appears to be a purpose-built SSRF protection mechanism.

CVE-2026-71504 & CVE-2026-71506 | Dolibarr ERP | CVSS 8.1
Two authorisation flaws in Dolibarr before 24.0.0: the Members REST API allows any user with member-creation rights to reset any account password including the admin (CVE-2026-71504), while the payments API allows invoice-deletion rights to permanently remove payment records and zero invoice balances (CVE-2026-71506). Together these represent account takeover and financial record manipulation risks in a widely deployed open-source ERP. Upgrade to 24.0.0.

CVE-2026-78206 & CVE-2026-78208 | exceljs-hardened | CVSS 7.5
Two flaws in exceljs-hardened before 5.0.0 undermine the library's hardened positioning: CVE-2026-78206 allows zip-bomb-style decompression attacks against XLSX uploads with no size or ratio limits, causing denial of service; CVE-2026-78208 allows path traversal via Workbook.addImage() to read any file accessible to the Node.js process and embed it in output workbooks. Applications processing user-supplied spreadsheets are affected. Upgrade to 5.0.0.

Headline News

IRGC Cyber Campaign Hits UK and US Critical Infrastructure

Iran's Islamic Revolutionary Guard Corps has conducted coordinated cyberattacks against power and water infrastructure in both the United Kingdom and the United States, with confirmed intrusions at UK energy facilities drawing significant government attention. The campaign appears designed to probe and exploit weaknesses in operational technology (OT) environments — particularly the interfaces between internet-connected IT networks and industrial control systems that manage physical plant operations. Security analysts assess the IRGC is deliberately targeting the convergence points between legacy industrial hardware and modern network connectivity, where patching cycles are slow and vendor support is inconsistent. The UK government has so far restricted public disclosure of specific targets or technical indicators, complicating coordinated defence across the sector. For practitioners managing OT or ICS environments, this campaign is a direct reminder that air-gap assumptions are no longer sufficient — network segmentation, OT-specific monitoring, and incident response plans tailored to physical infrastructure failure modes are now operational necessities.

Time-Release Backdoors in Open-Source AI Models

Security researchers have documented a class of supply chain attack targeting open-source machine learning models in which backdoors are engineered to remain dormant until a specific trigger condition is met — a date, an input token, or an inference count threshold — at which point the model's behaviour changes in attacker-controlled ways. Unlike traditional software backdoors, these are embedded in model weights rather than code, making them invisible to static analysis, dependency scanning, and most standard CI/CD security tooling. The attack surface is substantial: the dominant workflow for AI development involves pulling pre-trained weights directly from public repositories with minimal verification, often with trust_remote_code=True enabled (a pattern also flagged today in CVE-2026-76841). Practitioners integrating third-party models into production pipelines should treat weight files with the same suspicion as unverified binaries — cryptographic provenance, sandboxed evaluation environments, and behavioural testing against known-bad prompts are all relevant mitigations. Model signing and verified supply chain tooling for ML artifacts remains an immature space, but investment is accelerating.

seL4 Formal Verification Milestone: Full Proof on AArch64

The seL4 microkernel — the only OS kernel with a complete machine-checked formal proof of functional correctness — has now achieved full verification of its security proofs on the AArch64 architecture, closing a long-standing gap between the verified ARM 32-bit implementation and modern 64-bit hardware. This matters for practitioners in high-assurance environments: seL4's proof guarantees that if the hardware behaves as specified, the kernel cannot be made to violate its security properties through software means, eliminating entire vulnerability classes at the foundation of the stack. The AArch64 completion significantly broadens the practical deployment surface for verified systems, covering the architecture used in modern embedded systems, mobile hardware, and increasingly in server and automotive contexts. For teams building systems where a kernel CVE is categorically unacceptable — critical infrastructure, defence, medical devices — this is a meaningful expansion of the verified computing base.

Schrödinger's Feed

A cross-border post-quantum cryptography pilot has launched between the Responsible Fintech Institute and digital asset security provider Safeheron, with international commercial banks and financial regulators evaluating quantum-resilient infrastructure for real-world digital asset transactions. This is notable not as a research exercise but as a live operational trial — PQC algorithms (likely NIST-standardised ML-KEM and ML-DSA) being stress-tested against actual transaction workflows, cross-border latency constraints, and regulatory compliance requirements simultaneously. The financial sector's long settlement cycles and multi-decade data retention obligations make it acutely vulnerable to "harvest now, decrypt later" strategies, giving these pilots genuine urgency rather than theoretical interest. Practitioners in financial infrastructure security should watch whether this pilot surfaces performance or interoperability problems that the standards process didn't anticipate — real-world friction here will shape enterprise PQC rollout timelines industry-wide.

/dev/random

It turns out Microsoft Paint and the Windows Photos app have been quietly embedding invisible watermarks in image output — including images generated or edited entirely locally, never touching a network. A researcher discovered that both applications append a GUID-based identifier to file output, invisible to the naked eye and absent from standard EXIF fields, but recoverable with the right tooling. The watermark persists through the save pipeline regardless of whether the user has any Microsoft account linked or any cloud features enabled. The practical implications range from "interesting metadata hygiene problem" to "quietly attributable forensic trail on locally produced images" — depending on your threat model and how you feel about your image editor knowing more than you told it to.