All Articles

TL;DR for CISOs: A critical VMware vCenter flaw (CVE-2026-59310) is being exploited in the wild to plant persistent access on hundreds of servers worldwide, and three more high-impact issues, a CVSS 10 Metabase zero-day, a state-backed Gunra ransomware advisory, and a Lazarus Windows kernel zero-day, all landed in the same 24 hours.

VMware vCenter flaw exploited to hold persistent access on 361 systems

CVE-2026-59310 · Broadcom VMware vCenter · Directory traversal to remote code execution

What happened

Broadcom published its advisory for two critical vCenter flaws on July 29 and revised it on August 3 to add express patches. QUIRSO says it uncovered active exploitation of one of them, CVE-2026-59310, during an incident response engagement and published its analysis on August 10. The attack chain showed path-traversal activity matching the flaw, followed by a malicious cron job that used reverse_ssh, an open-source reverse-shell framework, to keep a foothold on the host.

Because reverse_ssh dials outbound to attacker-controlled infrastructure rather than accepting inbound connections, it slips past controls built to block unsolicited inbound traffic. Germany, the United States, Turkey, Iran, and France accounted for 185 of the 361 victim IPs. QUIRSO attributes the campaign to a suspected advanced persistent threat actor but has not named one. Separately, Defused Cyber reported a scanning spike against the second flaw, CVE-2026-59309, a CVSS 9.8 authentication bypass in VMware Directory Service, though QUIRSO says there is not yet enough evidence to link that scanning to the intrusion set it investigated.

Evidence

Verified against two independent sources:

• The Hacker News: Attackers Exploit VMware vCenter Vulnerability to Gain Persistent Remote Access
• Infosecurity Magazine: vCenter Flaw Exploited Just Five Days After Disclosure

What this means for your team

vCenter sits at the center of most virtualized estates, so a foothold there is a foothold over the workloads it governs. The five-day gap between disclosure and mass exploitation is the real lesson: the advisory itself appears to have been the starting gun. As Sectigo's Jason Soroko put it, there are two clocks to manage, one for closing the hole and one for evicting anyone who walked through it first. If your vCenter was internet-reachable in late July, a clean patch does not answer the second question.

Metabase zero-day scored a perfect 10 and had already breached five companies

CVE-2026-72898 · Metabase self-hosted · Unauthenticated SQL injection to admin takeover

What happened

Metabase is a widely used business-intelligence layer that stores connection strings for the databases it queries, from Snowflake and BigQuery to Oracle, MongoDB, and Amazon Redshift. An attacker who reaches administrator level can change configuration, read those stored credentials, and pivot into every connected system. Workflow-automation vendor n8n disclosed that an unauthorized party used the flaw to query its Metabase environment and obtain 136 customer records. CISA listed the flaw alongside a Cisco Secure Firewall ASA and FTD vulnerability in the same catalog update.

Evidence

• The Hacker News: Metabase Zero-Day Exploited in Wild Allows Admin Access Without Authentication
• CISA: Adds Three Known Exploited Vulnerabilities to Catalog (August 11, 2026)

What this means for your team

Analytics and automation tools rarely get the same scrutiny as the databases behind them, yet they concentrate exactly the credentials an attacker wants. A single internet-facing Metabase box with stored warehouse credentials is a master key. The federal deadline of August 14 is a useful yardstick: if the government considers this a days-not-weeks problem, so should you.

FBI and Korean police warn Gunra ransomware is hitting critical infrastructure through old Fortinet flaws

CVE-2024-55591 and CVE-2025-24472 · FortiOS and FortiProxy · Ransomware-as-a-service

What happened

Gunra affiliates use known VPN and firewall flaws for initial access, then move laterally with stolen credentials and authentication-bypass tricks. In observed cases they abused default credentials on an SSL-VPN appliance, installed OpenSSH to tunnel out, and modified authentication files on a corporate VDI portal to bypass multi-factor authentication continuously. The group exfiltrates large volumes of data from Microsoft 365, OneDrive, and SharePoint, in one case moving tens of terabytes to the file-sharing service Mega before encrypting, then extorts victims twice, once for decryption and once to keep the stolen data offline. As iCOUNTER's Roman Sannikov noted, if detection coverage drops overnight, that is exactly the window this group is built to exploit.

Evidence

• Infosecurity Magazine: Gunra Ransomware Exploits Fortinet Flaws to Target Critical Infrastructure
• CISA advisory AA26-222A: #StopRansomware Gunra

What this means for your team

The flaws Gunra favors were patched more than a year ago, which is the uncomfortable point: patch coverage without eviction leaves the door open. One expert quoted in the advisory coverage described closing a Fortinet vulnerability while an authentication backdoor sat untouched in the MFA flow. Edge devices remain the single most common ransomware entry point, and the after-hours operating pattern is a direct argument for round-the-clock detection coverage.

Lazarus used a Windows kernel zero-day to hit defense and aerospace firms

CVE-2026-68820 · Windows AFD.sys · Privilege escalation to SYSTEM

What happened

Operation Dream Job lures targets with fake recruitment offers. In this wave, once a system was compromised, the attackers used the AFD.sys zero-day to escalate to SYSTEM and deploy a new version of the FudModule kernel-mode rootkit, which is built to disable security tooling from below the operating system. The campaign is a reminder that a mid-scored privilege-escalation bug becomes a strategic weapon when it is chained behind a convincing social-engineering front and used to plant a rootkit.

Evidence

• BleepingComputer: Lazarus hackers exploited Windows zero-day to target defense firms
• Check Point Research: Shattering the Dream, When a Job Offer Becomes a Zero-Day Attack

What this means for your team

If your organization touches defense, aerospace, or advanced manufacturing, the recruitment lure is aimed at your people, not just your perimeter. The August Patch Tuesday fix closes the escalation path, but the initial access depends on an employee opening a weaponized file. Pair rapid kernel patching with hiring-adjacent phishing awareness for engineering and research staff.

Also notable

• N-able N-central authentication bypass (CVE-2026-18577, CVSS 8.2): attackers took over RMM servers after an incomplete first patch, reached managed endpoints via Take Control, and persisted with Cloudflare tunnels. Upgrade to build 2026.3.1.7. The Hacker News
• Cisco Secure Firewall ASA and FTD heap-inspection flaw (CVE-2026-20349) was added to the CISA KEV catalog on August 11 in the same update as the Metabase flaw. CISA
• Adobe Commerce and Magento (CVE-2026-71362): first exploitation attempts appeared shortly after patches, with a risk of customer account hijack. BleepingComputer
• Microsoft SharePoint security-feature bypass (CVE-2026-55040): exploitation began after proof-of-concept code was published; the flaw was patched in July. SecurityWeek
• CERT.PL reported Russian-linked hackers reached a Polish power plant OT network through a private APN. Infosecurity Magazine

FAQ

Is CVE-2026-59310 being actively exploited?

Yes. Researchers at QUIRSO documented active exploitation across 361 victim IP addresses in 47 countries, with the first compromises appearing on August 3, five days after Broadcom disclosed the flaw.

Which Metabase versions are affected by CVE-2026-72898?

Self-hosted Metabase versions 0.58 through 0.63.4. The flaw carries a CVSS score of 10.0 and CISA set a federal remediation deadline of August 14, 2026.

Why does patching alone not close out these incidents?

In the vCenter, Fortinet, and N-able cases, attackers established persistence before or despite the patch. A fix removes the entry point but does not evict an intruder who is already inside or remove backdoors planted on other systems.

Who is behind the Gunra ransomware campaign?

Gunra is a ransomware-as-a-service operation built on leaked Conti source code, also operating under the alias "Golden Community." The joint US and Republic of Korea advisory details its tactics but does not attribute it to a single nation-state.

What is the fastest way to prioritize today's items?

Start with anything internet-facing: vCenter, Metabase, and Fortinet appliances first, then apply the August 11 Windows kernel patch to high-value engineering and defense endpoints.

Corrections and takedown requests: CISO Platform is committed to accuracy and fairness. If any detail in this briefing is inaccurate, or if you represent an affected organization and would like a correction or removal, please contact us at pritha.aash@cisoplatform.com and we will review your request promptly.