All Articles

TL;DR for CISOs: Patch Tuesday did the ranking for you. Microsoft shipped fixes for 398 vulnerabilities, and only one was already under attack: a WinSock kernel driver flaw that lets an attacker who is already on a box climb to SYSTEM. The same day, CISA added that flaw plus two others to its Known Exploited Vulnerabilities catalog, a maximum-severity Metabase SQL injection that hands over admin without a login, and a Cisco firewall bug that lets an unauthenticated attacker crash the device. Separately, CERT Polska detailed how intruders crossed from a wind farm into a private cellular network and shut down a turbine at a heat plant serving roughly 50,000 people. The thread today is prioritization: the biggest number is not the biggest problem, and confirmed exploitation is what should move to the front of your queue.

Microsoft patches 398 flaws, and the only one under active attack is a WinSock privilege-escalation bug

What happened

The instinct on Patch Tuesday is to chase the highest scores, and this release offers four tempting 9.8s. The one that belongs at the top of the list, though, is a 7.0. The difference is not the math, it is the evidence. Microsoft says the WinSock driver flaw is already being used in real intrusions, while the four unauthenticated remote code execution bugs, serious as they are, had no observed exploitation when the fixes shipped. A privilege-escalation bug rarely opens the front door on its own, but it is a favorite second move: pair it with any foothold, whether a phishing payload or a stolen credential, and an ordinary user session becomes full control of the host.

The rest of the release is a study in reachability. A wormable label on the DNS Server flaw describes a technical condition, not a worm that exists, and HPC Pack is not installed by default, so its practical urgency depends entirely on whether you run it. The SharePoint fix is the cleaner win: the demonstrated attack chain was already broken once July's authentication-bypass patch went on, and August closes the remaining code-execution half. The takeaway for a security leader is to read a Patch Tuesday less as a scoreboard and more as a triage list, where exploitation status and whether the service is exposed in your estate decide the order of work.

Evidence

Two independent sources:

• The Hacker News: Microsoft Patches 398 Flaws Including a Windows Driver Zero-Day Under Active Attack
• BleepingComputer: Microsoft August 2026 Patch Tuesday fixes flaws and zero-days

What this means for your team

Rebuild your Patch Tuesday process so the first question is not the CVSS score but whether the flaw is being exploited and whether the affected component runs anywhere you can be reached. Put CVE-2026-68820 at the front for Windows endpoints and servers, because it is the piece an intruder adds to a foothold to take the whole host. Then queue the four unauthenticated 9.8 flaws by actual exposure: an internet-facing DNS or QUIC endpoint is a different risk than an internal service behind segmentation. Finally, confirm that on-premises SharePoint farms carry both the July and August fixes, since only the pair fully closes the chain. If you want to pressure-test your own approach, the community has an active thread on risk-based vulnerability management worth reading before the next cycle.

Metabase zero-day scored 10.0 hands attackers admin access without a login, now in CISA's KEV catalog

What happened

A reporting tool is easy to treat as low risk because it only reads data, but that framing misses what it holds. Metabase sits astride an organization's databases and keeps the connection credentials needed to query them. An unauthenticated flaw that yields admin on that console does not just expose a dashboard; it hands over the keys to everything the dashboard can see. The path here ran through the password-reset endpoint, which is exactly the kind of pre-authentication surface that has to work for anonymous users and therefore cannot hide behind a login prompt.

The downstream disclosures show the shape of the damage. Framework, n8n, and Kilo Code were reached not through their own core systems but through a shared piece of software wired into their data. That is the recurring pattern of the modern breach: the initial flaw is in a component many organizations run the same way, so one vulnerability produces many separate incidents. The specific counts matter here, and we are reporting the figures each company stated rather than an estimate. For defenders, the useful signal is that the tools sitting quietly between your applications and your databases deserve the same scrutiny as the databases themselves.

Evidence

• The Hacker News: Metabase Zero-Day Exploited in Wild Allows Admin Access Without Authentication
• Metabase: security update and advisory

What this means for your team

Find every Metabase instance you run, confirm it is on a fixed version, and treat any internet-exposed instance on an affected build as potentially compromised rather than merely unpatched. Because the flaw can expose stored database credentials, patching is only step one: rotate the connection credentials for any database the instance could reach, review admin accounts and API keys for anything you did not create, and check query and access logs for the disclosed indicators. More broadly, this is a prompt to inventory the analytics and admin consoles that hold connection strings to sensitive data, and to put them behind authentication, network segmentation, and monitoring rather than leaving them quietly exposed.

Cisco firewall flaw exploited to crash ASA and FTD devices, added to KEV the same day

What happened

A denial-of-service bug can read as lower stakes than remote code execution, but the device in question changes that calculation. ASA and FTD appliances sit at the network edge and often carry the remote-access VPN that employees depend on. A flaw that lets an unauthenticated attacker reload the firewall at will is not a nuisance; it is a way to knock out remote connectivity on demand, and repeated crashes can serve as cover or pressure during a larger operation. The trigger here is the Remote Access SSL VPN service, which by design has to accept connections from the internet.

What makes this one urgent is the pairing of active exploitation with edge exposure. Cisco confirmed attacks are underway without naming who is behind them, and CISA moved the flaw onto its catalog the same day with a short deadline. Security teams have learned repeatedly that perimeter VPN devices are a favored target, both for access and for disruption, so a confirmed in-the-wild bug in one warrants immediate attention rather than the next maintenance window.

Evidence

• BleepingComputer: Cisco warns of ASA and FTD VPN flaw exploited to crash devices
• SecurityWeek: Cisco Patches Firewall Zero-Day Exploited for DoS Attacks

What this means for your team

If you run ASA or FTD with Remote Access SSL VPN enabled, this is a same-week fix, not a scheduled one. Identify the affected appliances, confirm whether SSL listen sockets are in use, and apply Cisco's update on your edge devices before you work through less exposed systems. Because the outcome is a forced reload, plan for the availability angle as well: know how your remote workforce would connect if the VPN went down, and monitor these devices for unexpected reboots that could signal exploitation attempts. Perimeter appliances reward a standing habit of fast patching and tight management-plane access.

CERT Polska details a rare OT breach: attackers crossed a private cellular network to stop a turbine

What happened

This incident is a reminder that OT compromises rarely require an exotic exploit. The novel element was the entry path, a private cellular network that operators tend to treat as inherently trusted, but the rest of the intrusion relied on failures that show up in ordinary enterprise reviews: flat connectivity that let arbitrary devices talk to each other, and an industrial controller left on its default credentials. Once inside the private APN, the attackers scanned for the protocols that run plant equipment and found a controller that let them in without a fight.

The reason it belongs in a CISO briefing, even for organizations far from Polish energy, is the transferable lesson about trust boundaries. A private network, a cellular link, or an operational segment is not safe simply because it is separate from the corporate LAN. The controls that would have blunted this, restricting device-to-device connectivity, changing default credentials, and monitoring for scanning inside the trusted zone, are the same basics that protect any environment. The disclosure took months of analysis, which is itself a caution: OT incidents are slow to surface, so the absence of news is not the absence of risk.

Evidence

• Help Net Security: Previously unseen entry vector used to breach Polish energy plant
• BleepingComputer: Hackers breached a small Polish energy plant via private APN

What this means for your team

If your organization runs any OT, ICS, or private cellular infrastructure, use this as a template for a trust-boundary review rather than a distant news item. Confirm that your private networks and operational segments do not allow arbitrary device-to-device connectivity, and that industrial controllers and management interfaces are not running default or shared credentials. Extend monitoring into these zones so internal scanning for industrial protocols raises an alert instead of passing unseen. The peers working through these questions gather around OT and critical-infrastructure security, which is a practical place to compare segmentation and monitoring approaches.

FAQ

Which vulnerabilities did CISA add to its KEV catalog on August 11, 2026?

Three: CVE-2026-68820, a Microsoft WinSock driver use-after-free used for privilege escalation to SYSTEM; CVE-2026-72898, a maximum-severity Metabase SQL injection that grants unauthenticated administrator access; and CVE-2026-20349, a Cisco Secure Firewall ASA and FTD flaw that lets a remote attacker crash the device. The remediation deadlines were August 25 for the Microsoft flaw and August 14 for the Metabase and Cisco flaws.

What is CVE-2026-68820 and why does it matter?

It is a use-after-free in afd.sys, the Ancillary Function Driver for WinSock in Windows, rated CVSS 7.0. It is a privilege-escalation flaw, so an attacker who already has code running on a machine can use it to reach SYSTEM. Microsoft flagged it as the only vulnerability under active exploitation in the August release. Microsoft has not publicly attributed the activity, and Check Point Research says the Lazarus group used it in an Operation Dream Job campaign.

How severe is the Metabase zero-day, and who was affected?

The SQL injection, later assigned CVE-2026-72898, carries a CVSS score of 10.0. It lets a remote, unauthenticated attacker inject SQL through the password-reset endpoint and gain administrator access, which can expose stored credentials for connected databases. Metabase disclosed exploitation in the wild, and reporting has named Framework, n8n, and Kilo Code among the organizations affected.

What happened at the Polish combined heat and power plant?

CERT Polska detailed an intrusion in which attackers moved from a compromised wind farm into a private cellular APN used by a distribution operator, then crossed into a CHP plant serving about 50,000 residents. They reached a WAGO PFC200 controller running default credentials and shut down a steam turbine and the process-water treatment system. It is described as the first observed case of an OT compromise reached through a private APN.

What is the main CISO takeaway from the August 11 briefing?

Exploitation, not raw severity scores, set the priority order. Three flaws hit CISA's KEV catalog on the same day, and the highest CVSS score was not the most urgent fix. Rank patching by confirmed exploitation and reachability, treat the KEV catalog as a forcing function beyond federal agencies, and remember that flat networks and default credentials still turn a foothold into physical disruption.