August 2026 brings a massive security update from Microsoft addressing 398 new CVEs alongside Adobe's release of 51 vulnerabilities, with critical flaws in DNS servers, deployment services, and QUIC protocol that require rapid testing and deployment, particularly for internet-facing infrastructure. While the volume of patches continues to grow as the new normal, only one Microsoft vulnerability is currently under active attack, allowing organizations to prioritize critical remote code execution bugs in DNS and QUIC over the broader patch load. Key priorities include Microsoft Exchange Server elevation-of-privilege vulnerabilities demonstrated at Pwn2Own, Windows Deployment Services TFTP flaws affecting PXE boot scenarios, and Adobe Campaign Classic issues, all rated for immediate deployment.
Check Point Research has tracked a resurgence of the Operation Dream Job campaign since early 2026, which primarily targets the defense sector with focus on aerospace and aviation companies. The threat actors distribute modified PDF viewers that execute malicious payloads embedded in specially crafted files, using fake job offers as a social engineering vector. This campaign demonstrates how threat actors exploit industry-specific targeting and trusted application types to deliver zero-day exploits against critical infrastructure sectors.
Six malicious npm packages were discovered exfiltrating command-and-control infrastructure addresses by querying an Ethereum wallet, demonstrating a novel evasion technique that leverages blockchain to host malware configuration. This approach obscures C2 locations within cryptocurrency transactions, making them harder to detect and block through traditional network monitoring methods.
Rapid7 and Microsoft disclosed CVE-2026-55040, a critical authentication bypass in Microsoft SharePoint's JWT token validation that allows unauthenticated remote attackers to forge valid tokens and impersonate any site user or administrator. The vulnerability stems from four chained weaknesses in the token validation pipeline: disabled signature verification on outer tokens, unverified actor token resolution using attacker-controlled certificate thumbprints, overly permissive issuer validation, and non-cryptographic signature checks. Rapid7 has published a technical analysis and proof-of-concept demonstrating how attackers can construct malicious JWTs to gain authenticated access to vulnerable SharePoint Server Subscription Edition instances.
Rapid7 Labs disclosed CVE-2026-63520, a high-severity remote code execution vulnerability in Microsoft SharePoint caused by unsafe .NET type instantiation in Business Connectivity Services, which affects all supported versions of the platform. When chained with the previously disclosed authentication bypass CVE-2026-55040, the vulnerabilities enable unauthenticated RCE with the privileges of the SharePoint service account, with Microsoft patches now available across multiple SharePoint versions. The vulnerability was discovered through an AI-assisted research methodology that combined agentic workflows with expert guidance, demonstrating the accelerating capability of large language models in vulnerability discovery against complex enterprise targets.
Researchers discovered a critical flaw in Zoom's screen-sharing feature that could allow any call participant to take control of another user's device, which has since been patched. The vulnerability was identified through automated AI-assisted fuzzing, with the public tool requiring fewer than 20 prompts to uncover the exploit.
Kaspersky researchers have identified that the Head Mare APT group is exploiting unpatched vulnerabilities in TrueConf servers to distribute the PhantomCore and PhantomGraph backdoors to video conference participants. The attack leverages compromised TrueConf software installers to deliver these malicious payloads to target systems. This campaign highlights the risks posed by unpatched collaboration tools and their potential use as infection vectors by sophisticated threat actors.
View CSAF Summary Successful exploitation of these vulnerabilities could allow an attacker to access unauthorized health profile information, make changes to health information, cause a denial-of-service condition, disclose session token information, and obtain control of user accounts. The following versions of Mira Hormone Monitor, Mira Android App are affected: Mira Monitor Firmware 1.7.1.47 (CVE-2026-66875, CVE-2026-66098, CVE-2026-67558, CVE-2026-67568, CVE-2026-68067, CVE-2026-66340, CVE-2026-64934, CVE-2026-66832) Mira Android App 4.5.15.4 (CVE-2026-66875, CVE-2026-66098, CVE-2026-67558, CVE-2026-67568, CVE-2026-68067, CVE-2026-66340, CVE-2026-64934, CVE-2026-66832) CVSS Vendor Equipment Vulnerabilities v3 9.8 Quanovate Tech Inc. (operating as Mira / Mira Care) Mira Hormone Monitor, Mira Android App Missing Authentication for Critical Function, Authentication Bypass by Spoofing, Use of Hard-coded Credentials, Weak Authentication, Improper Restriction of Excessive Authentication Attempts, Reliance on Untrusted Inputs in a Security Decision, Use of GET Request Method With Sensitive Query Strings Background Critical Infrastructure Sectors: Healthcare and Public Health Countries/Areas Deployed: Worldwide Company Headquarters Location: United States Vulnerabilities Expand All + CVE-2026-66875 In the Mira hormone monitor device firmware v1.7.1.47 build 01070147, a remote unauthenticated attacker within BLE range (approximately 10–30 meters) can silently rebind the device to an attacker-controlled account, extract stored hormone measurements in cleartext, cause a denial-of-service via malformed or undocumented command opcodes, and passively track the user via a static random BLE address that never rotates. View CVE Details Affected Products Mira Hormone Monitor, Mira Android App Vendor: Quanovate Tech Inc. (operating as Mira / Mira Care) Product Version: Quanovate Tech Inc. (operating as Mira / Mira Care) Mira Monitor Firmware: 1.7.1.47, Quanovate Tech Inc. (operating as Mira / Mira Care) Mira Android App: 4.5.15.4 Product Status: known_affected Remediations Mitigation Users should update the Mira app to the latest version iOS v3.5.18 / Android v4.5.18. Firmware v01.07.01.53 is updated via the app when the device is connected. No additional action is required. Relevant CWE: CWE-306 Missing Authentication for Critical Function Metrics CVSS Version Base Score Base Severity Vector String 3.1 8.8 HIGH CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 4.0 8.7 HIGH CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVE-2026-66098 The Mira hormone monitor device firmware accepts a 0x01 write from any BLE central without authentication, causing the device to reboot into bootloader mode. An attacker could cause a denial-of-service condition or disrupt ovulation tracking and fertility monitoring workflow. View CVE Details Affected Products Mira Hormone Monitor, Mira Android App Vendor: Quanovate Tech Inc. (operating as Mira / Mira Care) Product Version: Quanovate Tech Inc. (operating as Mira / Mira Care) Mira Monitor Firmware: 1.7.1.47, Quanovate Tech Inc. (operating as Mira / Mira Care) Mira Android App: 4.5.15.4 Product Status: known_affected Remediations Mitigation Users should update the Mira app to the latest version iOS v3.5.18 / Android v4.5.18. Firmware v01.07.01.53 is updated via the app when the device is connected. No additional action is required. Relevant CWE: CWE-306 Missing Authentication for Critical Function Metrics CVSS Version Base Score Base Severity Vector String 3.1 6.5 MEDIUM CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H 4.0 7.1 HIGH CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N CVE-2026-67558 The Mira Android companion app v4.5.15.4 identifies the paired Mira hormone analyzer by performing a substring match against the BLE advertisement name only, with no cryptographic peripheral authentication, MAC allowlist, or bonded-identity check. An attacker could capture live session token information and inject forged hormone measurements into the victim's cloud record and clinical trend view. View CVE Details Affected Products Mira Hormone Monitor, Mira Android App Vendor: Quanovate Tech Inc. (operating as Mira / Mira Care) Product Version: Quanovate Tech Inc. (operating as Mira / Mira Care) Mira Monitor Firmware: 1.7.1.47, Quanovate Tech Inc. (operating as Mira / Mira Care) Mira Android App: 4.5.15.4 Product Status: known_affected Remediations Mitigation Users should update the Mira app to the latest version iOS v3.5.18 / Android v4.5.18. Firmware v01.07.01.53 is updated via the app when the device is connected. No additional action is required. Relevant CWE: CWE-290 Authentication Bypass by Spoofing Metrics CVSS Version Base Score Base Severity Vector String 3.1 7.4 HIGH CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N 4.0 8.2 HIGH CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:A/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N CVE-2026-67568 The distributed Mira Android APK v4.5.15.4 allows an attacker read/write access to reproductive health profiles from internet connected hosts, which could result in forgery, deletion, or destruction of health information. View CVE Details Affected Products Mira Hormone Monitor, Mira Android App Vendor: Quanovate Tech Inc. (operating as Mira / Mira Care) Product Version: Quanovate Tech Inc. (operating as Mira / Mira Care) Mira Monitor Firmware: 1.7.1.47, Quanovate Tech Inc. (operating as Mira / Mira Care) Mira Android App: 4.5.15.4 Product Status: known_affected Remediations Mitigation Users should update the Mira app to the latest version iOS v3.5.18 / Android v4.5.18. Firmware v01.07.01.53 is updated via the app when the device is connected. No additional action is required. Relevant CWE: CWE-798 Use of Hard-coded Credentials Metrics CVSS Version Base Score Base Severity Vector String 3.1 9.1 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N 4.0 9.3 CRITICAL CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N CVE-2026-68067 The login endpoint on the Mira cloud API accepts any format-valid string in the password field and returns a live active session token for the account matching the supplied email address. An attacker could use an email address to control cloud accounts and access hormone record information and account settings. View CVE Details Affected Products Mira Hormone Monitor, Mira Android App Vendor: Quanovate Tech Inc. (operating as Mira / Mira Care) Product Version: Quanovate Tech Inc. (operating as Mira / Mira Care) Mira Monitor Firmware: 1.7.1.47, Quanovate Tech Inc. (operating as Mira / Mira Care) Mira Android App: 4.5.15.4 Product Status: known_affected Remediations Mitigation Users should update the Mira app to the latest version iOS v3.5.18 / Android v4.5.18. Firmware v01.07.01.53 is updated via the app when the device is connected. No additional action is required. Relevant CWE: CWE-1390 Weak Authentication Metrics CVSS Version Base Score Base Severity Vector String 3.1 9.8 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 4.0 9.3 CRITICAL CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVE-2026-66340 The Mira cloud authentication endpoints do not enforce per-account rate limiting, per-IP throttling, or account lockout after repeated failed login attempts. An attacker can use brute-force methods to obtain gain access to user accounts. View CVE Details Affected Products Mira Hormone Monitor, Mira Android App Vendor: Quanovate Tech Inc. (operating as Mira / Mira Care) Product Version: Quanovate Tech Inc. (operating as Mira / Mira Care) Mira Monitor Firmware: 1.7.1.47, Quanovate Tech Inc. (operating as Mira / Mira Care) Mira Android App: 4.5.15.4 Product Status: known_affected Remediations Mitigation Users should update the Mira app to the latest version iOS v3.5.18 / Android v4.5.18. Firmware v01.07.01.53 is updated via the app when the device is connected. No additional action is required. Relevant CWE: CWE-307 Improper Restriction of Excessive Authentication Attempts Metrics CVSS Version Base Score Base Severity Vector String 3.1 5.3 MEDIUM CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N 4.0 6.9 MEDIUM CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N CVE-2026-64934 The Mira cloud API accepts the firmware version reported by the companion app as authoritative for a given device, without independently attesting the version from the device itself. An authenticated attacker could submit arbitrary firmware version strings for their own device, allowing them to evade vendor-side vulnerable-fleet analytics, suppress security update prompts to the user, and misrepresent patch-adoption metrics. View CVE Details Affected Products Mira Hormone Monitor, Mira Android App Vendor: Quanovate Tech Inc. (operating as Mira / Mira Care) Product Version: Quanovate Tech Inc. (operating as Mira / Mira Care) Mira Monitor Firmware: 1.7.1.47, Quanovate Tech Inc. (operating as Mira / Mira Care) Mira Android App: 4.5.15.4 Product Status: known_affected Remediations Mitigation Users should update the Mira app to the latest version iOS v3.5.18 / Android v4.5.18. Firmware v01.07.01.53 is updated via the app when the device is connected. No additional action is required. Relevant CWE: CWE-807 Reliance on Untrusted Inputs in a Security Decision Metrics CVSS Version Base Score Base Severity Vector String 3.1 4.3 MEDIUM CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N 4.0 5.3 MEDIUM CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N CVE-2026-66832 When the Mira Android app opens in-app WebView content (e.g., shop redirect flows), the user's live session token is appended to the URL as a query string parameter, and a persistent user identifier is included in the WebView's User-Agent header. Both are then transmitted to third-party web properties, referrer logs, and any JavaScript running in the WebView context. View CVE Details Affected Products Mira Hormone Monitor, Mira Android App Vendor: Quanovate Tech Inc. (operating as Mira / Mira Care) Product Version: Quanovate Tech Inc. (operating as Mira / Mira Care) Mira Monitor Firmware: 1.7.1.47, Quanovate Tech Inc. (operating as Mira / Mira Care) Mira Android App: 4.5.15.4 Product Status: known_affected Remediations Mitigation Users should update the Mira app to the latest version iOS v3.5.18 / Android v4.5.18. Firmware v01.07.01.53 is updated via the app when the device is connected. No additional action is required. Relevant CWE: CWE-598 Use of GET Request Method With Sensitive Query Strings Metrics CVSS Version Base Score Base Severity Vector String 3.1 6.5 MEDIUM CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N 4.0 6.9 MEDIUM CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N Acknowledgments Gigi Xiaoqing Liu, Muzzammil Mohammed, Narmina Karimova, and En Mong of Northeastern University SPQR Lab reported these vulnerabilities to Quanovate Tech Legal Notice and Terms of Use This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy). Recommended Practices CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities. Minimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet. Locate control system networks and remote devices behind firewalls and isolating them from business networks. When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices. CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures. CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies. CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets. Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies. Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents. CISA also recommends users take the following measures to protect themselves from social engineering attacks: Do not click web links or open attachments in unsolicited email messages. Refer to Recognizing and Avoiding Email Scams for more information on avoiding email scams. Refer to Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks. No known public exploitation specifically targeting these vulnerabilities has been reported to CISA at this time. Revision History Initial Release Date: 2026-08-11 Date Revision Summary 2026-08-11 1 Initial Publication Legal Notice and Terms of Use
View CSAF Summary Successful exploitation of this vulnerability could allow an attacker to use hidden commands to disable electrical safety mechanisms or modify other stimulation output settings. The following versions of Pulsetto Vagus Nerve Stimulator are affected: Pulsetto Vagus Nerve Stimulator vers:all/* (CVE-2026-18844) CVSS Vendor Equipment Vulnerabilities v3 8.1 Pulsetto Pulsetto Vagus Nerve Stimulator Hidden Functionality Background Critical Infrastructure Sectors: Healthcare and Public Health Countries/Areas Deployed: Worldwide Company Headquarters Location: Lithuania Vulnerabilities Expand All + CVE-2026-18844 The firmware of the affected product accepts several undisclosed commands over its Bluetooth Low Energy (BLE) interface. These commands are sent without authentication or encryption, and are never issued by the companion mobile application, yet are fully processed by the device when it is powered on. View CVE Details Affected Products Pulsetto Vagus Nerve Stimulator Vendor: Pulsetto Product Version: Pulsetto Pulsetto Vagus Nerve Stimulator: vers:all/* Product Status: known_affected Remediations Mitigation Pulsetto has not responded to requests to work with CISA to mitigate this vulnerability. Users are encouraged to reach out directly to Pulsetto for assistance at info@pulsetto.tech. mailto:info@pulsetto.tech Relevant CWE: CWE-912 Hidden Functionality Metrics CVSS Version Base Score Base Severity Vector String 3.1 8.1 HIGH CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H 4.0 7.2 HIGH CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N Acknowledgments A.C. Buglione reported this vulnerability to CISA Legal Notice and Terms of Use This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy). Recommended Practices CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability. Minimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet. Locate control system networks and remote devices behind firewalls and isolating them from business networks. When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices. CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures. CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies. CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets. Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies. Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents. CISA also recommends users take the following measures to protect themselves from social engineering attacks: Do not click web links or open attachments in unsolicited email messages. Refer to Recognizing and Avoiding Email Scams for more information on avoiding email scams. Refer to Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks. No known public exploitation specifically targeting this vulnerability has been reported to CISA at this time. This vulnerability is not exploitable remotely. Revision History Initial Release Date: 2026-08-11 Date Revision Summary 2026-08-11 1 Initial Publication Legal Notice and Terms of Use
CISA has released an advisory on critical vulnerabilities affecting Johnson Controls C-CURE 9000 and Victor application server, with CVSS scores up to 9.6, that could allow unauthenticated attackers on adjacent networks to achieve remote code execution and impact physical security controls. CVE-2026-21655 involves unsafe deserialization, CVE-2026-21653 is a server-side request forgery flaw in Victor Web, and CVE-2026-34496 permits privilege escalation—all affecting critical infrastructure worldwide. Affected versions include C-CURE 9000 ≤v3.10.1, Victor Application Server ≤v4.10, and Victor Web ≤v7.1; Johnson Controls recommends immediate upgrades and provides interim mitigations including network segmentation on port 8999 and IDS/IPS tuning for .NET deserialization payloads.
CISA has added three vulnerabilities to its Known Exploited Vulnerabilities Catalog: a Cisco Secure Firewall heap inspection flaw, a Microsoft Windows use-after-free vulnerability, and a Metabase SQL injection vulnerability, all showing evidence of active exploitation. Federal agencies are required under BOD 26-04 to prioritize patching these high-risk vulnerabilities on publicly exposed assets, while CISA encourages all organizations to adopt similar risk-based remediation practices. The agency continues to accept nominations for vulnerabilities meeting exploitation criteria to expand the KEV Catalog.
Suisan City, California, has fallen victim to a cyber incident that has disrupted police and fire response services, adding to a growing wave of attacks targeting US local government entities. The attack is part of a broader pattern, with at least two other local authorities experiencing cyber incidents within the same week.
Project CAV3RN uses Google Apps Script as a command-and-control relay to target Israeli systems, leveraging legitimate Google services as cover for malicious traffic. The campaign employs a modular .NET NativeAOT framework paired with DNS-based C2 channel selection, enabling attackers to route commands while blending communications with benign Google traffic to bypass security detection.
Kimwolf v7 represents an updated iteration of the Kimwolf botnet with enhanced capabilities targeting Android IoT devices, leveraging HTTP/2 DDoS fingerprinting for attacks. The malware employs Ethereum ENS for command-and-control resolution alongside Tor-based backup routing to maintain resilience against takedown efforts.