August 2026 brings a massive security update from Microsoft addressing 398 new CVEs alongside Adobe's release of 51 vulnerabilities, with critical flaws in DNS servers, deployment services, and QUIC protocol that require rapid testing and deployment, particularly for internet-facing infrastructure. While the volume of patches continues to grow as the new normal, only one Microsoft vulnerability is currently under active attack, allowing organizations to prioritize critical remote code execution bugs in DNS and QUIC over the broader patch load. Key priorities include Microsoft Exchange Server elevation-of-privilege vulnerabilities demonstrated at Pwn2Own, Windows Deployment Services TFTP flaws affecting PXE boot scenarios, and Adobe Campaign Classic issues, all rated for immediate deployment.
Rapid7 and Microsoft disclosed CVE-2026-55040, a critical authentication bypass in Microsoft SharePoint's JWT token validation that allows unauthenticated remote attackers to forge valid tokens and impersonate any site user or administrator. The vulnerability stems from four chained weaknesses in the token validation pipeline: disabled signature verification on outer tokens, unverified actor token resolution using attacker-controlled certificate thumbprints, overly permissive issuer validation, and non-cryptographic signature checks. Rapid7 has published a technical analysis and proof-of-concept demonstrating how attackers can construct malicious JWTs to gain authenticated access to vulnerable SharePoint Server Subscription Edition instances.
Rapid7 Labs disclosed CVE-2026-63520, a high-severity remote code execution vulnerability in Microsoft SharePoint caused by unsafe .NET type instantiation in Business Connectivity Services, which affects all supported versions of the platform. When chained with the previously disclosed authentication bypass CVE-2026-55040, the vulnerabilities enable unauthenticated RCE with the privileges of the SharePoint service account, with Microsoft patches now available across multiple SharePoint versions. The vulnerability was discovered through an AI-assisted research methodology that combined agentic workflows with expert guidance, demonstrating the accelerating capability of large language models in vulnerability discovery against complex enterprise targets.
Researchers discovered a critical flaw in Zoom's screen-sharing feature that could allow any call participant to take control of another user's device, which has since been patched. The vulnerability was identified through automated AI-assisted fuzzing, with the public tool requiring fewer than 20 prompts to uncover the exploit.
View CSAF Summary Successful exploitation of these vulnerabilities could allow an attacker to access unauthorized health profile information, make changes to health information, cause a denial-of-service condition, disclose session token information, and obtain control of user accounts. The following versions of Mira Hormone Monitor, Mira Android App are affected: Mira Monitor Firmware 1.7.1.47 (CVE-2026-66875, CVE-2026-66098, CVE-2026-67558, CVE-2026-67568, CVE-2026-68067, CVE-2026-66340, CVE-2026-64934, CVE-2026-66832) Mira Android App 4.5.15.4 (CVE-2026-66875, CVE-2026-66098, CVE-2026-67558, CVE-2026-67568, CVE-2026-68067, CVE-2026-66340, CVE-2026-64934, CVE-2026-66832) CVSS Vendor Equipment Vulnerabilities v3 9.8 Quanovate Tech Inc. (operating as Mira / Mira Care) Mira Hormone Monitor, Mira Android App Missing Authentication for Critical Function, Authentication Bypass by Spoofing, Use of Hard-coded Credentials, Weak Authentication, Improper Restriction of Excessive Authentication Attempts, Reliance on Untrusted Inputs in a Security Decision, Use of GET Request Method With Sensitive Query Strings Background Critical Infrastructure Sectors: Healthcare and Public Health Countries/Areas Deployed: Worldwide Company Headquarters Location: United States Vulnerabilities Expand All + CVE-2026-66875 In the Mira hormone monitor device firmware v1.7.1.47 build 01070147, a remote unauthenticated attacker within BLE range (approximately 10–30 meters) can silently rebind the device to an attacker-controlled account, extract stored hormone measurements in cleartext, cause a denial-of-service via malformed or undocumented command opcodes, and passively track the user via a static random BLE address that never rotates. View CVE Details Affected Products Mira Hormone Monitor, Mira Android App Vendor: Quanovate Tech Inc. (operating as Mira / Mira Care) Product Version: Quanovate Tech Inc. (operating as Mira / Mira Care) Mira Monitor Firmware: 1.7.1.47, Quanovate Tech Inc. (operating as Mira / Mira Care) Mira Android App: 4.5.15.4 Product Status: known_affected Remediations Mitigation Users should update the Mira app to the latest version iOS v3.5.18 / Android v4.5.18. Firmware v01.07.01.53 is updated via the app when the device is connected. No additional action is required. Relevant CWE: CWE-306 Missing Authentication for Critical Function Metrics CVSS Version Base Score Base Severity Vector String 3.1 8.8 HIGH CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 4.0 8.7 HIGH CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVE-2026-66098 The Mira hormone monitor device firmware accepts a 0x01 write from any BLE central without authentication, causing the device to reboot into bootloader mode. An attacker could cause a denial-of-service condition or disrupt ovulation tracking and fertility monitoring workflow. View CVE Details Affected Products Mira Hormone Monitor, Mira Android App Vendor: Quanovate Tech Inc. (operating as Mira / Mira Care) Product Version: Quanovate Tech Inc. (operating as Mira / Mira Care) Mira Monitor Firmware: 1.7.1.47, Quanovate Tech Inc. (operating as Mira / Mira Care) Mira Android App: 4.5.15.4 Product Status: known_affected Remediations Mitigation Users should update the Mira app to the latest version iOS v3.5.18 / Android v4.5.18. Firmware v01.07.01.53 is updated via the app when the device is connected. No additional action is required. Relevant CWE: CWE-306 Missing Authentication for Critical Function Metrics CVSS Version Base Score Base Severity Vector String 3.1 6.5 MEDIUM CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H 4.0 7.1 HIGH CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N CVE-2026-67558 The Mira Android companion app v4.5.15.4 identifies the paired Mira hormone analyzer by performing a substring match against the BLE advertisement name only, with no cryptographic peripheral authentication, MAC allowlist, or bonded-identity check. An attacker could capture live session token information and inject forged hormone measurements into the victim's cloud record and clinical trend view. View CVE Details Affected Products Mira Hormone Monitor, Mira Android App Vendor: Quanovate Tech Inc. (operating as Mira / Mira Care) Product Version: Quanovate Tech Inc. (operating as Mira / Mira Care) Mira Monitor Firmware: 1.7.1.47, Quanovate Tech Inc. (operating as Mira / Mira Care) Mira Android App: 4.5.15.4 Product Status: known_affected Remediations Mitigation Users should update the Mira app to the latest version iOS v3.5.18 / Android v4.5.18. Firmware v01.07.01.53 is updated via the app when the device is connected. No additional action is required. Relevant CWE: CWE-290 Authentication Bypass by Spoofing Metrics CVSS Version Base Score Base Severity Vector String 3.1 7.4 HIGH CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N 4.0 8.2 HIGH CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:A/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N CVE-2026-67568 The distributed Mira Android APK v4.5.15.4 allows an attacker read/write access to reproductive health profiles from internet connected hosts, which could result in forgery, deletion, or destruction of health information. View CVE Details Affected Products Mira Hormone Monitor, Mira Android App Vendor: Quanovate Tech Inc. (operating as Mira / Mira Care) Product Version: Quanovate Tech Inc. (operating as Mira / Mira Care) Mira Monitor Firmware: 1.7.1.47, Quanovate Tech Inc. (operating as Mira / Mira Care) Mira Android App: 4.5.15.4 Product Status: known_affected Remediations Mitigation Users should update the Mira app to the latest version iOS v3.5.18 / Android v4.5.18. Firmware v01.07.01.53 is updated via the app when the device is connected. No additional action is required. Relevant CWE: CWE-798 Use of Hard-coded Credentials Metrics CVSS Version Base Score Base Severity Vector String 3.1 9.1 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N 4.0 9.3 CRITICAL CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N CVE-2026-68067 The login endpoint on the Mira cloud API accepts any format-valid string in the password field and returns a live active session token for the account matching the supplied email address. An attacker could use an email address to control cloud accounts and access hormone record information and account settings. View CVE Details Affected Products Mira Hormone Monitor, Mira Android App Vendor: Quanovate Tech Inc. (operating as Mira / Mira Care) Product Version: Quanovate Tech Inc. (operating as Mira / Mira Care) Mira Monitor Firmware: 1.7.1.47, Quanovate Tech Inc. (operating as Mira / Mira Care) Mira Android App: 4.5.15.4 Product Status: known_affected Remediations Mitigation Users should update the Mira app to the latest version iOS v3.5.18 / Android v4.5.18. Firmware v01.07.01.53 is updated via the app when the device is connected. No additional action is required. Relevant CWE: CWE-1390 Weak Authentication Metrics CVSS Version Base Score Base Severity Vector String 3.1 9.8 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 4.0 9.3 CRITICAL CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVE-2026-66340 The Mira cloud authentication endpoints do not enforce per-account rate limiting, per-IP throttling, or account lockout after repeated failed login attempts. An attacker can use brute-force methods to obtain gain access to user accounts. View CVE Details Affected Products Mira Hormone Monitor, Mira Android App Vendor: Quanovate Tech Inc. (operating as Mira / Mira Care) Product Version: Quanovate Tech Inc. (operating as Mira / Mira Care) Mira Monitor Firmware: 1.7.1.47, Quanovate Tech Inc. (operating as Mira / Mira Care) Mira Android App: 4.5.15.4 Product Status: known_affected Remediations Mitigation Users should update the Mira app to the latest version iOS v3.5.18 / Android v4.5.18. Firmware v01.07.01.53 is updated via the app when the device is connected. No additional action is required. Relevant CWE: CWE-307 Improper Restriction of Excessive Authentication Attempts Metrics CVSS Version Base Score Base Severity Vector String 3.1 5.3 MEDIUM CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N 4.0 6.9 MEDIUM CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N CVE-2026-64934 The Mira cloud API accepts the firmware version reported by the companion app as authoritative for a given device, without independently attesting the version from the device itself. An authenticated attacker could submit arbitrary firmware version strings for their own device, allowing them to evade vendor-side vulnerable-fleet analytics, suppress security update prompts to the user, and misrepresent patch-adoption metrics. View CVE Details Affected Products Mira Hormone Monitor, Mira Android App Vendor: Quanovate Tech Inc. (operating as Mira / Mira Care) Product Version: Quanovate Tech Inc. (operating as Mira / Mira Care) Mira Monitor Firmware: 1.7.1.47, Quanovate Tech Inc. (operating as Mira / Mira Care) Mira Android App: 4.5.15.4 Product Status: known_affected Remediations Mitigation Users should update the Mira app to the latest version iOS v3.5.18 / Android v4.5.18. Firmware v01.07.01.53 is updated via the app when the device is connected. No additional action is required. Relevant CWE: CWE-807 Reliance on Untrusted Inputs in a Security Decision Metrics CVSS Version Base Score Base Severity Vector String 3.1 4.3 MEDIUM CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N 4.0 5.3 MEDIUM CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N CVE-2026-66832 When the Mira Android app opens in-app WebView content (e.g., shop redirect flows), the user's live session token is appended to the URL as a query string parameter, and a persistent user identifier is included in the WebView's User-Agent header. Both are then transmitted to third-party web properties, referrer logs, and any JavaScript running in the WebView context. View CVE Details Affected Products Mira Hormone Monitor, Mira Android App Vendor: Quanovate Tech Inc. (operating as Mira / Mira Care) Product Version: Quanovate Tech Inc. (operating as Mira / Mira Care) Mira Monitor Firmware: 1.7.1.47, Quanovate Tech Inc. (operating as Mira / Mira Care) Mira Android App: 4.5.15.4 Product Status: known_affected Remediations Mitigation Users should update the Mira app to the latest version iOS v3.5.18 / Android v4.5.18. Firmware v01.07.01.53 is updated via the app when the device is connected. No additional action is required. Relevant CWE: CWE-598 Use of GET Request Method With Sensitive Query Strings Metrics CVSS Version Base Score Base Severity Vector String 3.1 6.5 MEDIUM CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N 4.0 6.9 MEDIUM CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N Acknowledgments Gigi Xiaoqing Liu, Muzzammil Mohammed, Narmina Karimova, and En Mong of Northeastern University SPQR Lab reported these vulnerabilities to Quanovate Tech Legal Notice and Terms of Use This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy). Recommended Practices CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities. Minimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet. Locate control system networks and remote devices behind firewalls and isolating them from business networks. When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices. CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures. CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies. CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets. Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies. Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents. CISA also recommends users take the following measures to protect themselves from social engineering attacks: Do not click web links or open attachments in unsolicited email messages. Refer to Recognizing and Avoiding Email Scams for more information on avoiding email scams. Refer to Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks. No known public exploitation specifically targeting these vulnerabilities has been reported to CISA at this time. Revision History Initial Release Date: 2026-08-11 Date Revision Summary 2026-08-11 1 Initial Publication Legal Notice and Terms of Use
CISA has added three vulnerabilities to its Known Exploited Vulnerabilities Catalog: a Cisco Secure Firewall heap inspection flaw, a Microsoft Windows use-after-free vulnerability, and a Metabase SQL injection vulnerability, all showing evidence of active exploitation. Federal agencies are required under BOD 26-04 to prioritize patching these high-risk vulnerabilities on publicly exposed assets, while CISA encourages all organizations to adopt similar risk-based remediation practices. The agency continues to accept nominations for vulnerabilities meeting exploitation criteria to expand the KEV Catalog.
CISA has released an advisory on critical vulnerabilities affecting Johnson Controls C-CURE 9000 and Victor application server, with CVSS scores up to 9.6, that could allow unauthenticated attackers on adjacent networks to achieve remote code execution and impact physical security controls. CVE-2026-21655 involves unsafe deserialization, CVE-2026-21653 is a server-side request forgery flaw in Victor Web, and CVE-2026-34496 permits privilege escalation—all affecting critical infrastructure worldwide. Affected versions include C-CURE 9000 ≤v3.10.1, Victor Application Server ≤v4.10, and Victor Web ≤v7.1; Johnson Controls recommends immediate upgrades and provides interim mitigations including network segmentation on port 8999 and IDS/IPS tuning for .NET deserialization payloads.
View CSAF Summary Successful exploitation of this vulnerability could allow an attacker to use hidden commands to disable electrical safety mechanisms or modify other stimulation output settings. The following versions of Pulsetto Vagus Nerve Stimulator are affected: Pulsetto Vagus Nerve Stimulator vers:all/* (CVE-2026-18844) CVSS Vendor Equipment Vulnerabilities v3 8.1 Pulsetto Pulsetto Vagus Nerve Stimulator Hidden Functionality Background Critical Infrastructure Sectors: Healthcare and Public Health Countries/Areas Deployed: Worldwide Company Headquarters Location: Lithuania Vulnerabilities Expand All + CVE-2026-18844 The firmware of the affected product accepts several undisclosed commands over its Bluetooth Low Energy (BLE) interface. These commands are sent without authentication or encryption, and are never issued by the companion mobile application, yet are fully processed by the device when it is powered on. View CVE Details Affected Products Pulsetto Vagus Nerve Stimulator Vendor: Pulsetto Product Version: Pulsetto Pulsetto Vagus Nerve Stimulator: vers:all/* Product Status: known_affected Remediations Mitigation Pulsetto has not responded to requests to work with CISA to mitigate this vulnerability. Users are encouraged to reach out directly to Pulsetto for assistance at info@pulsetto.tech. mailto:info@pulsetto.tech Relevant CWE: CWE-912 Hidden Functionality Metrics CVSS Version Base Score Base Severity Vector String 3.1 8.1 HIGH CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H 4.0 7.2 HIGH CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N Acknowledgments A.C. Buglione reported this vulnerability to CISA Legal Notice and Terms of Use This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy). Recommended Practices CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability. Minimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet. Locate control system networks and remote devices behind firewalls and isolating them from business networks. When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices. CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures. CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies. CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets. Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies. Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents. CISA also recommends users take the following measures to protect themselves from social engineering attacks: Do not click web links or open attachments in unsolicited email messages. Refer to Recognizing and Avoiding Email Scams for more information on avoiding email scams. Refer to Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks. No known public exploitation specifically targeting this vulnerability has been reported to CISA at this time. This vulnerability is not exploitable remotely. Revision History Initial Release Date: 2026-08-11 Date Revision Summary 2026-08-11 1 Initial Publication Legal Notice and Terms of Use
A critical unauthenticated SQL injection vulnerability has been discovered in Metabase's password reset functionality, tracked as CVE-2026-72898, with confirmed active exploitation occurring in the wild. Organizations operating self-hosted Metabase instances are urged to take immediate remediation action to protect against this vulnerability, which requires no authentication to exploit.
Metabase contains a SQL Injection vulnerability that allows an unauthenticated remote attacker to inject arbitrary SQL into the Metabase application database, which can give them administrator access to the instance. From there, the attacker could change the application configuration, steal stored credentials for the connected databases, read any data accessible through those connections, and export data. Added to CISA's Known Exploited Vulnerabilities catalog with a CVSS score of 10 (Critical). Affects Metabase Metabase.
A maximum-severity zero-day vulnerability in Metabase allows remote attackers to gain administrator access to the business-analytics platform, potentially exposing both the platform itself and its downstream users to compromise. The flaw remains unpatched and has not yet been assigned a CVE identifier, creating immediate risk for organizations using the affected software.
Sophisticated iPhone exploit chains that were previously restricted to nation-state actors are now proliferating among organized cybercrime groups globally. The Coruna and DarkSword exploits represent a significant shift in the accessibility of advanced iOS attack capabilities, expanding the threat landscape beyond state-sponsored operations to larger criminal ecosystems.
Researchers discovered a vulnerability in Atlassian's Rovo AI assistant that could allow attackers to exfiltrate company data through a single crafted link. Atlassian has issued a fix for the flaw, which was tracked as RovoBlast. The vulnerability highlights potential risks in AI-assisted tools used for enterprise collaboration and knowledge management.
Key Takeaways Human-speed compliance is dead. Attackers utilizing modern, autonomous AI tools can chain enterprise misconfigurations and weaponize vulnerabilities in under 25 minutes, rendering manual, periodic audit cycles completely obsolete. The “Configuration Gap” is your biggest blind spot. Organizations take an average of 14 months to remediate basic identity, access control, and logging flaws, leaving […]
Ghostjacking exploits the trusted access of AI agents to bypass firewall controls by feeding them fabricated reports, a technique that Tenet found affects half of Fortune 500 companies. This vulnerability highlights a critical gap in how AI systems validate information sources before executing privileged actions. Security teams must reassess their AI agent configurations to verify data authenticity and restrict unnecessary elevated permissions.
A real-world Evo Continuous Offensive Security assessment identified 33 confirmed vulnerabilities within a multi-tenant enterprise SaaS environment, encompassing critical authorization flaws and issues that could enable tenant-wide compromise. The findings demonstrate the practical value of continuous offensive security testing in uncovering systemic weaknesses that traditional assessments might miss in complex SaaS architectures.
Apple's latest macOS update patches two Screen Sharing server vulnerabilities, one of which allows pre-authenticated remote code execution. These flaws represent a significant risk as they can be exploited without credentials to gain root-level system access on affected macOS devices.
CISA has disclosed five vulnerabilities in CPDLC over ATN-B1, a critical aviation data link communications protocol used globally, which rely on unauthenticated cleartext radio frequency links allowing remote message injection, session disruption, and denial-of-service attacks. The vulnerabilities enable adversaries to inject false clearances, disconnect multiple aircraft simultaneously, and inject fraudulent emergency messages, degrading operational safety margins through increased workload and delayed safety-critical communications, though no public exploitation has been reported and attacks require high complexity conditions unlikely outside laboratory settings. No mitigations are currently available for any of the five CVEs, with CVSS scores ranging from 5.3 to 7.1.