WordPress 7.0.4 (12 August 2026) is a security release. An Author or anyone with upload_files can upload a malicious PostScript file and reach remote code execution, but only where Imagick and Ghostscript are both in use. WordPress credits pwn.ai. GitHub advisory GHSA-8vr3-7mxf-gx8w scores it 8.8 (CVSS 3.0). Fixed in 7.0.4, with backports through the 4.7 branch (6.9.7, 6.8.8, and the matching older branch builds). No exploitation claim on the WordPress or GitHub notices.
Palo Alto Networks 12 August 2026 advisory: local privilege-escalation bugs in the GlobalProtect app let a local user reach NT AUTHORITY\SYSTEM on Windows and root on macOS and Linux, then run commands with administrative privileges. iOS, Android and Chrome OS are not affected. Vendor CVSS-BT is 5.9 (CVSS 4.0); the same advisory lists CVSS-B 8.5 without the exploit-maturity modifier. Palo Alto Networks says it is not aware of malicious exploitation. Same-day GlobalProtect app advisories cover CVE-2026-0295 (macOS race-condition LPE, CVSS-BT 4.1), CVE-2026-0296 (certificate-validation bypass of app traffic, not the VPN tunnel, CVSS-BT 4.5), CVE-2026-0297 (UDP tunnel handshake buffer overflow, CVSS-BT 5.2) and CVE-2026-0298 (Windows PLAP MitM code execution, CVSS-BT 5.2 / CVSS-B 7.7). Those sibling advisories show Updated 2026-09-12 on the PSIRT hub; Palo Alto Networks still says it is not aware of malicious exploitation. PAN-OS URL Filtering information disclosure CVE-2026-0301 (CVSS 1.7) was also published 12 August. Prisma Access Agent LPE CVE-2026-0294 (CVSS-BT 6.0; patch 26.3+) remains a related same-day PSIRT item.
MSRC CVE-2026-65660 (August 2026 CSPU) is a SharePoint Server code-injection RCE: an authorized low-privilege attacker can execute code over the network without user interaction. Microsoft scores CVSS 3.1 8.8 Important (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Viettel Cyber Security (Dinh Ho Anh Khoa; technical details amplified 22 Sep 2026) shows the bug in SafeControls/ToolPane Register-directive reconstruction (unescaped quotes → arbitrary .NET class load → XamlServices.Parse webshell) and notes Microsoft’s HTML advisory initially framed it as spoofing/CVSS 6.5 while the CVE record titles RCE. Affects SharePoint Server 2016, 2019, Subscription Edition (researcher also claims 2013 EOL). August 11 updates fix; can chain with already-patched auth bypass for pre-auth RCE only if that June fix was missed. Distinct from desk CVE-2026-55040 / CVE-2026-63520. UPDATE 25 Sep 2026: CISA added CVE-2026-65660 to KEV (dateAdded 2026-09-25; federal due date 28 Sep 2026) alongside WSO2/Adobe Magento KEV adds. UPDATE 27 Sep 2026: SecurityWeek reports Microsoft’s updated advisory states that as of 25 September 2026 Microsoft had reliable evidence of observed attacks exploiting this vulnerability; Previdian (formerly KEVIntel) saw exploitation attempts on 24 Sep and attempts to create a webshell backdoor on 25 Sep, appearing based on Viettel’s technical disclosure. UPDATE 1 Oct 2026 (desk 13:00 Perth): WA SOC advisory 20261001001 (TLP:CLEAR) restates CVE-2026-65660 (CVSS 8.8 High) as an authenticated low-privilege code-injection RCE on SharePoint Server 2016/2019/Subscription Edition, notes CISA KEV listing, gives the build floors above, links MSRC, and states WA SOC has not received reports of exploitation on Western Australian Government networks at time of writing; recommends vendor patches within expected timeframes. Primary: MSRC; KEV: CISA; wire: SecurityWeek 27 Sep / BleepingComputer / The Hacker News.
MSRC — CVE-2026-65660 SharePoint Server RCE (Aug 2026)
Microsoft patched CVE-2026-62911 in the August 2026 Patch Tuesday cycle: authentication bypass by capture-replay in Exchange Server that lets an authorised attacker elevate privileges over the network and take over user mailboxes (send, read, download attachments). Affected products named in coverage include Exchange Server 2016, 2019 and Subscription Edition. On 1 September 2026 BleepingComputer reported Shadowserver observing 21,899 internet-exposed Exchange fingerprints still unpatched (largest counts in the United States and Germany), and relayed NCSC-NL guidance that exploit code is available and that Exchange 2016/2019 security updates require the Extended Security Updates programme. Germany's BSI separately warned that a large share of on-premises Exchange in Germany remained vulnerable. This desk has not seen a CISA KEV listing for CVE-2026-62911 at write-up. NEW 8 Sep AU: iTnews cites Shadowserver counts of 382 Australian and 56 New Zealand Exchange hosts still vulnerable as of 31 August 2026; NCSC-NL (28 Aug) said public PoC exists and warned unauthenticated attackers could potentially achieve arbitrary code execution; ASD urges patching or network segmentation for legacy Exchange; coverage rates CVSS 3.1 as 8.0. Patch promptly; do not leave legacy Exchange on the public internet.
Microsoft's 11 August 2026 Patch Tuesday fix (MSRC CVE-2026-63520) addresses improper input validation in on-premises SharePoint that lets an unauthorised attacker execute code over the network. NVD scores it 8.1 (CVSS 3.1, High, attack complexity High). Rapid7, which co-disclosed with Microsoft, says the bug is unsafe .NET type instantiation in Business Connectivity Services and that chaining it with the July auth bypass CVE-2026-55040 yields unauthenticated RCE. August security updates cover SharePoint Server Subscription Edition (KB5002893), SharePoint Server 2019 (KB5002894 / KB5002896), and SharePoint Enterprise Server 2016 (KB5002905 / KB5002906). Public PoC material for the RCE half appeared around 24 August; Defused later reported honeypot probes of the 55040+63520 chain (JWT bypass exercised, BCS probing, no code execution observed in that report). Microsoft had not labelled 63520 as exploited in the wild at last magazine check. Prefer the August updates; do not leave on-prem SharePoint internet-facing without need.
Microsoft's 11 August 2026 security update for CVE-2026-68820 fixes a use-after-free in the Windows Ancillary Function Driver for WinSock. A locally authenticated attacker who wins a race with a crafted application can elevate to SYSTEM. Microsoft rates it Important, CVSS 3.1 7.0 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), and marks Exploitation Detected. CISA added it to the Known Exploited Vulnerabilities catalog on 11 August 2026 with the same-day Cisco ASA/FTD and Metabase KEV batch. Apply the August 2026 cumulative update for your Windows build and reboot so the kernel driver replacement takes effect. Distinct from SharePoint CVE-2026-55040 already on this desk.
Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) Heap Inspection Vulnerability. Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) contain a heap inspection vulnerability that could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting in a denial of service (DoS) condition. Apply vendor mitigations. Check the NVD record and the vendor advisory for affected versions and the patch.
Microsoft's UFO repository published GitHub security advisory GHSA-24fq-m9rr-g3mm (rated Critical) on 10 August 2026 (05:24 UTC; 1:24 pm Perth) for CVE-2026-73296 in its open-source UFO automation framework. The advisory says the Mobile Model Context Protocol (MCP) data-collection and action servers, on TCP ports 8020 and 8021, expose ADB-backed Android functionality without authentication, so that when they are run in the documented remote configuration bound to 0.0.0.0, any network client that can reach them can retrieve screenshots, UI hierarchy data and device metadata and inject taps, swipes, text, key events, app launches and control clicks into an ADB-connected device; the default CLI host is localhost. It rates the flaw CVSS 3.1 9.4 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L) under CWE-306 and CWE-862. The advisory describes a proposed remediation in which both servers require a bearer credential read from UFO_MCP_API_KEY and startup fails closed when the key is absent. The CVE record (GitHub CNA) says the issue is fixed in UFO 3.0.8, and CISA's enrichment lists proof-of-concept exploitation. Until patched, keep Mobile MCP on localhost and block TCP 8020/8021. Primary: GitHub advisory (microsoft/UFO); CVE record. Correction (27 Oct 2026): the card now rests on the advisory in Microsoft's UFO repository and the CVE record, not on Cyber Security News, which does not serve its pages to this desk; that link and credit are removed, the advisory link now points at the repository advisory (the global advisory page returned 404), and the description of UFO 3.0.8's authentication change is now given as the advisory states it, a proposed remediation. The card date has moved from 31 August to 10 August 2026, the Perth date of the advisory. (source: GitHub advisory GHSA-24fq-m9rr-g3mm; CVE.org)
GitHub — microsoft/UFO advisory GHSA-24fq-m9rr-g3mm (10 Aug 2026)
Progress LoadMaster Command Injection Vulnerability. Progress LoadMaster contains a command injection vulnerability that allows an un-authenticated attacker to execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input in multiple command endpoints. Apply vendor mitigations. Check the NVD record and the vendor advisory for affected versions and the patch.
Apple's 6 August 2026 security content for macOS Tahoe 26.6.1 (and matching Sequoia/Sonoma notes) says an authentication issue in Screen Sharing was addressed with improved state management. Impact: an attacker on the network may be able to authenticate to Screen Sharing without valid credentials. Fixed in macOS Tahoe 26.6.1, macOS Sequoia 15.7.9 and macOS Sonoma 14.8.9. CISA added the CVE to KEV on 18 August 2026 (due 21 August for federal agencies under BOD 26-04) and CISA-ADP rates CVSS 3.1 9.8. Apply the Apple builds above; if Screen Sharing is not required, disable it and keep TCP 5900 off the public internet. Distinct from the 17 August iOS/macOS content card already on this desk.
Metabase GHSA-vwf4-m7j8-wcjf (published 6 August 2026; CVE-2026-72898) is an unauthenticated SQL injection on /api/session/reset_password that lets a remote attacker inject SQL into the Metabase application database and obtain administrator access, then steal connected-database credentials and export data. CVSS 3.1 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). Metabase confirmed active exploitation. Affected OSS lines include ≥0.58.0 before the patched builds; fixed releases are 0.58.24, 0.59.21, 0.60.17, 0.61.11, 0.62.9 and 0.63.5 (Enterprise 1.x counterparts on the same minors). Temporary workaround: block /api/session/reset_password. After upgrade on a previously exposed instance: delete core_session rows, review API keys and admin accounts, rotate connected-database credentials, and review warehouse and Metabase query history. This CVE is the Metabase flaw referenced in the Mathspace AU/NZ education breach and in third-party reporting on the ShipMonk/Trezor supply-chain incident. Primary: Metabase GitHub security advisory.
CyberArk (now Idira, the Palo Alto Networks identity security platform) published security bulletins CA26-37 and CA26-38. The public Technical Community notice, edited 4 August 2026, says CA26-37 is High severity and affects Privilege Cloud Central Policy Manager (CPM), all versions prior to 15.0, and CA26-38 is High severity and affects Secrets Manager, Self Hosted, version 13.9.0. Full technical detail sits behind the CyberArk/Idira Technical Community login. No CVE identifiers or CVSS vectors are in that public post. Idira is the May 2026 rebrand of CyberArk after the Palo Alto Networks acquisition; it is not a separate invented product. Confirm the exact patched builds from the logged-in bulletins before upgrading. UPDATE 15–16 October 2026: Palo Alto Networks, as CVE numbering authority, published CVE-2026-45165 for the CA26-38 Secrets Manager flaw on 15 October. The CVE record describes improper authorisation in the REST API (CWE-863) of Idira Secrets Manager (Self-Hosted), also referred to as Conjur, version 13.9.0: an authenticated user with limited privileges can perform unauthorised actions on a policy branch and, under specific circumstances, retrieve secrets they should not see, alter administrative access controls on the branch, or cause a denial of service. It is rated CVSS 4.0 8.6 High, with no exploitation recorded in the CVE record's SSVC data. The fix is Secrets Manager Self-Hosted 13.9.1, per the vendor release notes linked from the CVE record. Canada's Cyber Centre issued advisory AV26-1056 on 16 October covering the same product (prior to 13.9.1).
