Weekly Report: New Hacking Techniques and Critical CVEs 10 Aug to 16 Aug 2026

CISA added 3 vulnerabilities to its Known Exploited Vulnerabilities catalog between 10 and 16 August 2026, all in a single batch on 11 August. Five newly disclosed CVEs reached CVSS 9.0 or above in the window, all of them in SAP’s 11 August Patch Day. Four of the five critical CVEs this week covered in this report have confirmed in-the-wild exploitation, and none of the five had a public proof of concept at the time of writing. Patch CVE-2026-58231 first: a CVSS 10.0 unauthenticated remote code execution flaw in SAP Commerce Cloud’s Data Hub Adapter, with exploitation attempts hitting honeypots three days after the patch shipped. The week’s pattern is speed: attackers moved on freshly patched, internet-facing business platforms within 72 hours, which matches the broader trend of CVEs being exploited in about 3 days.

Which vulnerabilities should you patch first this week?

1. CVE-2026-58231, SAP Commerce Cloud. CVSS 10.0, unauthenticated RCE in the Data Hub Adapter, and threat intelligence firm Defused confirmed exploitation attempts against honeypots on 14 August 2026, three days after SAP’s patch. Shadowserver counts more than 4,200 internet-exposed SAP Commerce Cloud instances. Apply SAP Security Note 3771065 and rebuild now; use IP filtering as interim mitigation.
2. CVE-2026-72898, Metabase. CVSS 10.0, unauthenticated SQL injection through the password-reset endpoint, exploited as a zero-day against Metabase Cloud before disclosure and added to CISA KEV on 11 August 2026. Self-hosted Metabase is internet-facing analytics infrastructure holding database credentials. Upgrade to a fixed release immediately, then rotate credentials and audit admin accounts.
3. CVE-2026-20349, Cisco Secure Firewall ASA and FTD. CVSS 8.6 and under active exploitation to crash remote access SSL VPN devices, with a CISA KEV addition on 11 August 2026 and a federal remediation due date of 14 August 2026, an unusually short three-day clock. It ranks third only because the impact is denial of service rather than code execution; the exploitation is live and the devices are by definition internet-facing.

Ranking logic: confirmed exploitation on internet-facing systems outranks raw CVSS. CVE-2026-68820 in Windows is also actively exploited, and by a state-backed group, but it requires local access and an initial foothold, so it patches with this month’s updates rather than ahead of them. CVE-2026-53413 in Zoom carries no known exploitation and ships through routine client updates. The two CVSS 10.0 flaws lead because both sit unauthenticated on platforms that are internet-facing by design, and one of them was already being attacked three days after its patch existed.

CVE-2026-58231: SAP Commerce Cloud Data Hub Adapter remote code execution

What it is: CVE-2026-58231 is an improper authorization flaw in the Data Hub Adapter extension for SAP Commerce Cloud that lets an unauthenticated attacker abuse a default authentication client and submit crafted input to functions lacking validation, resulting in remote code execution.

Affected products and versions: SAP Commerce Cloud releases 2211 and 2211-JDK21 using the Data Hub Adapter. SAP Security Note 3771065 lists the affected and fixed release levels; patched builds require a rebuild and redeploy.

Severity: CVSS 10.0 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H, SAP). EPSS not available.

Exploitation status: Confirmed in the wild. Defused observed first exploitation attempts against its honeypots on 14 August 2026, three days after patch release, with no public PoC in circulation at that point. Not in CISA KEV as of 16 August 2026.

Patch status: Fixed via SAP Security Note 3771065, released on SAP Patch Day, 11 August 2026. Interim mitigation: restrict access to the Data Hub Adapter by IP filtering.

What to do: Apply Note 3771065 and redeploy affected Commerce Cloud instances this week. If patching is delayed, restrict Data Hub Adapter endpoints to known IP ranges. Check access logs from 11 August 2026 onward for anomalous requests to Data Hub paths.

Why it matters: SAP Commerce Cloud runs customer-facing storefronts, so CVE-2026-58231 gives an attacker code execution on a platform that touches orders, customer records, and payment flows, and more than 4,200 instances are internet-exposed per Shadowserver. Knowing whether one of them is yours is an external attack surface management question that has to be answered faster than the three-day exploitation clock this flaw just demonstrated.

CVE-2026-72898: Metabase unauthenticated SQL injection

What it is: CVE-2026-72898 is an unauthenticated SQL injection in the Metabase business intelligence platform’s /api/session/reset_password endpoint that lets a remote attacker inject arbitrary SQL into the application database and escalate to administrative access.

Affected products and versions: Metabase v58.0 through v58.23, v59.0 through v59.20, v60.0 through v60.16, v61.0 through v61.10, v62.0 through v62.8, and v63.0 through v63.3. Fixed in v58.24, v59.21, v60.17, v61.11, v62.9, and v63.5.

Severity: CVSS 10.0 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H, per the Metabase GitHub advisory). EPSS not available.

Exploitation status: Confirmed in the wild. Metabase detected an attack on Metabase Cloud exploiting the flaw as a zero-day before public disclosure. Added to CISA KEV on 11 August 2026; see the KEV entry for the federal remediation due date.

Patch status: Fixed versions published with the advisory on 6 August 2026: v58.24, v59.21, v60.17, v61.11, v62.9, v63.5. Metabase Cloud is already patched.

What to do: Upgrade self-hosted Metabase to the fixed release for your train now, or block the /api/session/reset_password endpoint until you can. After upgrading, revoke sessions, rotate database credentials stored in Metabase, and audit API keys and admin accounts for additions since early August 2026.

Why it matters: Metabase holds connection credentials for the databases it visualises, so CVE-2026-72898 converts one internet-facing analytics app into access to every connected data store. Exposed self-hosted instances are exactly the class of forgotten web application that AI agent web application pentesting exists to find and exploit before someone else does.

CVE-2026-20349: Cisco Secure Firewall ASA and FTD SSL VPN denial of service

What it is: CVE-2026-20349 is an insufficient error checking flaw in the HTTP processing of the remote access SSL VPN service in Cisco Secure Firewall ASA and FTD software that lets an unauthenticated remote attacker crash and reload the device with crafted HTTP requests, a denial of service against the VPN concentrator itself.

Affected products and versions: Cisco Secure Firewall ASA software release trains 9.16 through 9.24 and FTD release trains 7.0 through 10.0. Cisco has issued fixed and hotfix builds per train, for example ASA 9.24 is fixed in 9.24.1.221; consult the Cisco advisory for the exact fixed build in each train.

Severity: CVSS 8.6 (Cisco PSIRT). EPSS not available.

Exploitation status: Confirmed in the wild by Cisco. Added to CISA KEV on 11 August 2026 with a federal remediation due date of 14 August 2026. Cisco found the flaw during internal testing, and researcher Valerio Brussani independently reported it.

Patch status: Fixed builds and hotfixes are available for all affected ASA and FTD trains, published with Cisco’s advisory on 12 August 2026.

What to do: Patch every internet-facing ASA and FTD device running SSL VPN this week; the 3-day federal deadline signals how CISA reads the risk. Monitor for unexpected device reloads from 11 August 2026 onward. Where patching lags, restrict SSL VPN access at upstream filtering points.

Why it matters: A crash loop on the VPN concentrator locks the workforce out and can force rushed configuration changes that create worse exposure, and attackers have used exactly that pressure as cover for follow-on intrusion attempts against edge devices. ASA and FTD appliances are among the most externally reachable assets an enterprise owns, and repeated exploitation of this device class is why continuous automated penetration testing of the edge beats an annual test cadence: the 3-day federal deadline on this CVE is shorter than most organisations’ change windows.

CVE-2026-68820: Microsoft Windows afd.sys use-after-free zero-day

What it is: CVE-2026-68820 is a use-after-free race condition in the Windows Ancillary Function Driver for WinSock (afd.sys) that lets a low-privileged local attacker execute code as SYSTEM, no user interaction required.

Affected products and versions: Supported Windows client and server versions prior to the 11 August 2026 security updates; Microsoft’s advisory for CVE-2026-68820 carries the build-level boundaries per Windows version.

Severity: CVSS 7.0 (Microsoft). EPSS not available. One inconsistency worth knowing: Microsoft’s own CVSS assessment listed exploit maturity as unproven even as it confirmed active exploitation.

Exploitation status: Confirmed in the wild. Check Point Research attributes exploitation to the North Korea-linked Lazarus Group’s Operation Dream Job campaign, which used the flaw as a zero-day for about five weeks before the patch, targeting defense-sector workers through fake job offers and deploying kernel-mode rootkits. Added to CISA KEV on 11 August 2026 with a federal due date of 25 August 2026.

Patch status: Fixed in Microsoft’s Patch Tuesday updates released 11 August 2026.

What to do: Deploy the August 2026 Windows updates with priority on workstations of personnel exposed to recruitment-themed social engineering, since the observed campaign selected its victims by role rather than by infrastructure. Hunt for kernel-driver loads and privilege escalation from user context in the five weeks before 11 August 2026. Brief high-risk teams on the fake job offer lure Check Point documented in this campaign.

Why it matters: CVE-2026-68820 is the escalation half of a full chain: the phish delivers user-level access and afd.sys turns it into SYSTEM with rootkit persistence. Local privilege escalation flaws never look urgent in isolation, but a state-backed group spent five weeks proving this one chains.

CVE-2026-53413: Zoom clients zero-click remote code execution

What it is: CVE-2026-53413 is a stack buffer overflow in the text annotation feature of Zoom clients that lets a meeting participant execute code on another participant’s machine with no action from the victim; the attacker only needs to be in the same meeting.

Affected products and versions: Zoom Workplace, Zoom Rooms, and Zoom Meeting SDK clients up to and including version 7.0.5 on Windows, macOS, iOS, Android, and Linux. Fixed in Workplace 7.1.5 and 7.0.6, Rooms 7.1.5, and Meeting SDK 7.1.5.

Severity: CVSS 8.3 (CVSS:3.1, NVD). EPSS not available.

Exploitation status: No known exploitation in the wild. A working proof of concept exists privately with the researchers who disclosed it; none is public as of 16 August 2026.

Patch status: Fixed in the client releases above; Zoom also deployed a server-side mitigation on 15 July 2026. Public disclosure and bulletin on 11 August 2026, alongside fixes for related annotation flaws CVE-2026-53414 and CVE-2026-53415.

What to do: Push Zoom client version 7.1.5 (or 7.0.6) through managed software deployment now, since meeting clients update unevenly. Verify Rooms appliances and apps built on the Meeting SDK, which lag desktop updates. Treat external-participant meetings as untrusted input paths in your threat model.

Why it matters: CVE-2026-53413 turns any meeting into an attack surface where one participant can take over another’s device, which breaks the assumption that joining a call is passive. Meeting clients sit on nearly every corporate endpoint, including executive and admin machines, so a wormable-in-a-meeting primitive concentrates risk in exactly the population attackers value most. The discovery method matters as much as the flaw, as the technique section below explains.

New hacking technique: AI-assisted exploit development finds a Zoom zero-click in under 24 hours

What researchers demonstrated: On 11 August 2026, researchers at A Security, led by senior vulnerability researcher Idan Levcovich with Iliya Fayans and Lidor Elias, published Zoomsday, showing they used fewer than 20 prompts on publicly available AI models to find and exploit the Zoom zero-click flaw CVE-2026-53413 in under 24 hours, per their own Zoomsday write-up.

How it works:

1. AI agents mapped the Zoom client’s attack surface by scoring functions for dangerous operations such as buffer handling and allocations.
2. The agents pivoted from JNI entry points to protocol-level analysis of Zoom’s proprietary annotation feature.
3. The team dynamically traced the annotation code path with Frida and reverse-engineered the deserialization routines.
4. The AI-guided analysis surfaced memory corruption bugs in those routines, yielding CVE-2026-53413, CVE-2026-53414, and CVE-2026-53415.
5. A working cross-platform RCE was confirmed one day after the hunt began: identified 8 June 2026, working exploit 9 June, reported to Zoom 10 June.

Why it matters: The cost of exploit development against proprietary, closed-source protocols just collapsed from months of specialist reverse engineering to a day of AI-guided work, and that capability is symmetric: defenders and attackers get it at the same time. This is the dynamic FireCompass describes as the Great AI Divide, and it moves every fat-client protocol parser up the threat model.

What to do: Assume AI-assisted vulnerability discovery is already pointed at your externally exposed software, and shorten your own find-to-fix loop to match. Prioritise memory-safety hardening and fuzzing for any proprietary protocol parser you ship or expose, because obscurity was the only thing protecting most of them and a 20-prompt workflow just removed it. Track vendor bulletins weekly, since the window between disclosure and exploitation is now measured in days: SAP’s flaw this same week went from patch to honeypot hits in three.

CISA KEV additions, 10 to 16 Aug 2026

CISA added 3 vulnerabilities to the Known Exploited Vulnerabilities catalog this week, all on 11 August 2026, and none on any other day in the window.