Top 5 Cybersecurity News Stories August 14, 2026
This week’s Cybersecurity News Stories August 14, 2026 arrives during a week when defenders discovered something uncomfortable: the tools and infrastructure they depend on to manage, monitor, and protect their environments were themselves the target. A nation-state rootkit disabled Windows security callbacks at the kernel level. A heating plant lost control of its steam turbine because its network segmentation existed only on paper. A maximum-severity flaw in an enterprise e-commerce platform required not a patch but a full rebuild. A business intelligence tool gave attackers a master key to every database in the organisation. And a security patch for an MSP management platform introduced a new bypass before the original vulnerability was even fully remediated. Five stories. Five different exposure layers. One pattern that practitioners need to sit with.
1) Lazarus Group Deploys FudModule Rootkit via Windows Kernel Zero-Day CVE-2026-68820
Microsoft’s August 2026 Patch Tuesday — 127 CVEs, 18 Critical — included a fix for CVE-2026-68820, a vulnerability in the Windows Sockets kernel driver (afd.sys) that Lazarus Group, the DPRK-attributed threat actor, had been exploiting in the wild since at least late July. This is the fourth afd.sys zero-day Lazarus has exploited in this ongoing series, following CVE-2023-28218, CVE-2024-38193, and CVE-2025-29824. CISA added CVE-2026-68820 to the Known Exploited Vulnerabilities catalogue on August 11, ahead of the patch release, indicating confirmed active exploitation.
The payload delivered via this exploit is FudModule rootkit version 3. FudModule operates by manipulating Windows kernel security callbacks — the hooks that endpoint detection and response (EDR) tools use to monitor system activity. Once deployed, it instructs the kernel to stop notifying security software of process creation, file system changes, and network events, effectively causing EDR products to go operationally blind without crashing or generating alerts. Alongside FudModule, researchers identified two new components: ForestTiger, a persistent backdoor communicating over encrypted channels, and a dropper named “Troy” that uses a weaponised PDF reader exploit to achieve initial execution. The delivery mechanism is Operation Dream Job, Lazarus’s long-running campaign in which the group impersonates defence sector recruiters to approach engineers at aerospace, defence, and dual-use technology firms — the lure arrives as a job description PDF, and the PDF reader exploit is embedded in the rendering engine.
Patch CVE-2026-68820 immediately as part of August 2026 Patch Tuesday. Prioritise environments running Windows Server without Hypervisor-Protected Code Integrity (HVCI) enabled — FudModule specifically targets the lack of HVCI enforcement to perform its kernel callback manipulation. Verify that Secure Boot is active, review kernel audit logs for afd.sys anomalies, and treat any inbound PDF files from recruitment-themed communications with elevated scrutiny. Organisations in the defence, aerospace, and dual-use technology sectors should brief their engineers on the Operation Dream Job lure pattern.
Lazarus Group exploited CVE-2026-68820 in the Windows afd.sys kernel driver to deploy FudModule rootkit v3, blinding EDR tools before delivering ForestTiger backdoor and the Troy dropper via Operation Dream Job.
Read more on: BleepingComputer
2) CERT Polska: Russia-Linked Attackers Pivot from Wind Farm to Heating Plant via Shared Private APN
On December 29, 2025, approximately 50,000 residents in a Polish city lost heating and hot water during winter. The cause was not a grid failure. CERT Polska disclosed on August 8, 2026 — after a three-month joint investigation with national security authorities — that Russia-linked attackers had breached a district heating plant by pivoting through a shared private APN (Access Point Name) from an adjacent wind farm operator on the same mobile carrier. The heating plant’s operators had no visibility into traffic arriving over the APN from the wind farm side. They had treated APN membership as a network trust boundary. It was not one.
A private APN is a mobile carrier segmentation mechanism that allows organisations to share a dedicated cellular data channel with agreed partners while keeping that traffic off the public internet. The implicit assumption — that other APN members cannot reach your devices — is only valid when the carrier enforces client isolation within the APN. In this case, no such isolation was configured. Once the attackers established a foothold at the wind farm operator, they could reach the heating plant’s SCADA and DCS systems directly over the shared APN without crossing any firewall or traversing the public internet. They disabled a steam turbine and disrupted water treatment controls. Recovery took approximately 14 hours. This is the first publicly documented case of a private APN being used as an OT lateral movement vector in a cyberattack.
CERT Polska disclosed a Russia-linked attack in which threat actors pivoted from a wind farm through a shared private APN with no client isolation into a district heating plant — disabling heating for 50,000 residents in December 2025.
Organisations using private APNs for M2M connectivity, SCADA communications, or OT telemetry should immediately audit whether their APN configuration enforces client isolation between all APN members. Carrier-level APN grouping is a routing convenience, not a security boundary. Apply firewall segmentation between APN clients as if each were an untrusted third-party network — because from an attack-path perspective, that is exactly what they are. Review all shared APN agreements and map which OT networks are reachable from each co-tenant.
Read more on: Help Net Security
3) SAP Commerce Cloud CVE-2026-58231: CVSS 10.0 — Rebuild Required, No Patch Sufficient
SAP’s August 2026 Security Patch Day brought a disclosure that will require more than an evening maintenance window to address: CVE-2026-58231, a CVSS 10.0 improper authorization vulnerability in the Data Hub Adapter import endpoint of SAP Commerce Cloud (formerly SAP Hybris). An unauthenticated remote attacker can send a crafted HTTP request to the import endpoint and execute arbitrary code on the server — no credentials, no user interaction, no exploit chain. The vulnerability exists because the Data Hub Adapter endpoint lacks authorization enforcement on import operations. SAP’s own advisory makes clear that a configuration-level patch is not available: the fix requires a full rebuild and redeploy of the Commerce Cloud instance to version 2211.55. Until that rebuild is complete, the interim mitigation is applying an IP Filter Set to restrict access to the Data Hub Adapter endpoint at the network perimeter.
The significance of this vulnerability extends beyond a single CVSS score. SAP Commerce Cloud powers e-commerce catalogues, pricing engines, customer portals, and B2B ordering systems for a substantial share of large-enterprise retail and manufacturing operations in Germany, Austria, and Switzerland. The Data Hub Adapter is a standard component used to import product data from ERP systems into the storefront — it is frequently internet-accessible in production environments to allow bulk data synchronisation. Onapsis Research and Pathlock, both specialising in SAP security, independently confirmed that the endpoint lacks any authentication mechanism in vulnerable versions and that the vulnerability is exploitable with a single HTTP POST request from the public internet.
CVE-2026-58231 is a CVSS 10.0 unauthenticated RCE in SAP Commerce Cloud’s Data Hub Adapter. The fix requires a full platform rebuild to version 2211.55 — a configuration patch is not sufficient.
This is the third SAP vulnerability at maximum or near-maximum severity in 2026, following the NetWeaver AS ABAP flaw in April and the SAP BusinessObjects BI vulnerability in June. The pattern suggests that SAP’s broad platform surface — spanning ERP, commerce, analytics, and middleware — will continue to attract concentrated attack attention. For affected organisations: apply the IP Filter Set to the Data Hub Adapter endpoint as an emergency compensating control, then treat the rebuild to version 2211.55 as a P1 change with a firm deadline rather than a planned maintenance item.
Read more on: SecurityWeek
4) Metabase CVE-2026-72898: Zero-Day to CISA KEV to Confirmed Victims in Eight Days
On August 3, threat actors began exploiting a previously unknown SQL injection vulnerability in Metabase’s password reset endpoint. The vulnerability — assigned CVE-2026-72898 and rated CVSS 10.0 — requires no authentication and allows an attacker to gain full administrative access to a Metabase instance with a single HTTP request. From the admin panel, the attacker can read or exfiltrate every database connected to the instance, modify or delete data, and extract all stored database credentials. Metabase published its advisory and patch on August 8. CISA added CVE-2026-72898 to the Known Exploited Vulnerabilities catalogue on August 11. On August 8 — the same day as the advisory — the workflow automation platform n8n confirmed it had been breached via an exposed Metabase instance, with 136 records compromised. Security researchers subsequently confirmed at least five additional organisations had been breached before the patch was available.
The specific risk of a Metabase compromise is often underestimated because Metabase is classified as a business intelligence tool rather than a database or an identity system. That classification is operationally incorrect. A Metabase instance holds database credentials for every data source connected to it for dashboarding — which, in a mature deployment, frequently includes the production database, the data warehouse, the analytics database, and customer-facing reporting systems. Compromising the Metabase admin account gives an attacker a complete, pre-authenticated credential map of the organisation’s data infrastructure without ever directly interacting with the underlying databases. The attack surface is also broader than most IT teams realise: Metabase is frequently deployed by individual teams and business units outside of central IT oversight, which means it may not appear in the organisation’s asset inventory and may not be subject to the same patching SLA as core infrastructure.
CVE-2026-72898 allowed unauthenticated attackers to gain admin access to Metabase instances — and from there, to every database connected to the platform. Zero-day exploitation began August 3; CISA KEV was added August 11.
The eight-day zero-day-to-KEV-to-confirmed-victims timeline is a governance signal about how BI and analytics tools are treated in most organisations’ patch processes. If your Metabase instance is not covered by your emergency patch SLA, that needs to change. Immediate actions for any organisation running Metabase: update to the patched version, rotate all database credentials configured in the instance regardless of whether a breach is confirmed, audit access logs from August 1 onwards, and conduct an asset inventory scan to identify any Metabase instances deployed outside central IT visibility.
Read more on: The Hacker News
5) N-able N-Central CVE-2026-18577: The Patch That Created a New Bypass
In July 2026, N-able released a patch for CVE-2026-18556, an authentication bypass in N-Central — their remote monitoring and management platform used by MSPs to manage endpoints across thousands of small and medium-sized business clients. Security researchers and attackers both reviewed the patch using a technique called patch diffing: comparing the patched and unpatched code to understand exactly which logic the fix was protecting. What they found is that the July patch hardened one authentication code path while leaving an equivalent secondary path in the same component unmodified. CVE-2026-18577 is the exploitation of that secondary path. Exploitation began August 1 — before N-able had issued any advisory. CISA added CVE-2026-18577 to the Known Exploited Vulnerabilities catalogue on August 3. Belgium’s Centre for Cybersecurity published an independent advisory on August 6.
The attack path, once authentication is bypassed, leads to N-Central’s built-in “Take Control” feature — a legitimate remote access capability that allows MSP technicians to take over managed endpoints. Attackers use Take Control to pivot directly to the downstream business clients whose systems the MSP manages. The attacker does not need to breach each client individually; one authentication bypass in the MSP’s management platform is enough to reach thousands of endpoints across the MSP’s entire client base. Organisations managed by an MSP running N-Central are downstream targets even if their own environments are fully up to date.
CVE-2026-18577 bypasses N-able’s own July patch for CVE-2026-18556, allowing attackers to pivot through N-Central’s Take Control feature to downstream MSP-managed business clients.
The structural lesson here is not simply that a new CVE needs to be patched. It is that organisations which deployed the July patch, ran a vulnerability scan, confirmed remediation, and closed the ticket are now in a false-secure state. MSPs running N-Central should apply the August patch immediately, review Take Control session logs from August 1, identify which client endpoints were reachable during the exposure window, and notify affected clients. SMEs managed by an MSP should proactively ask which version of N-Central their provider is running and when the August patch will be applied — and document the response. Under NIS2, managed service providers are in scope as essential and important entities, and downstream incident notification obligations apply.
Read more on: BleepingComputer
If Cybersecurity News Stories August 14, 2026 Has One Lesson, It’s This:
The infrastructure you depend on to run, monitor, and protect your environment is not neutral ground. This week, Lazarus Group used a Windows kernel driver to blind the security tools watching for exactly that kind of attack. A private mobile network channel — chosen specifically to keep OT traffic off the public internet — became the route into a district heating plant. A maximum-severity vulnerability in an enterprise e-commerce platform requires not a patch file but a complete platform rebuild before the fix takes effect. A business intelligence tool carried the credentials of every database in an organisation, and an unauthenticated attacker needed one HTTP request to collect them. And a remote monitoring platform deployed by thousands of MSPs to manage their clients’ security delivered a bypass for its own incomplete patch, before the advisory was even published.
What these five stories have in common is not a category of attack or a class of vulnerability — it is that each one exploited a trust assumption embedded in infrastructure that organisations treat as being on their side. The kernel is trusted. The private APN is trusted. The vendor patch is trusted. The BI tool is trusted. The MSP platform is trusted. Adversaries — from DPRK-attributed nation-state groups to financially motivated actors — are systematically mapping those trust assumptions and finding that they hold. The defensive question this week is not whether you have patched these specific CVEs, though you should. It is whether you know which assumptions in your infrastructure are load-bearing — and whether any of them have been tested recently.
For more information, please contact us now!
