Vulnerabilities & Patches
CVE-2026-68820 WinSock Zero-Day: Lazarus Deploys Rootkit
The CVE-2026-68820 WinSock zero-day was already being used by North Korea’s Lazarus Group to plant a kernel-mode rootkit weeks before Microsoft shipped a fix in its August 2026 Patch Tuesday. Any Windows endpoint that processes network sockets — which is to say, essentially every Windows machine on your network — was exposed until this month’s…
Read MoreMetabase CVSS 10 SQL Injection Zero-Day Hits Admin Access
The Metabase CVSS 10 SQL injection zero-day lets an unauthenticated attacker turn a self-hosted analytics dashboard into a master key for every database it touches. Active exploitation began August 3, 2026, and two named victims — Framework and Tally — have already confirmed customer data theft. If your organization runs Metabase for internal reporting, this…
Read MoreTeamCity CVE-2026-63077 RCE: Unauthenticated CI/CD Takeover
TeamCity CVE-2026-63077 RCE lets an unauthenticated attacker send a single crafted request to a TeamCity On-Premises server and execute operating system commands — no login, no valid session, no user interaction. CISA added it to the Known Exploited Vulnerabilities catalog on August 5 with a three-day remediation deadline, and exploitation is now active in the…
Read MoreN-central CVE-2026-18577 Auth Bypass — CISA 3-Day Deadline
N-central CVE-2026-18577 auth bypass is being actively exploited to seize administrative control of N-able N-central servers — a remote monitoring and management (RMM) platform managed service providers (MSPs) use to run client networks. CISA gave federal civilian agencies just three days to patch, with the deadline landing August 6, 2026. What Happened N-able disclosed that…
Read MoreCisco Secure FMC CVE-2026-20316 Exploited
Cisco Secure FMC CVE-2026-20316 is under confirmed active exploitation: a hardcoded, low-privilege account built into every on-premises Secure Firewall Management Center gives an unauthenticated attacker a foothold — and in the same advisory cycle, Cisco quietly reactivated a five-month-old, maximum-severity root-level bypass in the same product, sharing an identical indicator of compromise. CISA added the…
Read More