The newest alert is with members right now
Sent 2026-09-08 to Senserva Watch members by email, covering CVE-2026-81963, CVE-2026-85880, CVE-2024-43451, CVE-2024-49039, CVE-2026-75650, CVE-2026-86218, KB5122878, KB5124008, KB5122880, KB5046615. It joins this log when the next alert goes out, so members read it first. Everything below is the full archive, free and with no sign-in.
One email address. No tenant connection, no agent, no call.
CVE-2026-82329CVE-2026-66384
CISA added CVE-2026-82329 to the Known Exploited Vulnerabilities catalog on 2026-09-02 and gave federal agencies until 2026-09-05 to remediate it. Three days again, and for the same reason: exploitation is confirmed in the wild, not predicted. JFrog shipped the patch on August 28. Attackers were on it by September 1.
The flaw is in JFrog Artifactory, the artifact repository that holds your binaries, containers, packages, and models. Senserva records a CVSS score of 9.8, the v3.1 base score from the National Vulnerability Database. No v4 score has been published. Earlier this week FIRST still had the 30 day exploitation probability under half a percent, which is the one signal here pointing the other way. While a predictive score is useful, the confirmed exploitation bumps up the priority.
Two things make it worse than a normal authentication bug. It is the default configuration that is vulnerable, so there is no misconfiguration to point at and no hardening step anyone skipped. Artifactory is a control plane, not an application. Administrative access there reaches repository configuration, the identities and tokens stored alongside it, and the distribution paths that feed your build and production systems.
What attackers actually did matters for your response. WatchTowr observed them minting administrator tokens, then enumerating users, groups, credential sets, and federated access relationships. In a smaller number of cases they created backdoor users. That is persistence that survives the patch, so make sure to audit as well after applying the update.
What to do this week. Upgrade self-hosted Artifactory to 7.161.20, 7.146.38, 7.133.29, 7.125.20, 7.117.28, or 7.111.21, whichever matches your branch. JFrog has already patched cloud instances, so this is a self-managed problem. Then assess, because patching alone does not close it: review the admin user list for accounts nobody created, audit access tokens and revoke ones you cannot account for, and rotate the credentials and integration secrets that Artifactory held. Check your CI/CD service accounts and any federated trust Artifactory brokers to other systems. If the upgrade has to wait for a change window, take the instance off any network path that does not need it.
Worth noting that this is the second Artifactory entry in KEV in a week. CVE-2026-66384 was added on August 27. If you are only tracking one, you are tracking half the problem.
The full record, with every change we have tracked since it was listed: https://senserva.com/cve/CVE-2026-82329.html
Everything CISA has added beyond Microsoft this month: https://senserva.com/non-microsoft-cve-tracker.html
Siemserva by Senserva now includes a browser-based Interactive UI. Download the latest release and work with your results in the browser: every missing patch ranked by real attacks, all 600+ security checks across Microsoft 365, Intune, Defender, and Entra ID, and full reports. Setup takes minutes, and your data stays local, in a results database only you hold.
The download is open to everyone, so pass it along: anyone can install Siemserva and explore the Interactive UI on the built-in demo data, no key needed.
As a Senserva Watch member, you get more. Your personalized key unlocks your Three Free Unlimited Audits of your own tenant: one to Find it, one to Fix it, one to Prove it. All users, all settings, all patches, all tenants, no time limit. Each audit includes the complete Senserva MCP server for Claude, so you can ask your own questions of the results. Included in this message is a reminder of your personalized key.
Direct downloads:
Windows (x64), signed executable: https://github.com/Senserva/Siemserva-Releases/releases/latest/download/siemserva-win-x64-signed.exe
Windows (x64), ZIP: https://github.com/Senserva/Siemserva-Releases/releases/latest/download/siemserva-win-x64-signed.zip
macOS (Apple Silicon): https://github.com/Senserva/Siemserva-Releases/releases/latest/download/siemserva-osx-arm64-signed.zip
Latest release: https://github.com/Senserva/Siemserva-Releases/releases/latest
Thank you for being part of Senserva Watch, The Senserva team
CVE-2026-8452CVE-2026-8451CVE-2026-19490
CISA added CVE-2026-8452 to the Known Exploited Vulnerabilities catalog on 2026-08-26 and gave federal agencies until 2026-08-29 to remediate it. Three days again, and the same reason as last time: exploitation is confirmed, not predicted.
The flaw is in Citrix NetScaler ADC and NetScaler Gateway, the appliances that terminate SSL VPN, ICA proxy, clientless VPN, and RDP proxy sessions at the edge. Senserva records a CVSS score of 8.8, the version 4 base score Citrix assigned in advisory CTX696604 on June 30. Credit for the original report goes to Michael Tucker of the JPMorgan Chase XOR team.
Read the vendor description carefully, because it is the weak point in this one. Citrix calls it a memory overflow leading to unpredictable or erroneous behavior and denial of service, and CISA's KEV entry repeats the denial of service framing. watchTowr Labs published the root cause and carried the same bug through to a webshell. Bishop Fox reproduced the memory corruption in a lab on a build the public proof of concept was not written for. Scoping your response to the vendor's wording would understate this.
The mechanism is worth one sentence because it explains the scoping. Before NetScaler verifies the signature on an inbound SAML message, it first rewrites the signed content into canonical form, and one attacker-supplied field in that step, the PrefixList, gets copied into a fixed-size buffer without a length check. The rewrite happens before any authentication, so a single unsigned POST from a stranger reaches the vulnerable code.
That means the unit of work is the virtual server, not the appliance. Citrix names Gateway and AAA virtual servers without mentioning SAML, but Bishop Fox found the vulnerable endpoints exist only where SAML is actually configured and a policy is attached. An appliance with three virtual servers can be vulnerable on one and unreachable on the other two. Standby HA nodes count, since an unpatched secondary is fully exposed the moment it takes over.
Senserva Watch leans Microsoft. This one is not, and it is in your inbox because exploitation is confirmed and the clock is three days.
What to do this week. Upgrade to at least 13.1-63.18 or 14.1-72.61, which are the minimum builds carrying the fix, and go past them to the latest on your branch. FIPS and NDcPP fleets run their own cadence: 14.1-72.61 FIPS, or 13.1-37.272 for 13.1-FIPS and 13.1-NDcPP. Nothing is coming for 12.1 or 13.0, so those need migration rather than patching. Inventory with "show ns runningConfig | grep -i saml" to find where SAML policies are actually bound, then confirm the installed build with "show ns version" on active and standby nodes both.
Then assess, because the patch does not tell you whether someone already came through. Look for unexpected files under /var/vpn/theme/, nsppe crashes in ns.log with pitboss reporting the process died, and fresh NSPPE-* core files under /var/core. One correction to the intuition here: a reboot does not distinguish a failed attempt from a successful one, so triage on what is in the file system.
While you have the inventory open, two siblings share the same exposure. CVE-2026-8451 is a memory disclosure bug in the same SAML feature and is also under active exploitation. CVE-2026-19490, from the August 19 bulletin, is a different bug that needs the same SAML configuration on current builds. One pass covers all three.
The full record, with every change we have tracked since it was listed: https://senserva.com/cve/CVE-2026-8452.html
Everything CISA has added beyond Microsoft this month: https://senserva.com/non-microsoft-cve-tracker.html
CVE-2026-55040
Microsoft SharePoint Server Security Feature Bypass Vulnerability (CVE-2026-55040) is the CVE to watch right now. The Microsoft SharePoint flaw is rated Critical with a CVSS score of 9.1. CISA added it to the Known Exploited Vulnerabilities catalog on 2026-08-18, which means it is being attacked in the wild, not just in theory. Rapid7 covered it on 2026-08-11: "Rapid7 Analysis: Microsoft SharePoint JWT Token Authentication Bypass (CVE-2026-55040)".
If it is in your environment, patch it now.
Details, affected versions, and remediation guidance: https://senserva.com/cve/CVE-2026-55040.html
CVE-2025-62593
CISA added CVE-2025-62593 to the Known Exploited Vulnerabilities catalog on 2026-08-17 and gave federal agencies until 2026-08-20 to remediate it. Three days is unusually short, and that is the part to read: exploitation is confirmed in the wild, not predicted.
The flaw is in Ray, the open source framework used to scale AI and machine learning workloads. Senserva records a CVSS score of 8.8, the version 3.1 base score from the National Vulnerability Database. The assigning authority also published a version 4 score of 9.4, so an advisory quoting the higher number is describing the same flaw on a newer rubric. FIRST puts the 30 day exploitation probability near 1 percent, which is the one signal here pointing the other way. When a confirmed exploitation source and a predictive score disagree, the confirmed source wins.
Senserva Watch leans Microsoft. This one is not, and it is in your inbox because exploitation is confirmed and the clock is three days.
Two things make it different from the usual Ray exposure story. It reaches Ray instances that were never exposed to the internet, by way of a developer's own browser, so firewall rules and network segmentation do not stop it. And the machines most at risk are workstations and laptops running Ray locally, not only clusters.
What to do this week. Upgrade Ray to 2.52.0 or later everywhere it runs, and inventory by package rather than by host role: pip and conda environments, container images, notebook kernels, continuous integration runners, and developer laptops. Turn on the token authentication that 2.52.0 introduced, because it ships off by default. Then assess: on any machine that ran an earlier version, review Ray job submission history for entries nobody recognizes, and rotate the credentials that were reachable from those environments. If the upgrade has to wait for a change window, separate the two halves of the attack and do not run Ray and a web browser on the same machine.
The full record, with every change we have tracked since it was listed: https://senserva.com/cve/CVE-2025-62593.html
Everything CISA has added beyond Microsoft this month: https://senserva.com/non-microsoft-cve-tracker.html
CVE-2026-58231CVE-2026-34480CVE-2026-5598
August 2026
SAP's August Patch Day carried 28 new security notes, one GitHub advisory and two updates to existing notes. One of them outranks the rest.
CVE-2026-58231, the Data Hub Adapter in SAP Commerce Cloud. CVSS 10.0, the highest the scale goes. Unauthenticated remote code execution: no credentials, no privileges, no administrator to trick into clicking anything. An attacker reaches the adapter over the network and runs code.
The fix is SAP Security Note 3771065. Affected versions are COM_CLOUD 2211 and 2211-JDK21.
THREE DAYS
SAP disclosed on August 11. On August 14, Defused reported the first exploitation attempts against its honeypots. No public proof of concept existed at that point, which points to patch diffing or exploit development straight from the advisory text.
Be precise about what that shows. Honeypot traffic means systems are trying the vulnerability. It does not mean a production SAP environment has been compromised. SAP had not classified the flaw as actively exploited at publication, and it was not in CISA's Known Exploited Vulnerabilities catalog. None of that is a reason to wait. Score of 10.0, no authentication required, vendor fix available, attack traffic observed by independent researchers. That is enough to act on.
THE EXPOSURE
Shadowserver counts more than 4,200 IP addresses carrying an SAP Commerce Cloud fingerprint, concentrated in Europe and North America. That is a footprint, not a vulnerability count. It includes patched hosts, duplicate observations, test systems and deployments that never expose the affected component.
What makes the position uncomfortable is where Data Hub sits. It stages and moves data between internet-facing commerce infrastructure and internal business applications: product records, pricing, inventory, customer information, back-office exchanges. A compromised adapter is not an isolated web service.
THE REST OF THE RELEASE
A 9.9 code injection flaw in SAP Manufacturing Integration and Intelligence. An updated 9.8 memory corruption note for NetWeaver Application Server ABAP. Two more Commerce Cloud items at 6.5: CVE-2026-34480, improper output encoding involving Apache Log4j Core in Commerce Cloud and Data Hub, and CVE-2026-5598, information disclosure tied to the Bouncy Castle Java library.
Onapsis put CVE-2026-58231 under SAP's HotNews priority and at the top of the month's remediation list.
THREE THINGS THIS WEEK
Determine whether the Data Hub Adapter is installed and reachable, apply Note 3771065, and finish the rebuild or redeploy the fix requires. Installing without redeploying is not patched. Include everything that is not production. Development, staging, disaster recovery and legacy environments run the same code with thinner monitoring and often broader network access. Patch, then assess. The update closes the door. It does not remove what was placed behind it beforehand. Pull logs for unauthenticated requests to Data Hub endpoints, unexpected child processes from the application runtime, new outbound connections, new or modified application packages, and changes to service accounts or authentication settings. Rotate any credentials the service can reach if the picture is unclear.
If patching has to wait on a change window, take the adapter off untrusted networks. Access controls, reverse proxies, WAF rules and segmentation buy time. They do not close the vulnerability.
WHERE THESE NUMBERS COME FROM
Severity scores and affected versions are SAP's own, from the August 2026 Security Patch Day release and the National Vulnerability Database entry. Exploitation attempts reported by Defused on August 14. Exposure count from the Shadowserver Foundation. Priority ranking from Onapsis's August Patch Day analysis.
Track it as revisions are made through the month: https://senserva.com/non-microsoft-cve-tracker.html
CVE-2026-58231CVE-2026-34480CVE-2026-5598
August 2026
SAP's August Patch Day carried 28 new security notes, one GitHub advisory and two updates to existing notes. One of them outranks the rest.
CVE-2026-58231, the Data Hub Adapter in SAP Commerce Cloud. CVSS 10.0, the highest the scale goes. Unauthenticated remote code execution: no credentials, no privileges, no administrator to trick into clicking anything. An attacker reaches the adapter over the network and runs code.
The fix is SAP Security Note 3771065. Affected versions are COM_CLOUD 2211 and 2211-JDK21.
THREE DAYS
SAP disclosed on August 11. On August 14, Defused reported the first exploitation attempts against its honeypots. No public proof of concept existed at that point, which points to patch diffing or exploit development straight from the advisory text.
Be precise about what that shows. Honeypot traffic means systems are trying the vulnerability. It does not mean a production SAP environment has been compromised. SAP had not classified the flaw as actively exploited at publication, and it was not in CISA's Known Exploited Vulnerabilities catalog. None of that is a reason to wait. Score of 10.0, no authentication required, vendor fix available, attack traffic observed by independent researchers. That is enough to act on.
THE EXPOSURE
Shadowserver counts more than 4,200 IP addresses carrying an SAP Commerce Cloud fingerprint, concentrated in Europe and North America. That is a footprint, not a vulnerability count. It includes patched hosts, duplicate observations, test systems and deployments that never expose the affected component.
What makes the position uncomfortable is where Data Hub sits. It stages and moves data between internet-facing commerce infrastructure and internal business applications: product records, pricing, inventory, customer information, back-office exchanges. A compromised adapter is not an isolated web service.
THE REST OF THE RELEASE
A 9.9 code injection flaw in SAP Manufacturing Integration and Intelligence. An updated 9.8 memory corruption note for NetWeaver Application Server ABAP. Two more Commerce Cloud items at 6.5: CVE-2026-34480, improper output encoding involving Apache Log4j Core in Commerce Cloud and Data Hub, and CVE-2026-5598, information disclosure tied to the Bouncy Castle Java library.
Onapsis put CVE-2026-58231 under SAP's HotNews priority and at the top of the month's remediation list.
THREE THINGS THIS WEEK
Determine whether the Data Hub Adapter is installed and reachable, apply Note 3771065, and finish the rebuild or redeploy the fix requires. Installing without redeploying is not patched. Include everything that is not production. Development, staging, disaster recovery and legacy environments run the same code with thinner monitoring and often broader network access. Patch, then assess. The update closes the door. It does not remove what was placed behind it beforehand. Pull logs for unauthenticated requests to Data Hub endpoints, unexpected child processes from the application runtime, new outbound connections, new or modified application packages, and changes to service accounts or authentication settings. Rotate any credentials the service can reach if the picture is unclear.
If patching has to wait on a change window, take the adapter off untrusted networks. Access controls, reverse proxies, WAF rules and segmentation buy time. They do not close the vulnerability.
WHERE THESE NUMBERS COME FROM
Severity scores and affected versions are SAP's own, from the August 2026 Security Patch Day release and the National Vulnerability Database entry. Exploitation attempts reported by Defused on August 14. Exposure count from the Shadowserver Foundation. Priority ranking from Onapsis's August Patch Day analysis.
Track it as revisions are made through the month: https://senserva.com/non-microsoft-cve-tracker.html
CVE-2026-58231CVE-2026-34480CVE-2026-5598
August 2026
SAP's August Patch Day carried 28 new security notes, one GitHub advisory and two updates to existing notes. One of them outranks the rest.
CVE-2026-58231, the Data Hub Adapter in SAP Commerce Cloud. CVSS 10.0, the highest the scale goes. Unauthenticated remote code execution: no credentials, no privileges, no administrator to trick into clicking anything. An attacker reaches the adapter over the network and runs code.
The fix is SAP Security Note 3771065. Affected versions are COM_CLOUD 2211 and 2211-JDK21.
THREE DAYS
SAP disclosed on August 11. On August 14, Defused reported the first exploitation attempts against its honeypots. No public proof of concept existed at that point, which points to patch diffing or exploit development straight from the advisory text.
Be precise about what that shows. Honeypot traffic means systems are trying the vulnerability. It does not mean a production SAP environment has been compromised. SAP had not classified the flaw as actively exploited at publication, and it was not in CISA's Known Exploited Vulnerabilities catalog. None of that is a reason to wait. Score of 10.0, no authentication required, vendor fix available, attack traffic observed by independent researchers. That is enough to act on.
THE EXPOSURE
Shadowserver counts more than 4,200 IP addresses carrying an SAP Commerce Cloud fingerprint, concentrated in Europe and North America. That is a footprint, not a vulnerability count. It includes patched hosts, duplicate observations, test systems and deployments that never expose the affected component.
What makes the position uncomfortable is where Data Hub sits. It stages and moves data between internet-facing commerce infrastructure and internal business applications: product records, pricing, inventory, customer information, back-office exchanges. A compromised adapter is not an isolated web service.
THE REST OF THE RELEASE
A 9.9 code injection flaw in SAP Manufacturing Integration and Intelligence. An updated 9.8 memory corruption note for NetWeaver Application Server ABAP. Two more Commerce Cloud items at 6.5: CVE-2026-34480, improper output encoding involving Apache Log4j Core in Commerce Cloud and Data Hub, and CVE-2026-5598, information disclosure tied to the Bouncy Castle Java library.
Onapsis put CVE-2026-58231 under SAP's HotNews priority and at the top of the month's remediation list.
THREE THINGS THIS WEEK
Determine whether the Data Hub Adapter is installed and reachable, apply Note 3771065, and finish the rebuild or redeploy the fix requires. Installing without redeploying is not patched. Include everything that is not production. Development, staging, disaster recovery and legacy environments run the same code with thinner monitoring and often broader network access. Patch, then assess. The update closes the door. It does not remove what was placed behind it beforehand. Pull logs for unauthenticated requests to Data Hub endpoints, unexpected child processes from the application runtime, new outbound connections, new or modified application packages, and changes to service accounts or authentication settings. Rotate any credentials the service can reach if the picture is unclear.
If patching has to wait on a change window, take the adapter off untrusted networks. Access controls, reverse proxies, WAF rules and segmentation buy time. They do not close the vulnerability.
WHERE THESE NUMBERS COME FROM
Severity scores and affected versions are SAP's own, from the August 2026 Security Patch Day release and the National Vulnerability Database entry. Exploitation attempts reported by Defused on August 14. Exposure count from the Shadowserver Foundation. Priority ranking from Onapsis's August Patch Day analysis.
Track it as revisions are made through the month: https://senserva.com/non-microsoft-cve-tracker.html
CVE-2026-58231CVE-2026-34480CVE-2026-5598
August 2026
SAP's August Patch Day carried 28 new security notes, one GitHub advisory and two updates to existing notes. One of them outranks the rest.
CVE-2026-58231, the Data Hub Adapter in SAP Commerce Cloud. CVSS 10.0, the highest the scale goes. Unauthenticated remote code execution: no credentials, no privileges, no administrator to trick into clicking anything. An attacker reaches the adapter over the network and runs code.
The fix is SAP Security Note 3771065. Affected versions are COM_CLOUD 2211 and 2211-JDK21.
THREE DAYS
SAP disclosed on August 11. On August 14, Defused reported the first exploitation attempts against its honeypots. No public proof of concept existed at that point, which points to patch diffing or exploit development straight from the advisory text.
Be precise about what that shows. Honeypot traffic means systems are trying the vulnerability. It does not mean a production SAP environment has been compromised. SAP had not classified the flaw as actively exploited at publication, and it was not in CISA's Known Exploited Vulnerabilities catalog. None of that is a reason to wait. Score of 10.0, no authentication required, vendor fix available, attack traffic observed by independent researchers. That is enough to act on.
THE EXPOSURE
Shadowserver counts more than 4,200 IP addresses carrying an SAP Commerce Cloud fingerprint, concentrated in Europe and North America. That is a footprint, not a vulnerability count. It includes patched hosts, duplicate observations, test systems and deployments that never expose the affected component.
What makes the position uncomfortable is where Data Hub sits. It stages and moves data between internet-facing commerce infrastructure and internal business applications: product records, pricing, inventory, customer information, back-office exchanges. A compromised adapter is not an isolated web service.
THE REST OF THE RELEASE
A 9.9 code injection flaw in SAP Manufacturing Integration and Intelligence. An updated 9.8 memory corruption note for NetWeaver Application Server ABAP. Two more Commerce Cloud items at 6.5: CVE-2026-34480, improper output encoding involving Apache Log4j Core in Commerce Cloud and Data Hub, and CVE-2026-5598, information disclosure tied to the Bouncy Castle Java library.
Onapsis put CVE-2026-58231 under SAP's HotNews priority and at the top of the month's remediation list.
THREE THINGS THIS WEEK
Determine whether the Data Hub Adapter is installed and reachable, apply Note 3771065, and finish the rebuild or redeploy the fix requires. Installing without redeploying is not patched. Include everything that is not production. Development, staging, disaster recovery and legacy environments run the same code with thinner monitoring and often broader network access. Patch, then assess. The update closes the door. It does not remove what was placed behind it beforehand. Pull logs for unauthenticated requests to Data Hub endpoints, unexpected child processes from the application runtime, new outbound connections, new or modified application packages, and changes to service accounts or authentication settings. Rotate any credentials the service can reach if the picture is unclear.
If patching has to wait on a change window, take the adapter off untrusted networks. Access controls, reverse proxies, WAF rules and segmentation buy time. They do not close the vulnerability.
WHERE THESE NUMBERS COME FROM
Severity scores and affected versions are SAP's own, from the August 2026 Security Patch Day release and the National Vulnerability Database entry. Exploitation attempts reported by Defused on August 14. Exposure count from the Shadowserver Foundation. Priority ranking from Onapsis's August Patch Day analysis.
Track it as revisions are made through the month: https://senserva.com/non-microsoft-cve-tracker.html
CVE-2026-58231CVE-2026-34480CVE-2026-5598
August 2026
SAP's August Patch Day carried 28 new security notes, one GitHub advisory and two updates to existing notes. One of them outranks the rest.
CVE-2026-58231, the Data Hub Adapter in SAP Commerce Cloud. CVSS 10.0, the highest the scale goes. Unauthenticated remote code execution: no credentials, no privileges, no administrator to trick into clicking anything. An attacker reaches the adapter over the network and runs code.
The fix is SAP Security Note 3771065. Affected versions are COM_CLOUD 2211 and 2211-JDK21.
THREE DAYS
SAP disclosed on August 11. On August 14, Defused reported the first exploitation attempts against its honeypots. No public proof of concept existed at that point, which points to patch diffing or exploit development straight from the advisory text.
Be precise about what that shows. Honeypot traffic means systems are trying the vulnerability. It does not mean a production SAP environment has been compromised. SAP had not classified the flaw as actively exploited at publication, and it was not in CISA's Known Exploited Vulnerabilities catalog. None of that is a reason to wait. Score of 10.0, no authentication required, vendor fix available, attack traffic observed by independent researchers. That is enough to act on.
THE EXPOSURE
Shadowserver counts more than 4,200 IP addresses carrying an SAP Commerce Cloud fingerprint, concentrated in Europe and North America. That is a footprint, not a vulnerability count. It includes patched hosts, duplicate observations, test systems and deployments that never expose the affected component.
What makes the position uncomfortable is where Data Hub sits. It stages and moves data between internet-facing commerce infrastructure and internal business applications: product records, pricing, inventory, customer information, back-office exchanges. A compromised adapter is not an isolated web service.
THE REST OF THE RELEASE
A 9.9 code injection flaw in SAP Manufacturing Integration and Intelligence. An updated 9.8 memory corruption note for NetWeaver Application Server ABAP. Two more Commerce Cloud items at 6.5: CVE-2026-34480, improper output encoding involving Apache Log4j Core in Commerce Cloud and Data Hub, and CVE-2026-5598, information disclosure tied to the Bouncy Castle Java library.
Onapsis put CVE-2026-58231 under SAP's HotNews priority and at the top of the month's remediation list.
THREE THINGS THIS WEEK
Determine whether the Data Hub Adapter is installed and reachable, apply Note 3771065, and finish the rebuild or redeploy the fix requires. Installing without redeploying is not patched. Include everything that is not production. Development, staging, disaster recovery and legacy environments run the same code with thinner monitoring and often broader network access. Patch, then assess. The update closes the door. It does not remove what was placed behind it beforehand. Pull logs for unauthenticated requests to Data Hub endpoints, unexpected child processes from the application runtime, new outbound connections, new or modified application packages, and changes to service accounts or authentication settings. Rotate any credentials the service can reach if the picture is unclear.
If patching has to wait on a change window, take the adapter off untrusted networks. Access controls, reverse proxies, WAF rules and segmentation buy time. They do not close the vulnerability.
WHERE THESE NUMBERS COME FROM
Severity scores and affected versions are SAP's own, from the August 2026 Security Patch Day release and the National Vulnerability Database entry. Exploitation attempts reported by Defused on August 14. Exposure count from the Shadowserver Foundation. Priority ranking from Onapsis's August Patch Day analysis.
Track it as revisions are made through the month: https://senserva.com/non-microsoft-cve-tracker.html
CVE-2026-58231CVE-2026-34480CVE-2026-5598
August 2026
SAP's August Patch Day carried 28 new security notes, one GitHub advisory and two updates to existing notes. One of them outranks the rest.
CVE-2026-58231, the Data Hub Adapter in SAP Commerce Cloud. CVSS 10.0, the highest the scale goes. Unauthenticated remote code execution: no credentials, no privileges, no administrator to trick into clicking anything. An attacker reaches the adapter over the network and runs code.
The fix is SAP Security Note 3771065. Affected versions are COM_CLOUD 2211 and 2211-JDK21.
THREE DAYS
SAP disclosed on August 11. On August 14, Defused reported the first exploitation attempts against its honeypots. No public proof of concept existed at that point, which points to patch diffing or exploit development straight from the advisory text.
Be precise about what that shows. Honeypot traffic means systems are trying the vulnerability. It does not mean a production SAP environment has been compromised. SAP had not classified the flaw as actively exploited at publication, and it was not in CISA's Known Exploited Vulnerabilities catalog. None of that is a reason to wait. Score of 10.0, no authentication required, vendor fix available, attack traffic observed by independent researchers. That is enough to act on.
THE EXPOSURE
Shadowserver counts more than 4,200 IP addresses carrying an SAP Commerce Cloud fingerprint, concentrated in Europe and North America. That is a footprint, not a vulnerability count. It includes patched hosts, duplicate observations, test systems and deployments that never expose the affected component.
What makes the position uncomfortable is where Data Hub sits. It stages and moves data between internet-facing commerce infrastructure and internal business applications: product records, pricing, inventory, customer information, back-office exchanges. A compromised adapter is not an isolated web service.
THE REST OF THE RELEASE
A 9.9 code injection flaw in SAP Manufacturing Integration and Intelligence. An updated 9.8 memory corruption note for NetWeaver Application Server ABAP. Two more Commerce Cloud items at 6.5: CVE-2026-34480, improper output encoding involving Apache Log4j Core in Commerce Cloud and Data Hub, and CVE-2026-5598, information disclosure tied to the Bouncy Castle Java library.
Onapsis put CVE-2026-58231 under SAP's HotNews priority and at the top of the month's remediation list.
THREE THINGS THIS WEEK
Determine whether the Data Hub Adapter is installed and reachable, apply Note 3771065, and finish the rebuild or redeploy the fix requires. Installing without redeploying is not patched. Include everything that is not production. Development, staging, disaster recovery and legacy environments run the same code with thinner monitoring and often broader network access. Patch, then assess. The update closes the door. It does not remove what was placed behind it beforehand. Pull logs for unauthenticated requests to Data Hub endpoints, unexpected child processes from the application runtime, new outbound connections, new or modified application packages, and changes to service accounts or authentication settings. Rotate any credentials the service can reach if the picture is unclear.
If patching has to wait on a change window, take the adapter off untrusted networks. Access controls, reverse proxies, WAF rules and segmentation buy time. They do not close the vulnerability.
WHERE THESE NUMBERS COME FROM
Severity scores and affected versions are SAP's own, from the August 2026 Security Patch Day release and the National Vulnerability Database entry. Exploitation attempts reported by Defused on August 14. Exposure count from the Shadowserver Foundation. Priority ranking from Onapsis's August Patch Day analysis.
Track it as revisions are made through the month: https://senserva.com/non-microsoft-cve-tracker.html
CVE-2026-58231CVE-2026-34480CVE-2026-5598
August 2026
SAP's August Patch Day carried 28 new security notes, one GitHub advisory and two updates to existing notes. One of them outranks the rest.
CVE-2026-58231, the Data Hub Adapter in SAP Commerce Cloud. CVSS 10.0, the highest the scale goes. Unauthenticated remote code execution: no credentials, no privileges, no administrator to trick into clicking anything. An attacker reaches the adapter over the network and runs code.
The fix is SAP Security Note 3771065. Affected versions are COM_CLOUD 2211 and 2211-JDK21.
THREE DAYS
SAP disclosed on August 11. On August 14, Defused reported the first exploitation attempts against its honeypots. No public proof of concept existed at that point, which points to patch diffing or exploit development straight from the advisory text.
Be precise about what that shows. Honeypot traffic means systems are trying the vulnerability. It does not mean a production SAP environment has been compromised. SAP had not classified the flaw as actively exploited at publication, and it was not in CISA's Known Exploited Vulnerabilities catalog. None of that is a reason to wait. Score of 10.0, no authentication required, vendor fix available, attack traffic observed by independent researchers. That is enough to act on.
THE EXPOSURE
Shadowserver counts more than 4,200 IP addresses carrying an SAP Commerce Cloud fingerprint, concentrated in Europe and North America. That is a footprint, not a vulnerability count. It includes patched hosts, duplicate observations, test systems and deployments that never expose the affected component.
What makes the position uncomfortable is where Data Hub sits. It stages and moves data between internet-facing commerce infrastructure and internal business applications: product records, pricing, inventory, customer information, back-office exchanges. A compromised adapter is not an isolated web service.
THE REST OF THE RELEASE
A 9.9 code injection flaw in SAP Manufacturing Integration and Intelligence. An updated 9.8 memory corruption note for NetWeaver Application Server ABAP. Two more Commerce Cloud items at 6.5: CVE-2026-34480, improper output encoding involving Apache Log4j Core in Commerce Cloud and Data Hub, and CVE-2026-5598, information disclosure tied to the Bouncy Castle Java library.
Onapsis put CVE-2026-58231 under SAP's HotNews priority and at the top of the month's remediation list.
THREE THINGS THIS WEEK
Determine whether the Data Hub Adapter is installed and reachable, apply Note 3771065, and finish the rebuild or redeploy the fix requires. Installing without redeploying is not patched. Include everything that is not production. Development, staging, disaster recovery and legacy environments run the same code with thinner monitoring and often broader network access. Patch, then assess. The update closes the door. It does not remove what was placed behind it beforehand. Pull logs for unauthenticated requests to Data Hub endpoints, unexpected child processes from the application runtime, new outbound connections, new or modified application packages, and changes to service accounts or authentication settings. Rotate any credentials the service can reach if the picture is unclear.
If patching has to wait on a change window, take the adapter off untrusted networks. Access controls, reverse proxies, WAF rules and segmentation buy time. They do not close the vulnerability.
WHERE THESE NUMBERS COME FROM
Severity scores and affected versions are SAP's own, from the August 2026 Security Patch Day release and the National Vulnerability Database entry. Exploitation attempts reported by Defused on August 14. Exposure count from the Shadowserver Foundation. Priority ranking from Onapsis's August Patch Day analysis.
Track it as revisions are made through the month: https://senserva.com/non-microsoft-cve-tracker.html
CVE-2026-58231CVE-2026-34480CVE-2026-5598
August 2026
SAP's August Patch Day carried 28 new security notes, one GitHub advisory and two updates to existing notes. One of them outranks the rest.
CVE-2026-58231, the Data Hub Adapter in SAP Commerce Cloud. CVSS 10.0, the highest the scale goes. Unauthenticated remote code execution: no credentials, no privileges, no administrator to trick into clicking anything. An attacker reaches the adapter over the network and runs code.
The fix is SAP Security Note 3771065. Affected versions are COM_CLOUD 2211 and 2211-JDK21.
THREE DAYS
SAP disclosed on August 11. On August 14, Defused reported the first exploitation attempts against its honeypots. No public proof of concept existed at that point, which points to patch diffing or exploit development straight from the advisory text.
Be precise about what that shows. Honeypot traffic means systems are trying the vulnerability. It does not mean a production SAP environment has been compromised. SAP had not classified the flaw as actively exploited at publication, and it was not in CISA's Known Exploited Vulnerabilities catalog. None of that is a reason to wait. Score of 10.0, no authentication required, vendor fix available, attack traffic observed by independent researchers. That is enough to act on.
THE EXPOSURE
Shadowserver counts more than 4,200 IP addresses carrying an SAP Commerce Cloud fingerprint, concentrated in Europe and North America. That is a footprint, not a vulnerability count. It includes patched hosts, duplicate observations, test systems and deployments that never expose the affected component.
What makes the position uncomfortable is where Data Hub sits. It stages and moves data between internet-facing commerce infrastructure and internal business applications: product records, pricing, inventory, customer information, back-office exchanges. A compromised adapter is not an isolated web service.
THE REST OF THE RELEASE
A 9.9 code injection flaw in SAP Manufacturing Integration and Intelligence. An updated 9.8 memory corruption note for NetWeaver Application Server ABAP. Two more Commerce Cloud items at 6.5: CVE-2026-34480, improper output encoding involving Apache Log4j Core in Commerce Cloud and Data Hub, and CVE-2026-5598, information disclosure tied to the Bouncy Castle Java library.
Onapsis put CVE-2026-58231 under SAP's HotNews priority and at the top of the month's remediation list.
THREE THINGS THIS WEEK
Determine whether the Data Hub Adapter is installed and reachable, apply Note 3771065, and finish the rebuild or redeploy the fix requires. Installing without redeploying is not patched. Include everything that is not production. Development, staging, disaster recovery and legacy environments run the same code with thinner monitoring and often broader network access. Patch, then assess. The update closes the door. It does not remove what was placed behind it beforehand. Pull logs for unauthenticated requests to Data Hub endpoints, unexpected child processes from the application runtime, new outbound connections, new or modified application packages, and changes to service accounts or authentication settings. Rotate any credentials the service can reach if the picture is unclear.
If patching has to wait on a change window, take the adapter off untrusted networks. Access controls, reverse proxies, WAF rules and segmentation buy time. They do not close the vulnerability.
WHERE THESE NUMBERS COME FROM
Severity scores and affected versions are SAP's own, from the August 2026 Security Patch Day release and the National Vulnerability Database entry. Exploitation attempts reported by Defused on August 14. Exposure count from the Shadowserver Foundation. Priority ranking from Onapsis's August Patch Day analysis.
Track it as revisions are made through the month: https://senserva.com/non-microsoft-cve-tracker.html
CVE-2026-58231CVE-2026-34480CVE-2026-5598
August 2026
SAP's August Patch Day carried 28 new security notes, one GitHub advisory and two updates to existing notes. One of them outranks the rest.
CVE-2026-58231, the Data Hub Adapter in SAP Commerce Cloud. CVSS 10.0, the highest the scale goes. Unauthenticated remote code execution: no credentials, no privileges, no administrator to trick into clicking anything. An attacker reaches the adapter over the network and runs code.
The fix is SAP Security Note 3771065. Affected versions are COM_CLOUD 2211 and 2211-JDK21.
THREE DAYS
SAP disclosed on August 11. On August 14, Defused reported the first exploitation attempts against its honeypots. No public proof of concept existed at that point, which points to patch diffing or exploit development straight from the advisory text.
Be precise about what that shows. Honeypot traffic means systems are trying the vulnerability. It does not mean a production SAP environment has been compromised. SAP had not classified the flaw as actively exploited at publication, and it was not in CISA's Known Exploited Vulnerabilities catalog. None of that is a reason to wait. Score of 10.0, no authentication required, vendor fix available, attack traffic observed by independent researchers. That is enough to act on.
THE EXPOSURE
Shadowserver counts more than 4,200 IP addresses carrying an SAP Commerce Cloud fingerprint, concentrated in Europe and North America. That is a footprint, not a vulnerability count. It includes patched hosts, duplicate observations, test systems and deployments that never expose the affected component.
What makes the position uncomfortable is where Data Hub sits. It stages and moves data between internet-facing commerce infrastructure and internal business applications: product records, pricing, inventory, customer information, back-office exchanges. A compromised adapter is not an isolated web service.
THE REST OF THE RELEASE
A 9.9 code injection flaw in SAP Manufacturing Integration and Intelligence. An updated 9.8 memory corruption note for NetWeaver Application Server ABAP. Two more Commerce Cloud items at 6.5: CVE-2026-34480, improper output encoding involving Apache Log4j Core in Commerce Cloud and Data Hub, and CVE-2026-5598, information disclosure tied to the Bouncy Castle Java library.
Onapsis put CVE-2026-58231 under SAP's HotNews priority and at the top of the month's remediation list.
THREE THINGS THIS WEEK
Determine whether the Data Hub Adapter is installed and reachable, apply Note 3771065, and finish the rebuild or redeploy the fix requires. Installing without redeploying is not patched. Include everything that is not production. Development, staging, disaster recovery and legacy environments run the same code with thinner monitoring and often broader network access. Patch, then assess. The update closes the door. It does not remove what was placed behind it beforehand. Pull logs for unauthenticated requests to Data Hub endpoints, unexpected child processes from the application runtime, new outbound connections, new or modified application packages, and changes to service accounts or authentication settings. Rotate any credentials the service can reach if the picture is unclear.
If patching has to wait on a change window, take the adapter off untrusted networks. Access controls, reverse proxies, WAF rules and segmentation buy time. They do not close the vulnerability.
WHERE THESE NUMBERS COME FROM
Severity scores and affected versions are SAP's own, from the August 2026 Security Patch Day release and the National Vulnerability Database entry. Exploitation attempts reported by Defused on August 14. Exposure count from the Shadowserver Foundation. Priority ranking from Onapsis's August Patch Day analysis.
Track it as revisions are made through the month: https://senserva.com/microsoft-patch-tracker.html
CVE-2026-58231CVE-2026-34480CVE-2026-5598
August 2026
SAP's August Patch Day carried 28 new security notes, one GitHub advisory and two updates to existing notes. One of them outranks the rest.
CVE-2026-58231, the Data Hub Adapter in SAP Commerce Cloud. CVSS 10.0, the highest the scale goes. Unauthenticated remote code execution: no credentials, no privileges, no administrator to trick into clicking anything. An attacker reaches the adapter over the network and runs code.
The fix is SAP Security Note 3771065. Affected versions are COM_CLOUD 2211 and 2211-JDK21.
THREE DAYS
SAP disclosed on August 11. On August 14, Defused reported the first exploitation attempts against its honeypots. No public proof of concept existed at that point, which points to patch diffing or exploit development straight from the advisory text.
Be precise about what that shows. Honeypot traffic means systems are trying the vulnerability. It does not mean a production SAP environment has been compromised. SAP had not classified the flaw as actively exploited at publication, and it was not in CISA's Known Exploited Vulnerabilities catalog. None of that is a reason to wait. Score of 10.0, no authentication required, vendor fix available, attack traffic observed by independent researchers. That is enough to act on.
THE EXPOSURE
Shadowserver counts more than 4,200 IP addresses carrying an SAP Commerce Cloud fingerprint, concentrated in Europe and North America. That is a footprint, not a vulnerability count. It includes patched hosts, duplicate observations, test systems and deployments that never expose the affected component.
What makes the position uncomfortable is where Data Hub sits. It stages and moves data between internet-facing commerce infrastructure and internal business applications: product records, pricing, inventory, customer information, back-office exchanges. A compromised adapter is not an isolated web service.
THE REST OF THE RELEASE
A 9.9 code injection flaw in SAP Manufacturing Integration and Intelligence. An updated 9.8 memory corruption note for NetWeaver Application Server ABAP. Two more Commerce Cloud items at 6.5: CVE-2026-34480, improper output encoding involving Apache Log4j Core in Commerce Cloud and Data Hub, and CVE-2026-5598, information disclosure tied to the Bouncy Castle Java library.
Onapsis put CVE-2026-58231 under SAP's HotNews priority and at the top of the month's remediation list.
THREE THINGS THIS WEEK
Determine whether the Data Hub Adapter is installed and reachable, apply Note 3771065, and finish the rebuild or redeploy the fix requires. Installing without redeploying is not patched. Include everything that is not production. Development, staging, disaster recovery and legacy environments run the same code with thinner monitoring and often broader network access. Patch, then assess. The update closes the door. It does not remove what was placed behind it beforehand. Pull logs for unauthenticated requests to Data Hub endpoints, unexpected child processes from the application runtime, new outbound connections, new or modified application packages, and changes to service accounts or authentication settings. Rotate any credentials the service can reach if the picture is unclear.
If patching has to wait on a change window, take the adapter off untrusted networks. Access controls, reverse proxies, WAF rules and segmentation buy time. They do not close the vulnerability.
WHERE THESE NUMBERS COME FROM
Severity scores and affected versions are SAP's own, from the August 2026 Security Patch Day release and the National Vulnerability Database entry. Exploitation attempts reported by Defused on August 14. Exposure count from the Shadowserver Foundation. Priority ranking from Onapsis's August Patch Day analysis.
Track it as revisions are made through the month: https://senserva.com/microsoft-patch-tracker.html
CVE-2026-58231CVE-2026-34480CVE-2026-5598
August 2026
SAP's August Patch Day carried 28 new security notes, one GitHub advisory and two updates to existing notes. One of them outranks the rest.
CVE-2026-58231, the Data Hub Adapter in SAP Commerce Cloud. CVSS 10.0, the highest the scale goes. Unauthenticated remote code execution: no credentials, no privileges, no administrator to trick into clicking anything. An attacker reaches the adapter over the network and runs code.
The fix is SAP Security Note 3771065. Affected versions are COM_CLOUD 2211 and 2211-JDK21.
THREE DAYS
SAP disclosed on August 11. On August 14, Defused reported the first exploitation attempts against its honeypots. No public proof of concept existed at that point, which points to patch diffing or exploit development straight from the advisory text.
Be precise about what that shows. Honeypot traffic means systems are trying the vulnerability. It does not mean a production SAP environment has been compromised. SAP had not classified the flaw as actively exploited at publication, and it was not in CISA's Known Exploited Vulnerabilities catalog. None of that is a reason to wait. Score of 10.0, no authentication required, vendor fix available, attack traffic observed by independent researchers. That is enough to act on.
THE EXPOSURE
Shadowserver counts more than 4,200 IP addresses carrying an SAP Commerce Cloud fingerprint, concentrated in Europe and North America. That is a footprint, not a vulnerability count. It includes patched hosts, duplicate observations, test systems and deployments that never expose the affected component.
What makes the position uncomfortable is where Data Hub sits. It stages and moves data between internet-facing commerce infrastructure and internal business applications: product records, pricing, inventory, customer information, back-office exchanges. A compromised adapter is not an isolated web service.
THE REST OF THE RELEASE
A 9.9 code injection flaw in SAP Manufacturing Integration and Intelligence. An updated 9.8 memory corruption note for NetWeaver Application Server ABAP. Two more Commerce Cloud items at 6.5: CVE-2026-34480, improper output encoding involving Apache Log4j Core in Commerce Cloud and Data Hub, and CVE-2026-5598, information disclosure tied to the Bouncy Castle Java library.
Onapsis put CVE-2026-58231 under SAP's HotNews priority and at the top of the month's remediation list.
THREE THINGS THIS WEEK
Determine whether the Data Hub Adapter is installed and reachable, apply Note 3771065, and finish the rebuild or redeploy the fix requires. Installing without redeploying is not patched. Include everything that is not production. Development, staging, disaster recovery and legacy environments run the same code with thinner monitoring and often broader network access. Patch, then assess. The update closes the door. It does not remove what was placed behind it beforehand. Pull logs for unauthenticated requests to Data Hub endpoints, unexpected child processes from the application runtime, new outbound connections, new or modified application packages, and changes to service accounts or authentication settings. Rotate any credentials the service can reach if the picture is unclear.
If patching has to wait on a change window, take the adapter off untrusted networks. Access controls, reverse proxies, WAF rules and segmentation buy time. They do not close the vulnerability.
WHERE THESE NUMBERS COME FROM
Severity scores and affected versions are SAP's own, from the August 2026 Security Patch Day release and the National Vulnerability Database entry. Exploitation attempts reported by Defused on August 14. Exposure count from the Shadowserver Foundation. Priority ranking from Onapsis's August Patch Day analysis.
Track it as revisions are made through the month: https://senserva.com/microsoft-patch-tracker.html
CVE-2026-58231CVE-2026-34480CVE-2026-5598
August 2026
SAP's August Patch Day carried 28 new security notes, one GitHub advisory and two updates to existing notes. One of them outranks the rest.
CVE-2026-58231, the Data Hub Adapter in SAP Commerce Cloud. CVSS 10.0, the highest the scale goes. Unauthenticated remote code execution: no credentials, no privileges, no administrator to trick into clicking anything. An attacker reaches the adapter over the network and runs code.
The fix is SAP Security Note 3771065. Affected versions are COM_CLOUD 2211 and 2211-JDK21.
THREE DAYS
SAP disclosed on August 11. On August 14, Defused reported the first exploitation attempts against its honeypots. No public proof of concept existed at that point, which points to patch diffing or exploit development straight from the advisory text.
Be precise about what that shows. Honeypot traffic means systems are trying the vulnerability. It does not mean a production SAP environment has been compromised. SAP had not classified the flaw as actively exploited at publication, and it was not in CISA's Known Exploited Vulnerabilities catalog. None of that is a reason to wait. Score of 10.0, no authentication required, vendor fix available, attack traffic observed by independent researchers. That is enough to act on.
THE EXPOSURE
Shadowserver counts more than 4,200 IP addresses carrying an SAP Commerce Cloud fingerprint, concentrated in Europe and North America. That is a footprint, not a vulnerability count. It includes patched hosts, duplicate observations, test systems and deployments that never expose the affected component.
What makes the position uncomfortable is where Data Hub sits. It stages and moves data between internet-facing commerce infrastructure and internal business applications: product records, pricing, inventory, customer information, back-office exchanges. A compromised adapter is not an isolated web service.
THE REST OF THE RELEASE
A 9.9 code injection flaw in SAP Manufacturing Integration and Intelligence. An updated 9.8 memory corruption note for NetWeaver Application Server ABAP. Two more Commerce Cloud items at 6.5: CVE-2026-34480, improper output encoding involving Apache Log4j Core in Commerce Cloud and Data Hub, and CVE-2026-5598, information disclosure tied to the Bouncy Castle Java library.
Onapsis put CVE-2026-58231 under SAP's HotNews priority and at the top of the month's remediation list.
THREE THINGS THIS WEEK
Determine whether the Data Hub Adapter is installed and reachable, apply Note 3771065, and finish the rebuild or redeploy the fix requires. Installing without redeploying is not patched. Include everything that is not production. Development, staging, disaster recovery and legacy environments run the same code with thinner monitoring and often broader network access. Patch, then assess. The update closes the door. It does not remove what was placed behind it beforehand. Pull logs for unauthenticated requests to Data Hub endpoints, unexpected child processes from the application runtime, new outbound connections, new or modified application packages, and changes to service accounts or authentication settings. Rotate any credentials the service can reach if the picture is unclear.
If patching has to wait on a change window, take the adapter off untrusted networks. Access controls, reverse proxies, WAF rules and segmentation buy time. They do not close the vulnerability.
WHERE THESE NUMBERS COME FROM
Severity scores and affected versions are SAP's own, from the August 2026 Security Patch Day release and the National Vulnerability Database entry. Exploitation attempts reported by Defused on August 14. Exposure count from the Shadowserver Foundation. Priority ranking from Onapsis's August Patch Day analysis.
Track it as revisions are made through the month: https://senserva.com/microsoft-patch-tracker.html
CVE-2026-68820
Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability (CVE-2026-68820) is the CVE to watch right now. The Microsoft Windows Ancillary Function Driver for WinSock flaw is rated High with a CVSS score of 7. CISA added it to the Known Exploited Vulnerabilities catalog on 2026-08-11, which means it is being attacked in the wild, not just in theory. BleepingComputer covered it on 2026-08-12: "Lazarus hackers exploited Windows zero-day to target defense firms". If it is in your environment, patch it now. Details, affected versions, and remediation guidance:
https://senserva.com/cve/CVE-2026-68820.html
CVE-2026-68820
Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability (CVE-2026-68820) is the CVE to watch right now. The Microsoft Windows Ancillary Function Driver for WinSock flaw is rated High with a CVSS score of 7. CISA added it to the Known Exploited Vulnerabilities catalog on 2026-08-11, which means it is being attacked in the wild, not just in theory. BleepingComputer covered it on 2026-08-12: "Lazarus hackers exploited Windows zero-day to target defense firms". If it is in your environment, patch it now. Details, affected versions, and remediation guidance:
https://senserva.com/cve/CVE-2026-68820.html
CVE-2026-68820
Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability (CVE-2026-68820) is the CVE to watch right now. The Microsoft Windows Ancillary Function Driver for WinSock flaw is rated High with a CVSS score of 7. CISA added it to the Known Exploited Vulnerabilities catalog on 2026-08-11, which means it is being attacked in the wild, not just in theory. BleepingComputer covered it on 2026-08-12: "Lazarus hackers exploited Windows zero-day to target defense firms". If it is in your environment, patch it now. Details, affected versions, and remediation guidance:
https://senserva.com/cve/CVE-2026-68820.html
CVE-2026-68820
Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability (CVE-2026-68820) is the CVE to watch right now. The Microsoft Windows Ancillary Function Driver for WinSock flaw is rated High with a CVSS score of 7. CISA added it to the Known Exploited Vulnerabilities catalog on 2026-08-11, which means it is being attacked in the wild, not just in theory. BleepingComputer covered it on 2026-08-12: "Lazarus hackers exploited Windows zero-day to target defense firms". If it is in your environment, patch it now. Details, affected versions, and remediation guidance:
https://senserva.com/cve/CVE-2026-68820.html
CVE-2026-68820
Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability (CVE-2026-68820) is the CVE to watch right now. The Microsoft Windows Ancillary Function Driver for WinSock flaw is rated High with a CVSS score of 7. CISA added it to the Known Exploited Vulnerabilities catalog on 2026-08-11, which means it is being attacked in the wild, not just in theory. BleepingComputer covered it on 2026-08-12: "Lazarus hackers exploited Windows zero-day to target defense firms". If it is in your environment, patch it now. Details, affected versions, and remediation guidance:
https://senserva.com/cve/CVE-2026-68820.html
CVE-2026-68820
Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability (CVE-2026-68820) is the CVE to watch right now. The Microsoft Windows Ancillary Function Driver for WinSock flaw is rated High with a CVSS score of 7. CISA added it to the Known Exploited Vulnerabilities catalog on 2026-08-11, which means it is being attacked in the wild, not just in theory. BleepingComputer covered it on 2026-08-12: "Lazarus hackers exploited Windows zero-day to target defense firms". If it is in your environment, patch it now. Details, affected versions, and remediation guidance:
https://senserva.com/cve/CVE-2026-68820.html
CVE-2026-68820
Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability (CVE-2026-68820) is the CVE to watch right now. The Microsoft Windows Ancillary Function Driver for WinSock flaw is rated High with a CVSS score of 7. CISA added it to the Known Exploited Vulnerabilities catalog on 2026-08-11, which means it is being attacked in the wild, not just in theory. BleepingComputer covered it on 2026-08-12: "Lazarus hackers exploited Windows zero-day to target defense firms". If it is in your environment, patch it now. Details, affected versions, and remediation guidance:
https://senserva.com/cve/CVE-2026-68820.html
CVE-2026-68820
Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability (CVE-2026-68820) is the CVE to watch right now. The Microsoft Windows Ancillary Function Driver for WinSock flaw is rated High with a CVSS score of 7. CISA added it to the Known Exploited Vulnerabilities catalog on 2026-08-11, which means it is being attacked in the wild, not just in theory. BleepingComputer covered it on 2026-08-12: "Lazarus hackers exploited Windows zero-day to target defense firms". If it is in your environment, patch it now. Details, affected versions, and remediation guidance:
https://senserva.com/cve/CVE-2026-68820.html
CVE-2026-68820
Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability (CVE-2026-68820) is the CVE to watch right now. The Microsoft Windows Ancillary Function Driver for WinSock flaw is rated High with a CVSS score of 7. CISA added it to the Known Exploited Vulnerabilities catalog on 2026-08-11, which means it is being attacked in the wild, not just in theory. BleepingComputer covered it on 2026-08-12: "Lazarus hackers exploited Windows zero-day to target defense firms". If it is in your environment, patch it now. Details, affected versions, and remediation guidance:
https://senserva.com/cve/CVE-2026-68820.html
CVE-2026-68820
Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability (CVE-2026-68820) is the CVE to watch right now. The Microsoft Windows Ancillary Function Driver for WinSock flaw is rated High with a CVSS score of 7. CISA added it to the Known Exploited Vulnerabilities catalog on 2026-08-11, which means it is being attacked in the wild, not just in theory. BleepingComputer covered it on 2026-08-12: "Lazarus hackers exploited Windows zero-day to target defense firms". If it is in your environment, patch it now. Details, affected versions, and remediation guidance:
https://senserva.com/cve/CVE-2026-68820.html
CVE-2026-68820
Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability (CVE-2026-68820) is the CVE to watch right now. The Microsoft Windows Ancillary Function Driver for WinSock flaw is rated Critical with a CVSS score of 9.8. CISA added it to the Known Exploited Vulnerabilities catalog on 2026-08-11, which means it is being attacked in the wild, not just in theory. BleepingComputer covered it on 2026-08-12: "Lazarus hackers exploited Windows zero-day to target defense firms". If it is in your environment, patch it now. Details, affected versions, and remediation guidance: https://senserva.com/cve/CVE-2026-68820.html
CVE-2026-68820
Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability (CVE-2026-68820) is the CVE to watch right now. The Microsoft Windows Ancillary Function Driver for WinSock flaw is rated Critical with a CVSS score of 9.8. CISA added it to the Known Exploited Vulnerabilities catalog on 2026-08-11, which means it is being attacked in the wild, not just in theory. BleepingComputer covered it on 2026-08-12: "Lazarus hackers exploited Windows zero-day to target defense firms". If it is in your environment, patch it now. Details, affected versions, and remediation guidance: https://senserva.com/cve/CVE-2026-68820.html
CVE-2026-68820
Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability (CVE-2026-68820) is the CVE to watch right now. The Microsoft Windows Ancillary Function Driver for WinSock flaw is rated Critical with a CVSS score of 9.8. CISA added it to the Known Exploited Vulnerabilities catalog on 2026-08-11, which means it is being attacked in the wild, not just in theory. BleepingComputer covered it on 2026-08-12: "Lazarus hackers exploited Windows zero-day to target defense firms". If it is in your environment, patch it now. Details, affected versions, and remediation guidance: https://senserva.com/cve/CVE-2026-68820.html
CVE-2026-68820
Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability (CVE-2026-68820) is the CVE to watch right now. The Microsoft Windows Ancillary Function Driver for WinSock flaw is rated Critical with a CVSS score of 9.8. CISA added it to the Known Exploited Vulnerabilities catalog on 2026-08-11, which means it is being attacked in the wild, not just in theory. BleepingComputer covered it on 2026-08-12: "Lazarus hackers exploited Windows zero-day to target defense firms". If it is in your environment, patch it now. Details, affected versions, and remediation guidance: https://senserva.com/cve/CVE-2026-68820.html
CVE-2026-68820
Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability (CVE-2026-68820) is the CVE to watch right now. The Microsoft Windows Ancillary Function Driver for WinSock flaw is rated Critical with a CVSS score of 9.8. CISA added it to the Known Exploited Vulnerabilities catalog on 2026-08-11, which means it is being attacked in the wild, not just in theory. BleepingComputer covered it on 2026-08-12: "Lazarus hackers exploited Windows zero-day to target defense firms". If it is in your environment, patch it now. Details, affected versions, and remediation guidance: https://senserva.com/cve/CVE-2026-68820.html
CVE-2026-68820
Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability (CVE-2026-68820) is the CVE to watch right now. The Microsoft Windows Ancillary Function Driver for WinSock flaw is rated Critical with a CVSS score of 9.8. CISA added it to the Known Exploited Vulnerabilities catalog on 2026-08-11, which means it is being attacked in the wild, not just in theory. BleepingComputer covered it on 2026-08-12: "Lazarus hackers exploited Windows zero-day to target defense firms". If it is in your environment, patch it now. Details, affected versions, and remediation guidance: https://senserva.com/cve/CVE-2026-68820.html
CVE-2026-68820
Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability (CVE-2026-68820) is the CVE to watch right now. The Microsoft Windows Ancillary Function Driver for WinSock flaw is rated Critical with a CVSS score of 9.8. CISA added it to the Known Exploited Vulnerabilities catalog on 2026-08-11, which means it is being attacked in the wild, not just in theory. Help Net Security covered it on 2026-08-12: "Microsoft patches 400+ vulnerabilities, one zero-day under attack (CVE-2026-68820)". If it is in your environment, patch it now. Details, affected versions, and remediation guidance: https://senserva.com/cve/CVE-2026-68820.html
CVE-2026-68820CVE-2026-62832CVE-2026-72971KB5120238KB5120242KB5120229KB5120249
August 2026
Microsoft shipped fixes for 751 vulnerabilities across 67 update articles.
One of them is already being exploited: CVE-2026-68820, the Windows Ancillary Function Driver for WinSock (AFD.sys). Elevation of privilege, CVSS 7.0, and Microsoft marks it Exploitation Detected. It does not get an attacker onto a machine; it takes an attacker who is already there and makes them administrator.
The fix ships in this month's cumulative updates. Depending on your build: KB5120238, KB5120242, KB5120229, KB5120249. Thirteen updates carry it in total, so if your build is not in that list, check the CVE page: https://senserva.com/cve/CVE-2026-68820.html
Every KB in this release, all 67, with what each one fixes: https://senserva.com/patch-tuesday.html
PUBLIC BEFORE THE PATCH
Two more were publicly disclosed before a fix existed. Neither is confirmed as being attacked, but the details were out while everyone was exposed.
CVE-2026-62832, Windows User Profile Service, elevation of privilege, CVSS 7.8. Microsoft rates it Exploitation More Likely, and it scores higher than the one under active attack. https://senserva.com/cve/CVE-2026-62832.html
CVE-2026-72971, Windows Container Isolation file system filter driver, tampering, CVSS 5.5. Narrower: mostly Windows container hosts. https://senserva.com/cve/CVE-2026-72971.html
THE SHAPE OF THE MONTH
108 of the 751 are rated Critical by Microsoft. The Severity split covers 743 of them (108 Critical, 396 Important, 207 Moderate, 32 Low); the remaining 8 carry no rating at all.
Worth noting where the Critical ones live. SharePoint Server, Teams and Azure SQL Managed Instance all appear, all elevation of privilege. Most patching routines have a rhythm for Windows and nothing like it for the collaboration and cloud services sitting alongside.
THREE THINGS THIS WEEK
1. The exploited one first: AFD.sys, this month's cumulative update, today.
2. The two public ones next. Public plus unpatched is how a proof of concept becomes a campaign.
3. Look past Windows. SharePoint, Teams and Azure SQL rarely share a maintenance window with the servers.
Every CVE and every KB above has its own page on senserva.com, with the affected products, the known issues in Microsoft's own words, and the change trail as Microsoft revises through the month.
Track it as Microsoft revises through the month: https://senserva.com/microsoft-patch-tracker.html
WHERE THESE NUMBERS COME FROM
Every figure above is Microsoft's own, from the Security Response Center's CVRF 2026-Aug release document, read directly on release day. Senserva tracks 347 of the 751 against update articles we hold pages for, and the difference is largely Azure Linux entries that ship no KB article, so you will see both numbers on the site, labeled.
CVE-2026-68820CVE-2026-62832CVE-2026-72971KB5120238KB5120242KB5120229KB5120249
August 2026, and the number that matters is not 751.
Microsoft shipped fixes for 751 vulnerabilities across 67 update articles. One of them is already being exploited.
START HERE CVE-2026-68820, the Windows Ancillary Function Driver for WinSock (AFD.sys). Elevation of privilege, CVSS 7.0, and Microsoft marks it Exploitation Detected. It does not get an attacker onto a machine; it takes an attacker who is already there and makes them administrator.
The fix ships in this month's cumulative updates. Depending on your build: KB5120238, KB5120242, KB5120229, KB5120249. Thirteen updates carry it in total, so if your build is not in that list, check the CVE page: https://senserva.com/cve/CVE-2026-68820.html
Every KB in this release, all 67, with what each one fixes: https://senserva.com/patch-tuesday.html
PUBLIC BEFORE THE PATCH Two more were publicly disclosed before a fix existed. Neither is confirmed as being attacked, but the details were out while everyone was exposed.
CVE-2026-62832, Windows User Profile Service, elevation of privilege, CVSS 7.8. Microsoft rates it Exploitation More Likely, and it scores higher than the one under active attack. https://senserva.com/cve/CVE-2026-62832.html
CVE-2026-72971, Windows Container Isolation file system filter driver, tampering, CVSS 5.5. Narrower: mostly Windows container hosts. https://senserva.com/cve/CVE-2026-72971.html
THE SHAPE OF THE MONTH 108 of the 751 are rated Critical by Microsoft. The Severity split covers 743 of them (108 Critical, 396 Important, 207 Moderate, 32 Low); the remaining 8 carry no rating at all.
Worth noting where the Critical ones live. SharePoint Server, Teams and Azure SQL Managed Instance all appear, all elevation of privilege. Most patching routines have a rhythm for Windows and nothing like it for the collaboration and cloud services sitting alongside.
THREE THINGS THIS WEEK 1. The exploited one first: AFD.sys, this month's cumulative update, today. 2. The two public ones next. Public plus unpatched is how a proof of concept becomes a campaign. 3. Look past Windows. SharePoint, Teams and Azure SQL rarely share a maintenance window with the servers.
Every CVE and every KB above has its own page on senserva.com, with the affected products, the known issues in Microsoft's own words, and the change trail as Microsoft revises through the month.
Track it as Microsoft revises through the month: https://senserva.com/microsoft-patch-tracker.html
Source: Microsoft Security Response Center, CVRF 2026-Aug, read on release day. Figures are Microsoft's own.
CVE-2026-8037
Progress LoadMaster Command Injection Vulnerability (CVE-2026-8037) is the CVE to watch right now. The Progress LoadMaster flaw is rated Critical with a CVSS score of 9.8. CISA added it to the Known Exploited Vulnerabilities catalog on 2026-08-07, which means it is being attacked in the wild, not just in theory. If it is in your environment, patch it now. Details, affected versions, and remediation guidance: https://senserva.com/cve/CVE-2026-8037.html