Skip to dossier
←fruition.net
just verified
The Perimeter · Issue 08-21-2026

KEV surge: VMware, Cisco ASA, Metabase, TeamCity, N-central all under active exploit

This week's KEV additions are unusually heavy on infrastructure that sits in front of production: Cisco ASA/FTD, VMware vCenter, JetBrains TeamCity, Metabase, and Progress LoadMaster all moved from advisory to observed exploitation. Patch Tuesday added ~400 Microsoft fixes including an in-the-wild WinSock EoP. Meanwhile the WordPress ecosystem took two direct hits — a 40k-install auth bypass in User Profile Builder and a supply-chain compromise across BdThemes plugins delivered via a poisoned update API. On the research side, PortSwigger dropped a full CRLF-powered desync class of attacks worth reading if you operate anything behind a shared front-end or CDN. Supply-chain-wise, npm continues to be weaponized: Unit 42's ChainDrop worm and Sonatype's Ethereum-lookup packages both point at attackers using on-chain infrastructure to survive takedowns. Recalculate this week: which of your edge appliances, CI runners, and CMS plugin vendors would you notice compromise on within 24 hours?
Published
Friday, August 21, 2026
Entries
12
Cadence
Weekly · Sundays
Curator
Brad Anderson
Wire
cisa.govNew addition to the Known Exploited Vulnerabilities catalog·
github.comGHSA: critical npm package compromise affecting CI pipelines·
wordfence.comWordPress plugin vulnerability with active exploitation·
drupal.orgHighly critical core security advisory published·
aws.amazon.comAWS security bulletin: IAM policy evaluation update·
unit42.paloaltonetworks.comThreat actor expands toolkit targeting public-facing PHP apps·
krebsonsecurity.comBreach disclosure with named victim and confirmed initial vector·
snyk.ioComposer dependency advisory affecting production framework versions·
cisa.govNew addition to the Known Exploited Vulnerabilities catalog·
github.comGHSA: critical npm package compromise affecting CI pipelines·
wordfence.comWordPress plugin vulnerability with active exploitation·
drupal.orgHighly critical core security advisory published·
aws.amazon.comAWS security bulletin: IAM policy evaluation update·
unit42.paloaltonetworks.comThreat actor expands toolkit targeting public-facing PHP apps·
krebsonsecurity.comBreach disclosure with named victim and confirmed initial vector·
snyk.ioComposer dependency advisory affecting production framework versions·
01

Web Application

frameworks · browsers · authentication flows

portswigger.net1w
▲ headline

PortSwigger: CRLF-Powered Desync Attacks beheading HTTP streams

James Kettle's new PortSwigger paper reframes HTTP header injection as a full desync primitive rather than a mere open-redirect/XSS bug. The techniques target front-end/back-end parsing disagreements and are demonstrated against live production stacks — implicating anyone running CDN + origin, ingress-nginx + upstream, or shared reverse proxies.

HTTP proxiesCDNsingress-nginxvarnish
Fruition take

This is a re-baseline moment for anyone running varnish or ingress-nginx in front of PHP/Node origins. Review any code paths that copy user input into response headers, and test your fronting layer with the paper's payloads before someone else does.

02

Supply Chain

packages · build systems · dependency attacks

unit42.paloaltonetworks.com1w

ChainDrop npm worm exfiltrates GitHub Actions secrets via Ethereum C2

Unit 42 analyzed ChainDrop, a self-propagating npm supply-chain worm that harvests GitHub Actions runner secrets and uses Ethereum smart contracts as a C2 routing layer to resist takedown. Sonatype separately identified six npm packages using the same Ethereum-wallet lookup technique tied to the DPRK Contagious Interview campaign.

npmGitHub Actions
Fruition take

Audit GitHub Actions workflows for third-party actions and unpinned npm installs in build steps. Rotate any secret that a compromised runner could have read in the last 30 days if you can't rule out exposure.

03

Infrastructure

kubernetes · cloud · network · ingress

github.com2d

Argo Workflows: ArtifactGC.PodSpecPatch bypasses Strict/Secure allow-list (incomplete fix)

CVE-2026-54526 is an incomplete-fix follow-up to CVE-2026-31892. Argo Workflows' allow-list sanitizer only walks top-level WorkflowSpec fields, so `ArtifactGC.PodSpecPatch` — nested inside an allow-listed field — flows unmodified into the artifact-GC pod. A user submitting a Workflow under `templateReferencing: Strict` or `Secure` can still inject arbitrary pod-spec patches, defeating the guardrail administrators think they have.

CVE-2026-54526CVE-2026-31892Argo Workflows
Fruition take

If Argo Workflows is running in a shared or multi-tenant cluster and you rely on Strict/Secure template referencing as a security boundary, upgrade now and re-verify that any tenant Workflow cannot mount host paths or change service accounts through ArtifactGC.

github.com3dCVSS 9.3

SeaweedFS: cross-bucket path traversal and unauth SSRF with metadata read-back

Two SeaweedFS advisories landed together: CVE-2026-54917 lets an authenticated S3/Iceberg client escape bucket isolation via `..` segments because the routers set `SkipClean(true)`, and CVE-2026-73080 (CVSS 9.3) lets any unauthenticated peer that can reach a volume server's gRPC port coerce it into fetching arbitrary URLs — including cloud metadata endpoints — and read the response back. JWT signing does not close the SSRF.

CVE-2026-54917CVE-2026-73080SeaweedFS
Fruition take

If SeaweedFS is anywhere in a client stack, upgrade to 4.24 and put the volume-server gRPC port behind mTLS or a NetworkPolicy today. Assume any IMDS creds reachable from those pods are already burned.

04

PHP & CMS

wordpress · drupal · plugins · php frameworks

wordfence.com1d

User Profile Builder auth bypass gives admin takeover on 40k WordPress sites

Wordfence disclosed an authentication bypass in User Profile Builder (40,000+ active installs) allowing unauthenticated attackers to log in as user ID 1 — typically the site admin — for full takeover. Exploitation requires the plugin's "Automatically Log In" setting to be enabled, which is a common configuration for registration flows.

User Profile Builder (WordPress plugin)
Fruition take

Check WordPress plugin inventories for User Profile Builder and confirm the auto-login setting. If it's on, patch immediately and audit user roles for unexpected admins.

github.com2dCVSS 8.5

Pimcore: SQL injection via ClassDefinition UID (incomplete fix from earlier CVE)

CVE-2026-55072 (CVSS 8.5) is a Pimcore SQL injection reachable by any authenticated user with the `objects` permission. A missing end anchor in the ClassDefinition UID regex lets an attacker embed SQL in the UID; Block.php later concatenates the raw classId into a query with no quoting. This is an incomplete-fix regression from commit dbe1d131e4.

CVE-2026-55072Pimcore
Fruition take

For clients on Pimcore, patch immediately and audit the `objects` permission — it's often granted more liberally than intended in editorial workflows.

wordfence.comthis week

BdThemes WordPress plugins compromised via poisoned update API

Wordfence disclosed a supply-chain compromise affecting the BdThemes plugin ecosystem, delivered through a poisoned response from the vendor's own API. All affected plugins have been temporarily closed in the WordPress.org directory pending investigation. Sites running BdThemes plugins may have received malicious code through a normal update flow.

BdThemes pluginsWordPress
Fruition take

If any managed WordPress sites run BdThemes plugins (Element Pack, Prime Slider, Ultimate Post Kit, etc.), pull them now and diff against the last known-good version. This is exactly the update-channel-trust failure mode our clients pay us to catch.

05

Identity & Auth

oauth · saml · iam · session attacks

unit42.paloaltonetworks.com1w

Unit 42: passkey implementations silently downgrading to single-factor

Unit 42 documents a passkey attack surface where relying parties fail to validate the User Verified (UV) flag in WebAuthn assertions, allowing an authenticator to present a passkey without the local biometric/PIN check actually happening. The result: what looks like passwordless MFA is effectively single-factor possession of the device key.

WebAuthnPasskeys
Fruition take

If you own an Auth0 or WebAuthn implementation, confirm your verification policy requires `userVerification: required` and that server-side assertion validation rejects UV=false. Log and alert on any assertion where UV is not set.

06

Threat Intel

active exploitation · breaches · ransomware

darkreading.com2d
▲ headline

VMware vCenter CVE-2026-59310 under active global exploitation

A critical vCenter flaw (CVE-2026-59310) is being exploited in a global campaign that began earlier this month. Reporting indicates patching alone may not fully evict attackers who have already landed, implying post-exploitation persistence needs to be hunted rather than assumed cleared by the update.

CVE-2026-59310VMware vCenter
Fruition take

Patch vCenter this week and treat it as an incident, not a maintenance window — pull vpxd logs, review SSO/identity-source changes, and audit new service accounts created since early August.

nvd.nist.govthis weekKEV
▲ headline

CISA KEV: Cisco ASA/FTD, Metabase, TeamCity, N-central, LoadMaster all added

CISA added a cluster of infrastructure CVEs to KEV: Cisco ASA/FTD heap flaw CVE-2026-20349 (unauth DoS), Metabase pre-auth SQLi CVE-2026-72898 (admin takeover + connected-DB credential theft), TeamCity deserialization CVE-2026-63077 (unauth RCE via agent polling), N-able N-central auth bypass CVE-2026-18556/18577, and Progress LoadMaster command injection CVE-2026-8037. Windows AFD.sys use-after-free CVE-2026-68820 is also listed as exploited.

CVE-2026-20349CVE-2026-72898CVE-2026-63077+4 moreCisco Secure Firewall ASA/FTDMetabaseJetBrains TeamCityN-able N-central
Fruition take

Inventory Metabase and TeamCity exposure first — both are commonly reachable from the internet in dev/BI stacks and both give an attacker credentials to everything downstream. Patch by Friday.

darkreading.com3d

"City-Forum" data-theft campaign hitting Salesforce and ServiceNow tenants

A long-running campaign active since at least March 2025 is targeting Salesforce and ServiceNow customers across multiple sectors using custom tooling for bulk data extraction. The pattern is credential- and OAuth-integration abuse against SaaS tenants rather than exploiting the platforms themselves.

SalesforceServiceNow
Fruition take

Review connected apps and OAuth-integration inventories in both Salesforce and ServiceNow. Alert on bulk-export API usage and any new integration user created in the last 6 months.

krebsonsecurity.comthis weekKEVCVSS 9.8

Microsoft August Patch Tuesday: ~400 CVEs, WinSock zero-day exploited

Microsoft shipped fixes for roughly 398 vulnerabilities, including the actively-exploited AFD.sys WinSock use-after-free (CVE-2026-68820) added to CISA KEV, and CVE-2026-62878, an unauthenticated CVSS 9.8 RCE in Windows DNS Server. Two other issues were publicly detailed prior to patch.

CVE-2026-68820CVE-2026-62878WindowsWindows DNS ServerAFD.sys
Fruition take

Windows DNS Server fix is the one to sequence first for any internal AD-integrated resolvers — no user interaction, network-reachable. AFD.sys is a local EoP so prioritize on jump hosts and dev endpoints.