Other Conventional Threats

Picus Labs' Blue Report 2026 analyzed over 338 million attack simulations across production environments in H1 2026, finding that while perimeter/edge defenses have improved significantly, internal detection and containment capabilities have deteriorated. Attackers are increasingly succeeding not through loud, high-signature attacks but through low-noise techniques that evade internal detection once initial defenses are bypassed.

Updated Aug 14, 2026

Ukrainian authorities dismantled 94 fraudulent call centers that were running investment scams and attempting to gain unauthorized access to victims' bank accounts. Millions in cash were seized during the coordinated operation, representing a significant disruption to organized fraud networks operating in the region.

Updated Aug 14, 2026

A denial-of-service vulnerability (CVE-2026-59693) affects Siemens Desigo DXR and PXC building automation controllers. An attacker with adjacent network access can send a malformed BACnet packet to cause the device to stop responding, requiring a manual reset or reboot to restore functionality. Siemens has released firmware updates to remediate the issue.

Updated Aug 14, 2026 · CVSS 4.3

Siemens License Server (SLS) versions prior to 5.1 and 5.3 are affected by two vulnerabilities: an insecure sudoers policy enabling local privilege escalation to root, and a path traversal flaw allowing remote unauthenticated attackers to read arbitrary files. Siemens has released patched versions and CISA has published an advisory recommending immediate updates.

Updated Aug 14, 2026 · CVSS 7.5

Siemens Parasolid, a 3D geometric modeling kernel used in CAD/CAM/CAE software across critical manufacturing, contains an out-of-bounds read vulnerability (CVE-2026-64629) triggered when parsing malformed X_T files. Successful exploitation could crash the application or allow arbitrary code execution in the context of the current process. Siemens has released patched versions (V38.0.235 and V38.1.230) and users are advised to update.

Updated Aug 14, 2026 · CVSS 7.8

A critical vulnerability in IBM i affects versions 7.3 through 7.6, allowing a remote authenticated attacker to escalate privileges through improper authorization checks on high-authority threads. With a CVSS score of 9.6, this flaw could enable an attacker with low-level access to gain full administrative control over the system.

Updated Aug 14, 2026 · CVSS 9.6

A critical vulnerability in IBM i versions 7.3 through 7.6 allows a remote authenticated attacker to execute arbitrary code by exploiting an uncontrolled search path element. With a CVSS score of 9.9, this flaw could enable low-privileged users to escalate to full system compromise on affected IBM Power Systems servers.

Updated Aug 14, 2026 · CVSS 9.9

Researchers disclosed a flaw in how OpenAI, Anthropic, and Google encode and carry hidden chain-of-thought reasoning between API calls, allowing encrypted reasoning objects from one session to be replayed into another session. This cross-session replay allowed weaker models to decode or expose internal reasoning content from stronger models, including sensitive data such as API keys and passwords captured in session logs.

Updated Aug 13, 2026

A campaign dubbed 'City-Forum' is using custom tooling to systematically harvest data exposed to anonymous/unauthenticated users through misconfigured Salesforce Experience Cloud sites and ServiceNow customer portals. The attackers exploit overly permissive guest-user access controls rather than a software vulnerability, allowing bulk extraction of sensitive records without authentication.

Updated Aug 13, 2026

A critical flaw (CVE-2026-73268, CVSS 9.9) in the cluster-curator-controller component of multicluster engine (MCE) allows tenants with limited ClusterCurator permissions to inject arbitrary Job specifications that execute with the controller's elevated privileges. Successful exploitation enables arbitrary code execution, privilege escalation, and access to cluster-wide secrets, posing severe risk to multi-tenant Kubernetes/OpenShift environments.

Updated Aug 13, 2026 · CVSS 9.9

A critical flaw in the multicloud-operators-subscription component of Red Hat Advanced Cluster Management (RHACM) allows a low-privileged namespace-admin tenant to abuse a highly privileged ServiceAccount via Subscription Custom Resources. This confused-deputy attack enables deployment of arbitrary cluster-scoped resources, leading to full privilege escalation and potential arbitrary code execution across the entire managed cluster.

Updated Aug 13, 2026 · CVSS 9.9

A critical buffer overflow vulnerability exists in the PROFINET service of an industrial device in its default configuration, allowing unauthenticated remote attackers to crash the device or execute arbitrary code. With a CVSS score of 9.8, this flaw poses severe risk to industrial control system (ICS) and operational technology (OT) environments where the affected device is deployed.

Updated Aug 13, 2026 · CVSS 9.8

A critical Incorrect Authorization vulnerability in Adobe Campaign Classic (ACC) allows an unauthenticated attacker to execute arbitrary code in the context of the current user without any user interaction required. The maximum CVSS score of 10.0 and changed scope indicate the flaw can escalate impact beyond the vulnerable component itself, making this a top-priority patching target for any organization running ACC.

Updated Aug 13, 2026 · CVSS 10

Google announced that Chrome's anti-abuse systems are now blocking over 7 billion unwanted push notifications per day on Android as of Q1 2026. This is a defensive product improvement rather than an active threat, reflecting Google's ongoing efforts to curb notification spam and deceptive web push abuse.

Updated Aug 12, 2026

CISA disclosed eight vulnerabilities in the Mira Hormone Monitor firmware and companion Mira Android App, including missing BLE authentication, hard-coded credentials, and a broken login endpoint that returns valid session tokens for any password. Successful exploitation could allow attackers to hijack user accounts, exfiltrate or forge sensitive reproductive health data, track users physically via BLE, and cause denial-of-service on the device.

Updated Aug 12, 2026 · CVSS 9.8

CISA added three actively exploited vulnerabilities to its Known Exploited Vulnerabilities Catalog: a heap inspection flaw in Cisco Secure Firewall ASA/FTD, a use-after-free in the Windows Ancillary Function Driver for WinSock, and a SQL injection vulnerability in Metabase. Federal agencies are required under BOD 26-04 to remediate these on a prioritized timeline, and all organizations are strongly encouraged to patch given confirmed in-the-wild exploitation.

Updated Aug 12, 2026

The Pulsetto Vagus Nerve Stimulator firmware accepts undisclosed, unauthenticated Bluetooth Low Energy commands that are not issued by the official companion app but are still processed by the device. Successful exploitation could allow a nearby attacker to disable electrical safety mechanisms or alter stimulation output settings, posing a physical safety risk to users. The vendor has not responded to CISA's coordination attempts, and no patch is currently available.

Updated Aug 12, 2026 · CVSS 8.1

A critical vulnerability (CVSS 10.0) in Siemens SIMATIC IoT2050 Advanced devices running Industrial OS with Node-RED allows unauthenticated remote attackers to execute arbitrary code with maximum privileges via the exposed Node-RED HTTP interface. Attackers can craft malicious flows to invoke system command nodes, achieving full device compromise with no authentication required.

Updated Aug 12, 2026 · CVSS 10

CVE-2026-19425 is a critical unauthenticated SQL injection vulnerability in Win Men International's Travel Agency Management System, allowing remote attackers to fully compromise backend databases without credentials. With a CVSS score of 9.8, exploitation could lead to complete data exfiltration, modification, or destruction, posing severe risk to organizations relying on this platform for customer and booking data.

Updated Aug 12, 2026 · CVSS 9.8

A heap inspection vulnerability in Cisco Secure Firewall ASA and FTD allows an unauthenticated, remote attacker to trigger an unexpected device reload, causing a denial-of-service condition. CISA has added this CVE to its Known Exploited Vulnerabilities catalog, indicating active exploitation in the wild, with a mandated remediation due date of August 14, 2026.

Updated Aug 12, 2026