Vulnerabilities
Rapid7 Labs disclosed a two-CVE SharePoint chain reaching unauthenticated remote code execution as any user, including administrator. A JWT authentication bypass feeds an RCE flaw, both fixed in the August 11 Patch Tuesday. Notably, an AI agent helped find the chain.
Vulnerabilities
N-able's first N-central hotfix didn't end the intrusion. Attackers reached the managed systems behind the RMM platform and kept a foothold even after the server was locked down, so N-able has now shipped Hotfix 2 — required even if you already patched Hotfix 1.
Vulnerabilities
Metabase says a maximum-severity flaw in its business-intelligence software was exploited as a zero-day. The CVSS 10.0 bug lets an unauthenticated attacker inject SQL into Metabase's application database and seize admin access. Self-hosted operators should patch and rotate credentials.
Vulnerabilities
CISA added Progress Kemp LoadMaster's CVE-2026-8037 — a CVSS 9.6 command injection flaw — to its Known Exploited Vulnerabilities catalog after 792 documented exploit attempts. Federal agencies have until August 10 to patch. Here is how to find, fix, and verify your deployments.
Vulnerabilities
Cisco's newest hardening release patches 12 Catalyst SD-WAN and IOS XE flaws — three of them rated CVSS 9.9 and a fourth at 9.8. Cisco says none are exploited yet, which makes this a patch-priority call: take the criticals first, schedule the rest by exposure.
Vulnerabilities
N-able has confirmed what the earlier 'God mode' warnings only implied: attackers used the N-central flaw (CVE-2026-18577) to reach downstream customer networks. A second hotfix has landed after the first fix was bypassed. Here is what MSPs should verify now.
Vulnerabilities
CISA added three actively exploited flaws in Langflow, N-able N-central, and Apache Tomcat to its KEV catalog this week, then flagged JetBrains TeamCity's CVE-2026-63077 under active exploitation. Two 9.8s and two deadlines — here's what to patch first and how to verify it.
Vulnerabilities
Seventy-two hours, not twenty-one days. CISA gave federal agencies just three days to patch the actively exploited N-able N-central "God mode" flaw that grants full administrative access to a console — and warned the vendor and MSPs that the hotfix is "not optional."
Vulnerabilities
The N-central flaw just went federal. CISA added CVE-2026-18577 (CVSS 8.2) to its Known Exploited Vulnerabilities catalog after N-able found a second vector past the original patch for CVE-2026-18556 — putting federal agencies on the clock and every MSP customer in scope.
Vulnerabilities
From hosting customer to database root. cPanel patched CVE-2026-58048 (CVSS 4.0 score 9.4), where an authenticated customer could execute SQL in the database's root context — crossing the account-to-admin boundary — and closed two more account-boundary routes in the same release.
Vulnerabilities
From auth bypass to patch bypass. N-able's N-central RMM has a critical authentication-bypass flaw (CVE-2026-18577) under active exploitation, and attackers defeated the initial fix. Build 2026.3.1.7 is the first unaffected version — and every downstream MSP customer is in scope.
Vulnerabilities
The fix is out. Ruby on Rails has patched the critical KindaRails2Shell flaw (CVE-2026-66066) that let unauthenticated attackers read arbitrary files and potentially reach code execution. What Rails operators should identify, upgrade, and restart now.