Four actively exploited vulnerabilities hit enterprise infrastructure at once today. Cisco firewalls are crashing from unauthenticated HTTP requests, Microsoft is patching 398 flaws with one zero-day already weaponized, VMware vCenter is under attack through a CVSS 9.8 directory traversal, and ransomware operators are using SharePoint as an initial access vector. Every one of these targets infrastructure that most enterprises cannot take offline without planning — which is exactly why attackers chose them.

In the News

Cisco ASA/FTD VPN Zero-Day Crashes Firewalls — CVE-2026-20349

Cisco has confirmed active exploitation of CVE-2026-20349, a high-severity (CVSS 8.6) vulnerability in Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) software. The flaw resides in HTTP request processing on VPN-enabled interfaces. An unauthenticated, remote attacker can send a crafted HTTP request that crashes and reloads the firewall — a denial-of-service condition with no authentication barrier.

The attack vector is significant because ASA and FTD devices with Remote Access VPN (RAVPN) enabled expose the vulnerable HTTP handler to the internet by design. There is no workaround short of disabling RAVPN, which is operationally untenable for most organizations. Cisco has released firmware updates across affected ASA and FTD release trains.

This is not the first time Cisco firewall VPN interfaces have been targeted — ASA/FTD devices have been a recurring initial access target for both nation-state and financially motivated threat actors. Organizations running these platforms should prioritize firmware upgrades and monitor for unexpected device reloads in their syslog and SNMP trap data.

What defenders should do: Upgrade ASA/FTD firmware to the patched release immediately. If RAVPN is not in active use, disable it. Monitor syslog for %ASA-1-199010 or equivalent reload events and correlate with inbound HTTP traffic to VPN interfaces.

Microsoft August 2026 Patch Tuesday — 398 Fixes, One Exploited Zero-Day

Microsoft’s August 2026 Patch Tuesday is one of the largest in recent memory: 398 vulnerabilities patched, 62 rated critical, and three zero-days disclosed. The most urgent is CVE-2026-68820, a use-after-free vulnerability in the Windows Ancillary Function Driver for WinSock. This driver operates at the kernel level — successful exploitation grants local privilege escalation to SYSTEM.

CVE-2026-68820 carries a CVSS score of 7.0, reflecting the local access requirement. In practice, attackers chain local privilege escalation with a separate initial access vector — phishing, browser exploit, or compromised application — to move from user context to full system control. Microsoft has confirmed exploitation in the wild but has not attributed it to a specific threat actor.

Two additional zero-days were publicly disclosed but are not yet confirmed exploited. With 62 critical-severity flaws in the batch, patch prioritization is essential. Organizations that rely on monthly patching cycles will need to accelerate timelines for the actively exploited CVE and the critical-rated remote code execution flaws.

What defenders should do: Apply the August cumulative update with priority on CVE-2026-68820. Deploy EDR detection for WinSock driver exploitation indicators. Use vulnerability prioritization tooling to triage the remaining 62 criticals by asset exposure.

VMware vCenter RCE Actively Exploited — CVE-2026-59310

Attackers are actively exploiting CVE-2026-59310, a critical (CVSS 9.8) directory traversal vulnerability in VMware vCenter Server that enables unauthenticated remote code execution. vCenter is the centralized management platform for VMware virtualization environments — compromising it gives an attacker effective control over every virtual machine, template, and datastore in the cluster.

The vulnerability requires no authentication. An attacker with network access to the vCenter HTTPS port (443) can traverse directories and execute arbitrary code on the underlying operating system. Broadcom has released patches for affected vCenter versions.

The blast radius here is substantial. vCenter is the control plane — it is not a workload, it is the thing that manages all the workloads. Organizations that have not segmented management interfaces from general network traffic face the highest risk. Network detection monitoring for anomalous connections to vCenter management ports is a critical compensating control while patching proceeds.

What defenders should do: Patch vCenter Server immediately. Restrict network access to vCenter management interfaces to dedicated management VLANs or jump hosts. Monitor for directory traversal patterns in vCenter web server logs.

SharePoint RCE Exploited by Ransomware — KEV-Listed

CISA has added CVE-2026-55040 to the Known Exploited Vulnerabilities catalog after confirming that ransomware groups are using this SharePoint Server RCE flaw (CVSS 9.1) as an initial access vector. Exploitation has been observed since early July 2026, giving attackers roughly six weeks of activity before the KEV listing.

SharePoint Server remains deeply embedded in enterprise collaboration, particularly in organizations that have not fully migrated to SharePoint Online. On-premises instances are the primary target. The exploitation pattern aligns with ransomware initial access techniques (MITRE ATT&CK T1190 — Exploit Public-Facing Application) — attackers gain code execution on the SharePoint server and use it as a foothold for lateral movement and eventual ransomware deployment.

What defenders should do: Patch SharePoint Server. Place on-premises SharePoint instances behind a web application firewall. Monitor IIS logs for exploitation indicators. Federal agencies must comply with the KEV remediation deadline.

Defender Action Items

  • Cisco ASA/FTD: Upgrade firmware to patched release for CVE-2026-20349. Disable RAVPN if not required. Monitor syslog for unexpected reloads.
  • Windows endpoints: Apply August 2026 cumulative update. Prioritize CVE-2026-68820 (WinSock driver privesc). Deploy EDR rules for kernel driver exploitation.
  • VMware vCenter: Patch CVE-2026-59310 immediately. Restrict port 443 access to management VLANs. Deploy network detection for directory traversal in vCenter web logs.
  • SharePoint Server: Patch CVE-2026-55040. Deploy WAF rules for SharePoint exploitation patterns. Monitor for anomalous file operations on document libraries.
  • Adobe ColdFusion: Patch CVE-2026-48362 (CVSS 10.0 command injection). Segment ColdFusion servers in DMZ with strict egress filtering.
  • SAP Commerce Cloud: Apply SAP Security Note for CVE-2026-58231 (CVSS 10.0). Segment Commerce Cloud endpoints and audit authorization configurations.

Detection Spotlight

The Windows WinSock driver zero-day (CVE-2026-68820) exploits a use-after-free in the Ancillary Function Driver (afd.sys) for local privilege escalation. EDR and SIEM teams should look for suspicious process creation chains where a user-context process spawns a SYSTEM-context child following afd.sys interaction. The following Splunk SPL query identifies anomalous privilege transitions associated with AFD driver operations:

index=windows sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
| eval parent_user=coalesce(ParentUser, "unknown"), child_user=coalesce(User, "unknown")
| where like(parent_user, "%Users%") AND (like(child_user, "%SYSTEM%") OR like(child_user, "%LocalSystem%"))
| search (ParentImage="*\\afd.sys" OR Image="*\\afd.sys" OR CommandLine="*afd*")
| stats count by _time, Computer, ParentImage, Image, parent_user, child_user, CommandLine
| where count > 0
| sort - _time

This query catches processes where a standard user parent spawns a SYSTEM-level child with AFD driver references — a high-fidelity indicator of kernel driver privilege escalation. Expect some false positives from legitimate WinSock operations during network stack updates; baseline during patch deployment windows and tune accordingly.

References

Subscribe to the it-learn Brief

Get the daily cybersecurity brief in your inbox every weekday morning — news, SE angles, and detection queries.