Technology

Microsoft assessed with qualified confidence that Storm-1175, a financially motivated ransomware group, likely exploited CVE-2026-18577, an authentication-bypass flaw in N-able N-central, beginning on the day the vulnerability was publicly disclosed. The flaw allowed unauthenticated remote administrative access to N-central, which manages endpoints across MSP customer environments, and attackers used the platform's own Take Control feature to pivot to managed devices and install persistent Cloudflare tunnels that survived credential revocation. N-able has released a second hotfix that supersedes the first, and operators who applied only the initial patch are not fully protected.

CISA updated its Known Exploited Vulnerabilities catalog on August 11, 2026, to confirm that CVE-2026-45659, a deserialization flaw in Microsoft SharePoint Server with a CVSS score of 8.8, is actively being used in ransomware campaigns. Shadowserver data shows more than 200 of roughly 8,500 internet-exposed SharePoint servers remain unpatched, despite patches being available since May 2026 and a federal remediation deadline of July 4, 2026. Microsoft's own advisory has not been updated to reflect confirmed exploitation, creating a gap between vendor guidance and observed threat activity.

A cyberattack on logistics firm CEVA between July 29 and August 1, 2026, disrupted operations at eight European warehouses and likely exposed delivery data for European Steam hardware customers, including names, addresses, phone numbers, email addresses, and order details. Valve confirmed that payment information, passwords, and Steam account credentials were not held by CEVA and were therefore not part of the exposure. The total number of affected customers, the identities of the eight warehouses, and the full forensic scope of what was taken remain unestablished, and no threat actor has been publicly identified.

A May 2026 scan found 36,872 servers exposing IPMI management interfaces publicly, with 66.9% returning crackable authentication hashes before any login attempt under CVE-2013-4786, a vulnerability documented since 2013 with no vendor fix available when IPMI over LAN is enabled. Supermicro and HPE systems dominate the exposed population, and factory-default passwords on these devices are estimated to be recoverable within seconds to one day using current GPU hardware. Both vendors recommend disabling IPMI over LAN and isolating management interfaces on dedicated networks, guidance that NSA and CISA had already issued in June 2023.

Broadcom patched a command-injection flaw in VMware Aria Operations affecting versions 8.x through 8.18.5 and 9.x through 9.0.1, with fixes available in 8.18.6 and 9.0.2. CISA added the vulnerability to its Known Exploited Vulnerabilities catalog on March 3, 2026, setting a federal-agency remediation deadline of March 24, though no specific attack details, victims, or attribution have been made public. Broadcom separately stated it could not independently confirm the exploitation reports, leaving a gap between the vendor's position and CISA's formal classification.