AtRisk August 27, 2026 Vol. XXVI

Jump to:

Internet Storm Center Spotlight
Recent CVEs
Sponsors
Read More

ISC provides a free analysis and warning service to thousands of Internet users and organizations, and is actively working with Internet Service Providers to fight back against the most malicious attackers. https://isc.sans.edu/about.html

Who Got Missed in the MFA Rollout? More Powershell + Graph + Entra scripting!

Published: 2026-08-21

Last Updated: 2026-08-21 02:47:00 UTC

by Rob VandenBrink (Version: 1)

In every MFA rollout, there will come a time where you think you are closing in on "done", and some automation to list what's left would be handy. Something quicker than scrolling through the web interface through thousands of accounts ...

This is that method.

Also, remember when we discussed yesterday about the beta graph commands in the Microsoft.Graph.Beta library? We'll use one of those beta commands here! ...

Read the full entry: https://isc.sans.edu/diary/Who+Got+Missed+in+the+MFA+Rollout+More+Powershell+Graph+Entra+scripting/33272/

Even MOAR Powershell, looking at Entra logins - the good, the bad and the password sprays

Published: 2026-08-21

Last Updated: 2026-08-21 01:49:18 UTC

by Rob VandenBrink (Version: 1)

One thing that folks never seem to do after "going to the CLOOOOUUUUD" is to look at their logs, logs that they would have checked daily when things were on premise.

One log that really bears looking at is the log of successful and failed logins. the call for that is ...

Read the full entry: https://isc.sans.edu/diary/Even+MOAR+Powershell+looking+at+Entra+logins+the+good+the+bad+and+the+password+sprays/33268/

Using Microsoft Graph and Powershell - Risk Detection Commands

Published: 2026-08-20

Last Updated: 2026-08-20 13:09:50 UTC

by Rob VandenBrink (Version: 1)

Building on the last diary on Using MS Graph and Powershell, let's look at "Risky" logins.

Risky logins are a derived set of parameters that look at various (you guessed it) risky login parameters. What is considered a risk?

In most cases this is either impossible geography - in other words "we're not expecting to see you at that IP, in that subnet, ASN or country", or unusual device - ie "that's not your regular computer"

There are two groups of commands in this area. You can do Risk Detection in a basic Entra license, but to work with Persistent Risk User accounts you need to bump up your license. So it'll cost you every month to use these commands ...

Read the full entry: https://isc.sans.edu/diary/Using+Microsoft+Graph+and+Powershell+Risk+Detection+Commands/33266/

Obfuscating IP Addresses as Hostnames (2026.08.24)

https://isc.sans.edu/diary/Obfuscating+IP+Addresses+as+Hostnames/33280/

DOUBLECUP's PNG Payload (2026.08.24)

https://isc.sans.edu/diary/DOUBLECUPs+PNG+Payload/33274/

Using Microsoft Graph and Powershell to Mine for Information - Stale Accounts and Licenses (2026.08.20)

https://isc.sans.edu/diary/Using+Microsoft+Graph+and+Powershell+to+Mine+for+Information+Stale+Accounts+and+Licenses/33264/

Simple Scans for Cloud Metadata Service (2026.08.19)

https://isc.sans.edu/diary/Simple+Scans+for+Cloud+Metadata+Service/33260/

The list is assembled by pulling recent vulnerabilities from NIST NVD, Microsoft, Twitter mentions of vulnerabilities, ISC Diaries and Podcast, and the CISA list of known exploited vulnerabilities. There are also some unscored, but significant, vulnerabilities at the end. This includes vulnerabilities that have not been added to the NVD yet.

CVE-2026-72529 - TrueConf Server Missing Authentication for Critical Function Vulnerability

Product: TrueConf Server

CVSS Score: 9.8

** KEV since 2026-08-20 **

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-72529

KEV: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-72529

CVE-2026-72530 - TrueConf Server Code Injection Vulnerability

Product: TrueConf Server

CVSS Score: 9.0

** KEV since 2026-08-20 **

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-72530

KEV: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-72530

CVE-2026-73570 - Zimbra Collaboration Suite (ZCS) OS Command Injection Vulnerability

Product: Zimbra Collaboration Suite

CVSS Score: 0

** KEV since 2026-08-21 **

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-73570

KEV: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-73570

CVE-2026-64849 - MLflow Server-Side Request Forgery Vulnerability

Product: Mlflow

CVSS Score: 0

** KEV since 2026-08-19 **

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-64849

KEV: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-64849

CVE-2026-59310 - Broadcom VMware vCenter Path Traversal Vulnerability

Product: VMware vCenter

CVSS Score: 0

** KEV since 2026-08-18 **

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-59310

KEV: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-59310

CVE-2026-55040 - Microsoft SharePoint Weak Authentication Vulnerability

Product: Microsoft SharePoint

CVSS Score: 0

** KEV since 2026-08-18 **

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-55040

KEV: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-55040

CVE-2026-48282 - Adobe ColdFusion Path Traversal Vulnerability

Product: Adobe ColdFusion

CVSS Score: 0

** KEV since 2026-07-07 **

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-48282

KEV: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-48282

CVE-2026-65400 - Apple macOS Improper Authentication Vulnerability

Product: Apple macOS

CVSS Score: 0

** KEV since 2026-08-18 **

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-65400

KEV: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-65400

CVE-2026-60004 - Gitea contains a code injection vulnerability that allows an attacker with repository write access to send a malicious patch to the diffpatch API endpoint to plant an executable Git hook and run shell commands as the Gitea service account. Product: Gitea CVSS Score: 9.8 ** KEV since 2026-08-25 ** KEV: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-60004

Microsoft has addressed several vulnerabilities that require no customer action to resolve.

CVSS Scores: 9.1 - 10

CVE-2026-69836 - Microsoft Entra ID Remote Code Execution Vulnerability

ISC Podcast: https://isc.sans.edu/podcastdetail/10064

MSFT Details: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69836

CVE-2026-69851 - Microsoft Entra ID Elevation of Privilege Vulnerability

MSFT Details: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69851

CVE-2026-62834 - Azure Data Factory Elevation of Privilege Vulnerability

MSFT Details: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-62834

CVE-2026-63509 - Microsoft Fabric Elevation of Privilege Vulnerability

MSFT Details: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-63509

CVE-2026-65770 - Azure Managed Instance for Apache Cassandra Remote Code Execution Vulnerability

MSFT Details: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-65770

CVE-2026-65801 - Microsoft Exchange Online Elevation of Privilege Vulnerability

MSFT Details: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-65801

CVE-2026-65816 - Azure Arc Elevation of Privilege Vulnerability

MSFT Details: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-65816

CVE-2026-69555 - Azure Arc Elevation of Privilege Vulnerability

MSFT Details: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69555

CVE-2026-66309 - Azure SQL Database Elevation of Privilege Vulnerability

MSFT Details: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-66309

CVE-2026-68782 - Azure SQL Database Elevation of Privilege Vulnerability

MSFT Details: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-68782

CVE-2026-68789 - Azure SQL Database Elevation of Privilege Vulnerability

MSFT Details: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-68789

CVE-2026-69502 - Azure SQL Database Elevation of Privilege Vulnerability

MSFT Details: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69502

CVE-2026-69400 - Azure Logic Apps Elevation of Privilege Vulnerability

MSFT Details: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69400

CVE-2026-73194 - DBI versions before 1.652 for Perl are vulnerable to a heap out-of-bounds write via an unvalidated numeric placeholder that sets the binder counter in preparse.

Product: DBI Perl

CVSS Score: 9.1

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-73194

CVE-2026-50540 - Kata Containers: Config Path Annotation Arbitrary File Loading

Product: Kata Containers

CVSS Score: 9.6

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-50540

MSFT Details: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50540

CVE-2026-34884 - Apache SkyWalking MCP is vulnerable to SSRF via set_skywalking_url Tool and GraphQL expression injection, affecting version 0.1.0.

Product: Apache SkyWalking MCP

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-34884

NVD References: https://lists.apache.org/thread/s447p6h5dfr02lx17v27phoksgb8mkkp

Mozilla: Multiple vulnerabilities in Firefox, Thunderbird, and Thunderbird

CVE-2026-74943 - use-after-free

CVE-2026-74987 - improper restriction of operations within the bounds of a memory buffer

CVE-2026-74990 - improper restriction of operations within the bounds of a memory buffer

CVE-2026-74936 - use-after-free

CVE-2026-74938 - mitigation bypass

CVE-2026-74940 - use-after-free

CVE-2026-74944 - use-after-free

CVE-2026-74956 - same-origin policy bypass

CVE-2026-74959 - mitigation bypass

CVE-2026-74961 - side-channel

CVE-2026-74964 - integer overflow

CVE-2026-74979 - mitigation bypass

CVE-2026-74985 - privilege escalation

CVE-2026-74986 - exposure of sensitive information to an unauthorized actor

CVE-2026-74988 - improper restriction of operations within the bounds of a memory buffer

CVE-2026-74989 - improper restriction of operations within the bounds of a memory buffer

CVE-2026-75874 - sandbox escape / protection mechanism failure

Mozilla References:

- https://www.mozilla.org/security/advisories/mfsa2026-74/

- https://www.mozilla.org/security/advisories/mfsa2026-75/

- https://www.mozilla.org/security/advisories/mfsa2026-76/

- https://www.mozilla.org/security/advisories/mfsa2026-77/

- https://www.mozilla.org/security/advisories/mfsa2026-78/

- https://www.mozilla.org/security/advisories/mfsa2026-79/

- https://www.mozilla.org/security/advisories/mfsa2026-80/

CVE-2026-59940 - Seroval allows for JSON Promise control nodes to manipulate values with plugins enabled, potentially leading to remote code execution in versions prior to 1.5.3.

Product: Seroval

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-59940

NVD References: https://github.com/lxsmnsyc/seroval/security/advisories/GHSA-mv8w-475r-vwqw

CVE-2026-45117 - MyBB allows PHP code injection and remote code execution due to improper escaping of user-supplied database configuration values in versions 1.8.13 to 1.8.40 during the installation process, fixed in version 1.8.40.

Product: MyBB

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-45117

NVD References: https://github.com/mybb/mybb/security/advisories/GHSA-gpc4-77rp-3xqr

CVE-2026-45118 - MyBB is vulnerable to an open redirect and reflected JavaScript code injection in the Contact module prior to version 1.8.40, due to insufficient validation of the redirect URL or protocol in contact.php.

Product: MyBB

CVSS Score: 9.3

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-45118

NVD References: https://github.com/mybb/mybb/security/advisories/GHSA-wf92-5q5h-qr53

Oracle Critical Security Patch Update Advisory - August 2026

On Tuesday, August 18, 2026, Oracle published its monthly Oracle Critical Security Patch Update Advisory, which includes 943 new security patches, addressing 925 unique CVEs. The CPU addresses vulnerabilities in multiple Oracle products, including but not limited to various components of Oracle Database Server, Oracle Fusion Middleware, Oracle Hyperion, JD Edwards, Oracle Siebel CRM, Oracle Supply Chain, Oracle E-Business Suite, Oracle Commerce / Oracle Commerce Experience Manager, Oracle Analytics, Oracle Food and Beverage Applications, and Oracle PeopleSoft.

Oracle: https://www.oracle.com/security-alerts/cspuaug2026.html

CVE-2026-62988 - Froxlor open source server administration software exposes customer, administrator, and FTP password hashes and TOTP seeds, allowing for potential account takeover until version 2.3.8.

Product: Froxlor

CVSS Score: 9.0

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-62988

NVD References: https://github.com/froxlor/froxlor/security/advisories/GHSA-7788-ghfq-c6mh

CVE-2026-76036 - Google Chrome on Android prior to version 151.0.7922.169 is vulnerable to a critical buffer overflow, allowing remote attackers to execute arbitrary code via a crafted HTML page.

Product: Google Chrome

CVSS Score: 9.6

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-76036

NVD References: https://chromereleases.googleblog.com/2026/08/stable-channel-update-for-desktop_0826575033.html

Remote code execution vulnerabilities in IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1

CVE-2026-15068, CVE-2026-16840, CVE-2026-16882, CVE-2026-16885, CVE-2026-16894, CVE-2026-16913, CVE-2026-16917, CVE-2026-16919

CVSS Scores: 9.8 - 9.9

IBM References: https://www.ibm.com/support/pages/node/7283858

CVE-2026-16822 - IBM AIX 7.2, 7.3, and PowerVM VIOS 4.1 are vulnerable to remote impersonation and traffic modification due to improper certificate validation.

Product: IBM AIX

CVSS Score: 9.3

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-16822