Introduction
This report is generated using Velma (Vulnerability Enhanced Learning Machine AI) – Rootshell’s exploit intelligence engine.
Velma focuses on one thing: understanding when vulnerabilities actually become a problem.
There’s no shortage of vulnerability data out there, and most of it is driven by static scores. But risk isn’t static. A vulnerability can sit there for months with little real-world relevance, then overnight become critical when exploit code is released or it starts being used in the wild.
Velma tracks that shift.
By analysing exploit availability, attacker activity, and how vulnerabilities are being used in real-world scenarios, Velma highlights what’s genuinely worth paying attention to – not just what’s highly scored, but what’s actually exploitable.
This report provides a current view of the threat landscape, prioritizing vulnerabilities that are actively being weaponised or realistically used in attack paths.
For most organizations, the challenge isn’t a lack of vulnerabilities – it’s knowing which ones actually matter.
Jump to:
Velma Threat Prioritization Matrix - August 26
Priority | Threat | CVE | Likelihood | Impact | Exploit Maturity | Velma Risk |
Critical | Microsoft Entra ID RCE | CVE-2026-69836 | Very High | Critical | Exploited in the Wild | 10.0 |
Critical | SAP Commerce Cloud RCE | CVE-2026-58231 | High | Critical | Critical Vulnerability | 10.0 |
Critical | JetBrains TeamCity RCE | CVE-2026-63077 | Very High | Critical | Active Exploitation | 9.8 |
Critical | N-able N-central Auth Bypass | CVE-2026-18577 | Very High | Critical | Active Exploitation | 9.8 |
Critical | Check Point Admin Auth Bypass | CVE-2026-16232 | Very High | Critical | Active Exploitation | 9.7 |
Critical | VMware Authentication Bypass | CVE-2026-59309 | High | Critical | Patch Available | 9.6 |
Critical | SharePoint RCE | CVE-2026-50522 | High | Critical | High Exploit Potential | 9.5 |
Critical | WordPress SQLi → RCE Chain | CVE-2026-60137 / CVE-2026-63030 | High | Critical | Exploit Chain | 9.5 |
Critical | Adobe Commerce / Magento | CVE-2026-71362 | Very High | Critical | Reported Exploitation | 9.4 |
High | Windows IKE Remote Code Execution | CVE-2026-33824 | High | Critical | Network Exploitable | 9.2 |
High | F5 NGINX Buffer Overflow | CVE-2026-42533 | High | Critical | Public PoC | 9.1 |
High | Lazarus Windows Zero-Day | CVE-2026-68820 | Very High | High | Active Nation-State Exploitation | 9.0 |
High | Microsoft Defender SYSTEM PrivEsc | CVE-2026-50656 | High | High | Public PoC / Patch Bypass | 8.8 |
High | Apple Screen Sharing Auth Bypass | CVE-2026-65400 | Medium | High | Network Exploitable | 8.4 |
High | MLflow SSRF | CVE-2026-64849 | High | High | Technically Exploitable | 8.3 |
High | Flowise Authenticated RCE | CVE-2026-46442 | Medium | Critical | Sandbox Escape / RCE | 8.2 |
High | Windmill Path Traversal | CVE-2026-29059 | Very High | High | Active Exploitation | 8.2 |
High | TrueConf Remote Script Execution | CVE-2026-72529 | High | High | Network Exploitable | 8.0 |
High | Ray Browser/DNS Rebinding RCE | CVE-2025-62593 | Medium | Critical | Exploitable Technique | 7.8 |
Medium | Apache Tomcat Cluster Encryption Bypass | CVE-2026-34486 | Medium | High | Patch Available | 7.2 |
Medium | Cisco Static Credentials | CVE-2026-20316* | Medium | Medium | Network Exploitable | 6.8 |
Executive Summary
August 2026 has produced a particularly significant vulnerability landscape, with active exploitation, authentication bypasses and remote code execution (RCE) dominating the Velma watchlist.
The most significant threats this month affect Microsoft Entra ID, SAP Commerce Cloud, JetBrains TeamCity, VMware, Check Point Security Management, WordPress and enterprise remote-management platforms.
Of particular concern is the continued targeting of identity infrastructure, administrative platforms and development environments. Successful compromise of these systems can provide attackers with privileged access far beyond the initially affected application.
Velma also identified several vulnerabilities where exploitation has either been observed in the wild or credible proof-of-concept exploitation is available. These should be treated as priority remediation targets.
Top Threats This Month
1. Microsoft Entra ID – CVE-2026-69836
Risk: CRITICAL
One of the most significant vulnerabilities on the August watchlist affects Microsoft Entra ID, Microsoft’s cloud identity and access-management platform.
The vulnerability carries a CVSS score of 10.0 and involves unsafe deserialization capable of allowing an unauthorised attacker to execute code remotely.
Most importantly, exploitation has reportedly been observed in the wild. Microsoft has stated that no customer action is required, indicating remediation is being handled within the cloud service.
The targeting of identity infrastructure is particularly significant because successful compromise of an identity provider can potentially provide attackers with access across numerous connected systems.
Velma Priority: Immediate awareness and monitoring.
2. SAP Commerce Cloud – CVE-2026-58231
Risk: CRITICAL
SAP Commerce Cloud is affected by a maximum-severity CVSS 10.0 vulnerability caused by insufficient authorisation checks and input validation.
An unauthenticated attacker may abuse a default authentication client and provide specially crafted input to vulnerable functions.
Successful exploitation could result in arbitrary code execution and compromise internal components, affecting confidentiality, integrity and availability.
Internet-facing SAP Commerce infrastructure should therefore be considered a high-value remediation target.
3. JetBrains TeamCity – CVE-2026-63077
Risk: CRITICAL – ACTIVE EXPLOITATION
CVE-2026-63077 affects on-premise JetBrains TeamCity installations and has reportedly entered active exploitation in the wild.
The vulnerability carries a CVSS score of 9.8 and involves deserialization of untrusted data.
An unauthenticated attacker with access to a vulnerable TeamCity server can bypass authentication and execute arbitrary operating-system commands with the privileges of the TeamCity server process.
Compromise of CI/CD infrastructure represents a significant supply-chain risk because attackers may potentially pivot from the build platform towards source code, credentials, deployment pipelines and production infrastructure.
4. N-able N-central – CVE-2026-18577
Risk: CRITICAL – ACTIVE EXPLOITATION
Attackers have exploited an authentication bypass affecting N-able N-central to obtain remote administrative access and reach systems managed through vulnerable servers.
The initial remediation was reportedly incomplete, increasing the importance of verifying installed versions rather than simply confirming that an earlier patch was deployed.
The supplied intelligence identifies 2026.3.1.7, released on 2 August, as the first unaffected build.
Because RMM platforms typically provide highly privileged control over large numbers of endpoints, exploitation could potentially provide attackers with an extremely effective mechanism for lateral compromise.
5. Check Point Security Management – CVE-2026-16232
Risk: CRITICAL – ACTIVE EXPLOITATION
CVE-2026-16232 is a critical authentication bypass affecting Check Point Security Management and Multi-Domain Management products.
An unauthenticated remote attacker may obtain an application login token and authenticate with full administrative privileges.
Successful exploitation can allow attackers to modify security policies and configurations. The vulnerability has reportedly been exploited in the wild.
This is particularly serious because compromise of a security-management platform may allow an attacker to weaken the controls designed to prevent further compromise.
Microsoft Threat Landscape
Microsoft technologies feature prominently in the August watchlist.
Windows IKE – CVE-2026-33824
A double-free vulnerability within the Windows Internet Key Exchange extension can allow an unauthorised attacker to execute code remotely over a network.
SharePoint – CVE-2026-50522
This critical vulnerability carries a CVSS score of 9.8 and concerns deserialization of untrusted data within Microsoft Office SharePoint.
The supplied intelligence indicates that a Site Owner-level authenticated attacker could inject and remotely execute arbitrary code on the SharePoint Server.
Microsoft Defender – CVE-2026-50656
A publicly released proof-of-concept demonstrates a patch bypass associated with the Microsoft Defender vulnerability known as RoguePlanet.
Successful exploitation could allow an attacker to spawn a shell with SYSTEM-level privileges.
Nation-State Activity
Lazarus Group – CVE-2026-68820
August also demonstrates the continuing intersection between vulnerability exploitation and nation-state operations.
The North Korean Lazarus Group has reportedly exploited CVE-2026-68820 as a zero-day against organisations within the defence and aerospace sectors.
Targets have been identified across France, Germany, Brazil and India.
The campaign uses fake recruiter communications and malicious PDF-related activity before deploying a previously unseen backdoor named Troy.
The vulnerability affects the Windows Ancillary Function Driver for WinSock (AFD.sys) and enables privilege escalation.
The campaign reinforces the importance of treating recruitment-themed social engineering as a meaningful attack vector for organisations operating within defence, aerospace and other strategically sensitive sectors.
VMware Infrastructure
Broadcom has addressed multiple vulnerabilities affecting VMware ESX, vCenter, Workstation and Fusion.
The supplied watchlist highlights:
- CVE-2026-59309 – Authentication Bypass – CVSS 9.8
- CVE-2026-59310 – Directory Traversal – CVSS 9.8
- CVE-2026-47876 – Out-of-Bounds Write – CVSS 9.8
- CVE-2026-41703 – Out-of-Bounds Read – CVSS 7.6
Organisations operating VMware infrastructure should prioritise assessment and deployment of the relevant updates, particularly where management interfaces are reachable from untrusted networks.
Web Application & Internet Infrastructure
WordPress – CVE-2026-60137 / CVE-2026-63030
WordPress Core is addressing an unauthenticated SQL injection vulnerability which can reportedly be chained with a second vulnerability to achieve unauthenticated remote code execution.
Patched branches identified in the watchlist include 6.8.6, 6.9.5 and 7.0.2.
Given WordPress’s enormous deployment footprint, organisations should confirm successful automatic updating rather than assuming it has taken place.
F5 NGINX – CVE-2026-42533
A heap-based buffer overflow in NGINX Open Source and NGINX Plus carries a CVSS v4 score of 9.2.
Successful exploitation may cause denial-of-service and potentially remote code execution.
Security researchers have published detailed exploitation analysis and reportedly demonstrated reliable proof-of-concept exploitation in testing environments.
Adobe Commerce / Magento – CVE-2026-71362
Threat actors are reportedly exploiting CVE-2026-71362 against Adobe Commerce and Magento Open Source.
The vulnerability can allow an attacker to switch a customer’s session to another customer account, creating significant account compromise and e-commerce risk.
AI & Developer Infrastructure
Another important theme this month is the increasing number of vulnerabilities affecting AI, machine-learning and developer platforms.
MLflow – CVE-2026-64849
An unauthenticated SSRF vulnerability in MLflow can allow attackers to abuse webhook functionality and redirects to access internal systems or cloud metadata services.
The issue is fixed in MLflow 3.15.0.
Flowise – CVE-2026-46442
Flowise contains an authenticated remote-code-execution vulnerability involving its Custom JavaScript Function functionality.
Under commonly deployed configurations, attackers can escape the NodeVM sandbox and execute operating-system commands on the Flowise host.
The vulnerability is patched in version 3.1.2.
Ray – CVE-2025-62593
Ray deployments prior to version 2.52.0 can be exposed to remote code execution through a combination of browser behaviour and DNS rebinding.
The vulnerability is particularly relevant to developers running Ray locally who visit malicious or compromised websites.
These vulnerabilities demonstrate an emerging security concern around AI development infrastructure, where platforms designed to execute code and interact with models can create powerful attack primitives when exposed or incorrectly secured.
Velma Assessment
The August dataset shows a clear concentration around four attack themes:
Identity and Authentication
Entra ID, Check Point, VMware, N-able and Apple vulnerabilities demonstrate attackers’ continuing focus on bypassing authentication rather than attacking individual endpoints directly.
Remote Code Execution
TeamCity, SAP Commerce, SharePoint, Windows IKE, WordPress and potentially NGINX provide routes towards remote code execution.
Privileged Infrastructure
RMM, CI/CD, identity, virtualisation and security-management systems are particularly attractive because compromising a single platform can provide access to many downstream systems.
Active Exploitation
Several entries in this month’s intelligence are explicitly associated with exploitation activity, including TeamCity, N-able, Check Point, Entra ID, Windmill and the Lazarus Windows campaign. Adobe Commerce/Magento exploitation has also been reported.
Recommended Actions
Priority 1 – Immediate
Organisations should immediately identify exposure to:
CVE-2026-69836 – Microsoft Entra ID
CVE-2026-63077 – JetBrains TeamCity
CVE-2026-18577 – N-able N-central
CVE-2026-16232 – Check Point
CVE-2026-58231 – SAP Commerce Cloud
CVE-2026-71362 – Adobe Commerce / Magento
Where applicable, organisations should investigate for indicators of compromise rather than relying solely on patch deployment.
Priority 2 – Accelerated Remediation
Prioritise remediation of:
VMware infrastructure, SharePoint, WordPress, NGINX, Windows IKE and Microsoft Defender.
Particular attention should be given to internet-facing management interfaces and administrative platforms.
Priority 3 – Review AI/Development Infrastructure
Security teams should establish whether MLflow, Flowise, Ray, TeamCity or Windmill are deployed internally.
Development systems should not be assumed to be low-risk simply because they are not production applications.
August 2026 Risk Outlook
Overall Velma Threat Level: CRITICAL
August represents a high-risk month due to the combination of:
Active exploitation + authentication bypass + remote code execution + privileged infrastructure targeting.
The most important shift is not simply the number of critical vulnerabilities but where those vulnerabilities exist.
Identity providers, security-management consoles, RMM systems, virtualisation infrastructure and CI/CD platforms all provide attackers with opportunities to turn compromise of a single system into broader organisational access.
Velma therefore recommends prioritising vulnerabilities according to real-world exploitability and infrastructure importance, rather than CVSS score alone.
For August, the strongest remediation priority should be placed on known exploitation and vulnerabilities affecting systems capable of providing privileged or widespread downstream access.
