Daily Threat Briefing
← All briefings

Windows Ancillary Function Driver for WinSock · Microsoft SharePoint Server · Cisco Secure Firewall ASA and FTD

Date: 2026-08-12 Prepared for: SOC Analysts | Incident Responders | Vulnerability Management | Security Leadership

Executive Summary

August 2026 Patch Tuesday delivered 421 Microsoft vulnerabilities, including one actively exploited zero-day (CVE-2026-68820, Windows AFD for WinSock, CISA KEV), two publicly disclosed zero-days, and a critical unauthenticated RCE chain against SharePoint (CVE-2026-55040 + CVE-2026-63520) with a published PoC and technical analysis. CISA also added Cisco ASA/FTD (CVE-2026-20349) and Metabase (CVE-2026-72898) to KEV with a 3-day remediation deadline. Sandworm-linked UAC-0145 is actively targeting IT professionals with trojanized WireGuard VPN clients, and a cyberattack disrupted a Polish power plant via a private cellular network.

Critical Vulnerabilities

CVE-2026-68820 — Windows Ancillary Function Driver for WinSock (AFD)

  • Severity: CVSS 7.0
  • EPSS: Not yet scored — exploitation confirmed in the wild
  • Technical detail: Use-after-free vulnerability in the Windows AFD driver (afd.sys), which handles WinSock network socket operations. Exploitation requires winning a race condition, increasing exploit complexity but not preventing reliable weaponization. Successful exploitation grants SYSTEM-level privileges. No user interaction required. Affects all supported Windows client and server versions. Rapid7 notes attribution to Check Point researchers and suggests a North Korea-nexus threat actor interest pattern consistent with prior AFD exploitation.
  • Exploitation status: Actively exploited in the wild; CISA KEV added 2026-08-11, deadline 2026-08-25.
  • Remediation: Apply August 2026 Patch Tuesday updates immediately. Prioritize internet-facing and privileged-access workstations. Hunt for anomalous SYSTEM-level process creation chains originating from user-mode processes.

CVE-2026-63520 + CVE-2026-55040 — Microsoft SharePoint Server (Unauthenticated RCE Chain)

  • Severity: CVE-2026-63520: CVSS 8.1; chain is effectively critical (unauthenticated RCE)
  • EPSS: Not yet scored — PoC and full technical analysis published
  • Technical detail: Rapid7 disclosed a two-vulnerability chain enabling unauthenticated RCE against SharePoint Server. CVE-2026-55040 (JWT authentication bypass, patched July 2026) exploits four weaknesses in SharePoint’s JWT validation pipeline — disabled signature verification (RequireSignedTokens = false), unverified x5t actor token resolution, permissive issuer validation, and a non-cryptographic signature check — allowing an attacker to forge a valid JWT and impersonate any user including site administrators. CVE-2026-63520 (patched today) exploits an unsafe .NET type instantiation in Business Connectivity Services to execute arbitrary code as the SharePoint service account. A full PoC for the auth bypass and technical analysis for the RCE are now public. Affects SharePoint Server Subscription Edition, 2019, and 2016.
  • Exploitation status: No confirmed in-the-wild exploitation yet; PoC published 2026-08-11. CISA previously confirmed ransomware exploitation of CVE-2026-55040 (the auth bypass component).
  • Remediation: Apply August 2026 Patch Tuesday SharePoint updates immediately (KB5002893/5002894/5002905 and related). Verify July patches for CVE-2026-55040 are also applied. Treat unpatched internet-facing SharePoint as actively targeted. Review SharePoint service account privileges and audit recent authentication logs for anomalous JWT-based access.

CVE-2026-20349 — Cisco Secure Firewall ASA and FTD (Heap Inspection / DoS)

  • Severity: High (CWE-244)
  • EPSS: Not yet scored — actively exploited
  • Technical detail: An unauthenticated remote attacker can exploit a heap inspection vulnerability in the VPN processing path of Cisco ASA and FTD to cause an unexpected device reload, resulting in a denial-of-service condition. No authentication or user interaction required. Cisco confirmed active exploitation in the wild targeting VPN-enabled deployments.
  • Exploitation status: Actively exploited; CISA KEV added 2026-08-11, deadline 2026-08-14 (federal agencies).
  • Remediation: Apply Cisco security updates immediately. If patching is not immediately possible, review Cisco’s advisory for workarounds. Monitor for unexpected device reloads as an exploitation indicator.

CVE-2026-65791 — Windows iSCSI Target Service (Heap Buffer Overflow, RCE)

  • Severity: CVSS 9.8
  • EPSS: Not yet scored
  • Technical detail: Unauthenticated heap-based buffer overflow in the Windows iSCSI Target Service, exploitable over the network without user interaction. Affects Windows Server 2012 through 2025 and Windows 10 1607/1809. The iSCSI Target Service is commonly enabled in storage-heavy server environments. CVSS 9.8 with no authentication requirement makes this a high-priority patch target despite no confirmed exploitation.
  • Exploitation status: No confirmed exploitation; rated “Exploitation Unlikely” by Microsoft.
  • Remediation: Apply August 2026 Patch Tuesday updates. Restrict iSCSI target ports (TCP 3260) to authorized initiator IPs at the network perimeter.

CVE-2026-62832 — Windows User Profile Service (EoP, Publicly Disclosed)

  • Severity: CVSS 7.8
  • EPSS: Not yet scored — publicly disclosed zero-day
  • Technical detail: Elevation-of-privilege vulnerability in the Windows User Profile Service, exploitable via a specially crafted application. An authenticated attacker with credentials for another account can load another user’s registry hive to achieve administrator rights on the local asset. Publicly disclosed by pseudonymous researcher “Nightmare Eclipse” as “LegacyHive” prior to patch availability. Rated “Exploitation More Likely” by Microsoft.
  • Exploitation status: Publicly disclosed (zero-day); no confirmed in-the-wild exploitation at time of publication.
  • Remediation: Apply August 2026 Patch Tuesday updates. Monitor for suspicious registry hive loading activity (NtLoadKey calls from unexpected processes).

ONGOING:

  • CVE-2026-72898 (Metabase): Actively exploited SQL injection, CISA KEV deadline 2026-08-14 — patch immediately, covered in yesterday’s report.
  • CVE-2026-72899 (Metabase): Companion unauthenticated SQL injection — same remediation as above.
  • CVE-2026-63077 (JetBrains TeamCity): BSI advisory updated; actively exploited — upgrade to 2026.1.3.
  • CVE-2026-0257 (PAN-OS GlobalProtect): Qilin ransomware exploitation ongoing — patch immediately.
  • CVE-2026-16232 (Check Point SmartConsole): Actively exploited — treat unpatched instances as compromised.
  • CVE-2026-8037 (Progress Kemp LoadMaster): Ransomware exploitation confirmed — patch immediately.

European Advisories

BSI published a large batch of new and updated advisories on 2026-08-11, coinciding with Microsoft Patch Tuesday and SAP Patch Day.

WID-SEC-2026-2746 (SAP Patch Day August 2026): BSI issued a new high-severity advisory covering multiple SAP products. SAP Commerce Cloud is reportedly fully compromisable (Heise Security). Issues span arbitrary code execution, privilege escalation, security bypass, credential disclosure, SQL injection, XSS, and DoS across the SAP portfolio. Apply all SAP August 2026 Security Notes immediately; prioritize Commerce Cloud and NetWeaver components.

WID-SEC-2026-2750 / WID-SEC-2026-2749 (Red Hat OpenShift): Two new BSI advisories cover multiple vulnerabilities in Red Hat OpenShift and the oauth-proxy component, enabling RCE, privilege escalation, DoS, information disclosure, and security bypass. An authenticated remote attacker can bypass security controls via the oauth-proxy flaw. Apply Red Hat OpenShift updates.

WID-SEC-2026-2744 (TYPO3 Core): New BSI advisory — an authenticated remote attacker can bypass security controls in TYPO3 Core. Apply available TYPO3 security updates; relevant for German public sector and media organizations with high TYPO3 deployment rates.

WID-SEC-2026-2743 (CyberPanel): New BSI advisory — multiple vulnerabilities allow an authenticated remote attacker to disclose information, bypass security controls, gain administrator rights, and execute arbitrary code. Apply CyberPanel updates immediately; restrict management interface access.

WID-SEC-2026-2534 (JetBrains TeamCity): Updated BSI advisory — covered in ONGOING above.

WID-SEC-2026-2715 (Metabase): Covered in Critical Vulnerabilities (yesterday’s report).

BSI also issued updates for Linux Kernel (multiple advisories), OpenSSH, FreeBSD, Evince, libarchive, ClamAV, Golang Go, and Red Hat Ansible Automation Platform. Apply vendor patches per standard patch cycle.

Active Threats and Campaigns

NEW — Sandworm/UAC-0145: Trojanized WireGuard VPN targeting IT professionals. CERT-UA disclosed that UAC-0145, a Sandworm subgroup, has been conducting fake job interview campaigns against Ukrainian IT workers since at least May 2026. Victims are tricked into installing a trojanized WireGuard VPN client that provides the attacker with remote command execution capability. The social engineering lure impersonates recruiters. Organizations with Ukrainian IT staff or contractors should brief personnel on this campaign and verify the integrity of any recently installed VPN software.

NEW — DeadLock Ransomware: Blockchain-backed extortion infrastructure. Microsoft Threat Intelligence disclosed that the DeadLock ransomware group is using Polygon smart contracts and the Session messaging network to host victim communications and data leak operations, making infrastructure takedown significantly harder. This represents a maturation of ransomware operational resilience tactics. No specific IOCs published beyond the Microsoft report.

NEW — Gunra Ransomware targeting European critical infrastructure. US and South Korean agencies issued a joint advisory warning of Gunra ransomware attacks against healthcare, financial services, government, and critical infrastructure globally. Gunra exploits Fortinet and Schneider Electric vulnerabilities for initial access. European organizations in these sectors should review the advisory for TTPs and IOCs and validate patch status for Fortinet and Schneider Electric products.

NEW — Polish power plant cyberattack. Attackers breached a Polish combined heat and power plant via the operator’s private cellular network, shutting down a steam turbine and process-water treatment system. The plant supplies heat to approximately 50,000 residents. This is a significant European critical infrastructure incident; organizations using private cellular networks for OT/ICS access should review network segmentation and authentication controls.

ONGOING — BdThemes WordPress supply chain compromise: Rogue admin account creation ongoing on unpatched sites — audit admin accounts immediately.

ONGOING — Kimwolf v7 Android/IoT botnet: Unit 42 published analysis of HTTP/2 DDoS fingerprinting evasion and Ethereum ENS C2 — no new IOCs beyond published report.

Security News and Context

  • Microsoft August 2026 Patch Tuesday addressed 421 vulnerabilities including 62 critical, one actively exploited zero-day (CVE-2026-68820), and two publicly disclosed zero-days; SANS ISC and Rapid7 provide detailed breakdowns.
  • SharePoint unauthenticated RCE PoC published: Rapid7 released full technical analysis and PoC for CVE-2026-55040; ransomware exploitation of the auth bypass was previously confirmed by CISA — Rapid7 blog.
  • Mozilla revoked Firefox/Thunderbird Linux signing key after an unencrypted copy was accidentally committed to a private GitHub repository; Linux distribution maintainers should update trust stores — Bleeping Computer.
  • Wesco data breach: Global supply chain distributor Wesco confirmed a cybersecurity incident after ExfilSquad claimed data theft — Bleeping Computer.
  • Brandenburg memorial foundation ransomware attack: The Stiftung Brandenburgische Gedenkstätten (Brandenburg Memorials Foundation) was hit by ransomware; IT systems are offline and data exfiltration is suspected — Heise Security.
  1. Apply August 2026 Patch Tuesday updates across all Windows systems immediately; prioritize CVE-2026-68820 (AFD, actively exploited) and SharePoint (CVE-2026-63520).
  2. SharePoint (CVE-2026-63520 + CVE-2026-55040): Verify both July and August SharePoint patches are applied; audit JWT-based authentication logs for anomalous access; review SharePoint service account privileges.
  3. Cisco ASA/FTD (CVE-2026-20349): Patch by 2026-08-14 (CISA KEV deadline); monitor for unexpected device reloads as exploitation indicator.
  4. SAP August 2026 Patch Day: Apply all SAP Security Notes; prioritize SAP Commerce Cloud (fully compromisable per Heise).
  5. Sandworm/UAC-0145 WireGuard campaign: Brief IT staff on fake recruiter lures; verify integrity of recently installed VPN software; review endpoint telemetry for trojanized WireGuard indicators.
  6. Gunra Ransomware: Validate patch status for Fortinet and Schneider Electric products; review CISA joint advisory for IOCs; confirm offline backup availability.
  7. TYPO3 Core (WID-SEC-2026-2744): Apply TYPO3 security updates; relevant for German public sector deployments.
  8. CyberPanel (WID-SEC-2026-2743): Apply updates; restrict management interface to trusted IPs.
  9. Mozilla Firefox/Thunderbird Linux signing key: Update GPG trust stores on Linux systems and packaging pipelines.
  10. Continue remediation of previously reported items: CVE-2026-72898/CVE-2026-72899 (Metabase, KEV deadline 2026-08-14), CVE-2026-63077 (TeamCity), CVE-2026-0257 (PAN-OS), CVE-2026-16232 (Check Point), CVE-2026-8037 (LoadMaster), BdThemes WordPress supply chain.