Daily Threat Briefing
← All briefings

Tenable Security Center · IBM Db2 Mirror for i · SAP Commerce Cloud

Date: 2026-08-15 Prepared for: SOC Analysts | Incident Responders | Vulnerability Management | Security Leadership

Executive Summary

A maximum-severity SAP Commerce Cloud RCE vulnerability is now being actively targeted in attacks within days of patching. A macOS Screen Sharing authentication bypass is under active exploitation following public PoC release, with the Dutch NCSC issuing a warning. Tenable Security Center carries three critical command injection flaws — one unauthenticated — requiring immediate upgrade to 6.9.0. Multiple IBM Db2 Mirror for i vulnerabilities (CVSS 9.8–9.9) were published, covering unauthenticated RCE, auth bypass, and path traversal. Metasploit 6.5 shipped 13 new exploit modules covering a broad range of enterprise targets.

Critical Vulnerabilities

CVE-2026-19682 — Tenable Security Center

  • Severity: CVSS 9.4
  • EPSS: Not yet scored
  • Technical detail: Unauthenticated remote command injection in Tenable Security Center (all versions before 6.9.0). A remote attacker with no credentials can execute arbitrary OS commands on the underlying system. Two companion flaws — CVE-2026-19681 (authenticated file-upload command injection, CVSS 9.4) and CVE-2026-19626 (authenticated RCE via report generation, CVSS 9.4) — affect the same version range. Security Center is a privileged network management platform; compromise grants broad visibility into the vulnerability posture of the entire environment.
  • Exploitation status: No confirmed exploitation; unauthenticated attack vector elevates urgency.
  • Remediation: Upgrade Tenable Security Center to 6.9.0 immediately. Restrict management interface access to trusted networks as an interim control. Also apply fix for companion CVEs CVE-2026-19681, CVE-2026-19679, and CVE-2026-19626.

CVE-2026-17186 / CVE-2026-17184 / CVE-2026-17182 — IBM Db2 Mirror for i

  • Severity: CVSS 9.9 / 9.8 / 9.8
  • EPSS: Not yet scored
  • Technical detail: Three critical unauthenticated remote vulnerabilities in IBM Db2 Mirror for i 7.4, 7.5, and 7.6. CVE-2026-17186 allows arbitrary CL command execution via improper neutralization of special elements. CVE-2026-17184 enables arbitrary code execution via external control of file name or path. CVE-2026-17182 permits authentication bypass and sensitive data access/modification via improper URI path segment validation. A fourth flaw, CVE-2026-17181 (CVSS 9.3), adds arbitrary file write via path traversal. All are remotely exploitable without authentication on affected versions.
  • Exploitation status: No confirmed exploitation; published 2026-08-14.
  • Remediation: Apply IBM PTFs for Db2 Mirror for i 7.4, 7.5, and 7.6 immediately. Isolate Db2 Mirror management interfaces from untrusted networks pending patching.

CVE-2026-58231 (STATUS CHANGE) — SAP Commerce Cloud

  • Severity: CVSS 10.0
  • Exploitation status: STATUS CHANGE — active exploitation confirmed. Threat intelligence firm Defused reports attacks began within days of the patch released 2026-08-11. Treat unpatched internet-facing instances as compromised.
  • Remediation: Apply SAP August Security Notes immediately if not already done; audit for indicators of compromise.

CVE-2026-48907 — Joomla Content Editor (JCE) Extension

  • Severity: Not yet assigned (CVSS pending)
  • EPSS: Not yet scored
  • Technical detail: Unauthenticated arbitrary profile creation in JCE for Joomla (all versions ≤ 2.9.99.4). The profiles.import task lacks authentication enforcement, allowing an attacker to import a crafted profile written to disk as a PHP web shell. Remote code execution follows when the tmp/ directory is web-accessible. A Metasploit module (multi/http/joomla_com_jce_unauth_file_upload_rce) was published 2026-08-14, significantly lowering the exploitation barrier.
  • Exploitation status: Public Metasploit module available; exploitation likely imminent.
  • Remediation: Update JCE to a version above 2.9.99.4 immediately. Audit Joomla tmp/ directories for unexpected PHP files. Restrict web server access to tmp/ as an interim control.

CVE-2026-15341 / CVE-2026-15303 — WordPress Authentication Bypass Plugins

  • Severity: CVSS 9.8 (both)
  • EPSS: Not yet scored
  • Technical detail: Two separate WordPress plugin authentication bypass vulnerabilities published 2026-08-15. CVE-2026-15341 (User Session Synchronizer ≤ 1.4.0): the synchronize_session() function can be abused to take over arbitrary accounts. CVE-2026-15303 (6Storage Rentals ≤ 2.27.0): the six_storage_create_wp_user() AJAX handler is unauthenticated, enabling account creation and privilege escalation. Both allow full account takeover without credentials on affected WordPress installations.
  • Exploitation status: No confirmed exploitation; published 2026-08-15.
  • Remediation: Update User Session Synchronizer and 6Storage Rentals plugins immediately. If updates are unavailable, deactivate the plugins. Audit WordPress user tables for unexpected accounts.

ONGOING:

  • CVE-2026-59310 (VMware vCenter): Active exploitation with reverse SSH persistence confirmed — patch immediately, hunt for SSH persistence.
  • CVE-2026-55040 (SharePoint): Active exploitation post-PoC — apply July 2026 Patch Tuesday; treat unpatched instances as compromised.
  • CVE-2026-68820 (Windows AFD/Lazarus): CISA KEV deadline 2026-08-25 — apply August Patch Tuesday.
  • CVE-2026-72642 (Elasticsearch): No confirmed exploitation — upgrade to 8.19.20+/9.4.5+.
  • CVE-2026-14525 (IBM WebSphere Liberty): No confirmed exploitation — apply IBM fix or disable rtcomm features.
  • CVE-2026-63077 (JetBrains TeamCity): Actively exploited — upgrade to 2026.1.3.
  • CVE-2026-0257 (PAN-OS GlobalProtect): Qilin ransomware exploitation ongoing — patch immediately.
  • CVE-2026-16232 (Check Point SmartConsole): Actively exploited — treat unpatched instances as compromised.
  • CVE-2026-8037 (Progress Kemp LoadMaster): Ransomware exploitation confirmed — patch immediately.
  • CVE-2026-20349 (Cisco ASA/FTD) and CVE-2026-72898/72899 (Metabase): CISA KEV deadlines passed — patch immediately if not done.

European Advisories

BSI published a large batch of new and updated advisories on 2026-08-14.

New advisories (2026-08-14): BSI issued new high-severity advisories for Golang Go (WID-SEC-2026-2850) — multiple flaws enabling DoS, XSS, security bypass, and data manipulation; apply Go runtime updates. Budibase (WID-SEC-2026-2849) — authenticated attackers can manipulate files, disclose sensitive data, escalate privileges, and bypass security controls; apply Budibase updates. PostgreSQL (WID-SEC-2026-2844) — RCE, SQL injection, security bypass, data disclosure/manipulation, and DoS; apply PostgreSQL updates immediately given enterprise prevalence. Elasticsearch (WID-SEC-2026-2841) — RCE and DoS; see CVE-2026-72642 in yesterday’s report. vllm (WID-SEC-2026-2842) — information disclosure, data manipulation, security bypass, DoS in the AI inference framework; apply updates. BigBlueButton (WID-SEC-2026-2845) — unauthenticated remote information disclosure; apply updates.

Updated advisories (2026-08-14): BSI updated advisories for Linux Kernel (critical, WID-SEC-2026-2640 and multiple high-severity kernel advisories), Microsoft Windows products (critical, WID-SEC-2026-2756), Microsoft Developer Tools (WID-SEC-2026-2761), Google Chrome (WID-SEC-2026-2790), ISC BIND (WID-SEC-2026-2484), Synacor Zimbra (two advisories updated), and FreeRDP. No material new exploitation data in these updates; apply vendor patches per standard cycle.

Fortinet FortiWeb (Heise Security): Fortinet patched multiple vulnerabilities in FortiWeb, including an authentication bypass allowing login with arbitrary credentials. Apply FortiWeb security updates immediately; no BSI advisory number available at time of writing.

Active Threats and Campaigns

NEW — macOS Screen Sharing authentication bypass (active exploitation): The Netherlands’ NCSC warns that attackers are actively exploiting a macOS authentication bypass vulnerability in the Screen Sharing service following the release of public exploit code. Organizations with macOS endpoints — particularly those with Screen Sharing enabled — should apply Apple security updates immediately, disable Screen Sharing where not required, and review remote access logs. No CVE identifier was available in source data at time of writing.

NEW — Commerzbank customer fraud via service provider flaw (€30M): Four suspects were arrested in Brazil and three charged in Europe for exploiting a vulnerability in a financial service provider to fraudulently withdraw funds from Commerzbank customer accounts, totalling approximately €30M. This highlights third-party/supply-chain risk in financial sector infrastructure. European financial institutions should audit service provider access controls and transaction monitoring for anomalous patterns.

NEW — Clop claims Shell data theft: The Clop ransomware group claims to have stolen 89 GB of data from oil major Shell. Shell has confirmed it is investigating a “potential incident.” No technical details or IOCs are publicly available; monitor for further disclosure.

ONGOING — Lazarus Group / Operation Dream Job (CVE-2026-68820): No new developments; European defense/aerospace organizations continue hunting with Check Point IOCs.

ONGOING — Akira ransomware EDR Safe Mode bypass: No new developments; enforce Safe Mode boot restrictions via GPO.

Security News and Context

  • SAP Commerce Cloud under active attack: A max-severity RCE flaw patched 2026-08-11 is already being exploited — covered in Critical Vulnerabilities above. (Bleeping Computer)
  • RingCentral breach — 1.6M accounts: ShinyHunters stole personal data from 1.6 million RingCentral accounts after a July intrusion; organizations using RingCentral should notify affected users and review API access. (Bleeping Computer)
  • Apple mercenary spyware alerts in 110 countries: Apple has issued threat notifications to users in 110 countries targeted by mercenary spyware — covered in yesterday’s report; no material change. (Heise Security)
  • AMD PSP side-channel: Researchers demonstrated a side-channel attack against the AMD Platform Security Processor (PSP) RAM address management on older AMD CPUs, enabling access to nominally protected memory regions. (Heise Security)
  1. Tenable Security Center (CVE-2026-19682 et al.): Upgrade to 6.9.0 immediately; restrict management interface to trusted networks.
  2. SAP Commerce Cloud (CVE-2026-58231): Active exploitation confirmed — patch immediately; treat unpatched instances as compromised and initiate IR review.
  3. IBM Db2 Mirror for i (CVE-2026-17186/17184/17182/17181): Apply IBM PTFs for all affected versions (7.4–7.6); isolate management interfaces.
  4. Joomla JCE (CVE-2026-48907): Update JCE above 2.9.99.4; audit tmp/ for PHP web shells; restrict web server access to tmp/.
  5. WordPress plugins (CVE-2026-15341, CVE-2026-15303): Update or deactivate User Session Synchronizer and 6Storage Rentals; audit user tables for unauthorized accounts.
  6. macOS Screen Sharing (active exploitation): Apply Apple security updates; disable Screen Sharing where not operationally required; review remote access logs.
  7. PostgreSQL (BSI WID-SEC-2026-2844): Apply PostgreSQL security updates; review for SQL injection exposure.
  8. Fortinet FortiWeb (auth bypass): Apply Fortinet security updates immediately; audit for unauthorized access.
  9. RingCentral breach: Identify organizational RingCentral accounts; assess data exposure and notify affected users per GDPR obligations.
  10. Continue remediation of previously reported items: CVE-2026-59310 (vCenter), CVE-2026-55040 (SharePoint), CVE-2026-68820 (Windows/Lazarus — KEV deadline 2026-08-25), CVE-2026-72642 (Elasticsearch), CVE-2026-14525 (WebSphere Liberty), CVE-2026-63077 (TeamCity), CVE-2026-0257 (PAN-OS), CVE-2026-16232 (Check Point), CVE-2026-8037 (LoadMaster).