Microsoft's August update carried a single exploited zero-day, and the research behind it names India among the countries where a North Korean campaign has been aiming fake recruitment lures at defence and aerospace suppliers. CISA added three vulnerabilities to its Known Exploited catalogue on 11 August with remediation due within three days, among them a Cisco firewall flaw that crashes remote-access VPN appliances and an analytics platform flaw scored at maximum severity. A load balancer family widely deployed in Indian data centres reached the same catalogue days earlier. Two further incidents this week required no vulnerability at all: a ransomware intrusion that walked in through a VPN without multi-factor authentication, and a phishing campaign hidden inside image files that most mail gateways do not inspect.
1HighCVSS 7.0
Windows AFD.sys Privilege Escalation Exploited in Fake-Recruitment Campaign — CVE-2026-68820
CVSS 7.0 | Microsoft Patch Tuesday, 11 August; CISA KEV, 11 August* Microsoft's 11 August 2026 release addressed 421 vulnerabilities, of which this was the only one already under attack. The flaw is a use-after-free in the Ancillary Function Driver for WinSock, the kernel-mode driver behind the Windows Sockets API. A locally authenticated attacker who runs a crafted application can win a race condition, obtain a kernel read and write primitive, and escalate to SYSTEM. It is not an initial-access flaw; it is what turns one user's mistake into control of the machine. Check Point Research attributes the exploitation to the North Korea-linked Lazarus group's Operation Dream Job, which uses fake job offers and trojanised PDF software against defence, aerospace, aviation, drone, robotics and military-technology organisations, and names India among the affected countries alongside France, Germany and Brazil. After escalating, the operators deployed the FudModule v3.1 kernel-mode rootkit to suppress endpoint security visibility.
India exposureIndian defence suppliers, aerospace and aviation engineering firms, drone and robotics manufacturers and their subcontractors are within the stated target set. Recruitment lures reach engineers directly, often on personal devices and personal messaging, well outside the mail gateway.
ActionDeploy the August Windows updates, prioritising engineering, research and privileged-administrator endpoints. Brief technical staff that unsolicited job approaches carrying documents or software to install are an active intrusion vector in this sector. Verify that endpoint tooling still reports after driver-level tampering, since a rootkit that silences the agent also silences the alert.
SourceCheck Point Research, 11 August 2026; SecurityWeek, 11 August 2026; Help Net Security and SOC Prime, 12 August 2026; CISA KEV addition, 11 August 2026.
2HighCVSS 8.6
Cisco Secure Firewall ASA and FTD Remote-Access VPN Flaw Exploited to Crash Appliances — CVE-2026-20349
CVSS 8.6 | CISA KEV, 11 August — federal remediation due 14 August* Insufficient error checking when the appliance processes HTTP requests lets a remote, unauthenticated attacker send a crafted request to the Remote Access SSL VPN service and force the device to reload. Cisco says it became aware of active exploitation in August 2026, having found the issue through internal security testing alongside a report from researcher Valerio Brussani. Devices are affected where IKEv2 Remote Access VPN with client services, SSL VPN, or Zero Trust Network Access on Threat Defense is enabled. Cisco states there is no workaround that addresses the flaw.
India exposureThis is a remote-access outage risk rather than a data-theft one, which changes who feels it first. Indian BFSI, IT services and government-contracting organisations running remote workforces on ASA or FTD lose VPN availability at the attacker's choosing, including during an incident response that depends on that same VPN.
ActionApply the Cisco hotfix or fixed release for your train; hotfixes cover ASA 9.16, 9.18, 9.20, 9.22, 9.23 and 9.24, and FTD 7.0, 7.2, 7.4, 7.6, 7.7 and 10.0. Confirm which remote-access services are actually enabled and disable those not in use. Treat repeated unexplained reloads on an internet-facing appliance as a security event, not a stability one.
SourceBleepingComputer, 11 August 2026; The Hacker News, 12 August 2026; CISA KEV addition, 11 August 2026.
CVSS 10.0 | Disclosed 8 August; CISA KEV, 11 August — federal remediation due 14 August* An unauthenticated attacker can inject SQL through the POST /api/session/reset_password endpoint and obtain administrator access to the Metabase instance. Metabase found the flaw while its own cloud platform was under attack on 2 August 2026 and disclosed it on 8 August. Affected releases are 1.58.x below 1.58.24, 1.59.x below 1.59.21, 1.60.x below 1.60.17, 1.61.x below 1.61.11, 1.62.x below 1.62.9 and 1.63.x below 1.63.5. The consequence is worth stating plainly: administrator access to a business-intelligence platform may expose the stored credentials for every database connected to it, and the data reachable through those connections.
India exposureMetabase is common in Indian fintech, SaaS and analytics teams precisely because it is quick to self-host, and those instances sit deliberately close to production data stores. Internet-reachable deployments are the immediate concern; instances exposed only to a partner VPN are not far behind.
ActionUpgrade to the fixed build for your train without waiting for a maintenance window. Remove internet exposure until patched. Rotate the database credentials Metabase holds, on the assumption that admin access implies credential access, and review logs for password-reset requests that return an error followed by an authenticated session.
SourceThe Hacker News, 8 August 2026; CISA KEV addition, 11 August 2026.
4CriticalCVSS 9.6
Progress LoadMaster Command Injection Under Sustained Exploitation — CVE-2026-8037
CVSS 9.6 | CISA KEV, 7 August — federal remediation due 10 August* Improper handling of user-supplied input in the appliance's escape_quotes() function allows an unauthenticated attacker to inject operating-system commands through API endpoints and execute code as root. watchTowr Labs published analysis in June 2026, and public exploitation followed the release of proof-of-concept code on 29 June; eSentire reported exploitation attempts through July. KEVIntel telemetry cited in reporting on the KEV addition counted 792 exploitation attempts over 41 days from 65 unique addresses across 18 countries, with activity as recent as 4 August. The scope is wider than the LoadMaster name suggests: ECS Connection Manager, Connection Manager for ObjectScale and MOVEit WAF are also affected.
India exposureLoad balancers sit in front of the application, which is the point of them and also the problem here. Indian data centres, payment platforms, hospital systems and public-sector application estates using these Progress appliances for internet-facing traffic should treat any reachable management or API interface as critical exposure.
ActionMove to LoadMaster GA 7.2.63.2 or LTSF 7.2.54.18 or later, and check whether ECS Connection Manager, ObjectScale Connection Manager or MOVEit WAF are also deployed. Restrict the management and API interfaces to an administrative network rather than relying on the appliance's own access controls. Given exploitation predates the patch by weeks, review appliance logs and configuration for unauthorised change before assuming a clean upgrade.
SourceThe Hacker News, 8 August 2026; SecurityWeek, 10 August 2026; CISA KEV addition, 7 August 2026.
5
Akira Affiliate Reaches Domain Enumeration in Seven Minutes Through a VPN Without MFA
No CVE | Huntress incident report, 12 August 2026* Huntress reported an intrusion that is instructive precisely because no vulnerability was involved. On 4 August 2026 at 03:45 UTC, a credential spray began against a SonicWall SSL VPN. At 03:52 UTC one account succeeded from an external address, against a VPN with no multi-factor authentication in front of it. Hands-on activity and Active Directory enumeration followed from around 05:30 UTC. At 06:29 UTC the operator rebooted the host into Safe Mode with Networking using msconfig, which took the endpoint agent and Defender real-time protection offline together while keeping network access. The ransomware ran at 06:34 UTC but failed in Safe Mode's restricted memory environment, and the payload was quarantined once the host returned to normal mode at 08:10 UTC. The encryption failed by accident, not by design.
India exposureMid-market Indian manufacturing, healthcare and regional government networks frequently run remote access on a VPN appliance where multi-factor authentication was scoped for a later phase that has not arrived. Seven minutes from first spray attempt to valid session is the figure worth putting in front of a budget committee.
ActionEnforce MFA on every remote-access path without exception, and treat any VPN account exempted from it as a known open door. Alert on authentication bursts against the VPN and on Safe Mode boot configuration changes, which have no legitimate place in normal server operation. Confirm that endpoint tooling reports its own absence.
SourceHuntress, 12 August 2026.
6
Seqrite Warns Indian Enterprises Over SVG Files as a Phishing Delivery Vector
No CVE | Seqrite advisory, reported 10 August 2026* Seqrite, the enterprise arm of Quick Heal, warned that attackers are embedding JavaScript and redirection logic inside SVG vector graphics to deliver phishing to Indian organisations. The format's advantage to the attacker is that controls treating SVG as an ordinary image will not inspect the script or the URL inside it. In one case Seqrite describes, the file executed embedded script in the browser and redirected the user to a counterfeit Microsoft 365 login page built to harvest credentials. The warning draws on Seqrite's India Cyber Threat Report 2026, which recorded 265.52 million detections across more than eight million endpoints.
India exposureSVG moves through exactly the workflows that raise no suspicion, including marketing, design, web publishing and document collaboration. Organisations where design and content files circulate routinely between agencies and internal teams have the weakest natural checkpoint.
ActionApply script and URL inspection to SVG attachments and downloads at the mail gateway and browser layers rather than exempting them as images. Add behaviour-based detection for browser-initiated redirection to credential-collection pages, and confirm that phishing-resistant authentication is in place for Microsoft 365, since credential harvesting is the objective here.
SourceCIOL, 10 August 2026; IT Voice and NCN Online, August 2026.
Takeaway
Two of this week's items required no vulnerability and two required no user. The Cisco, Metabase and Progress flaws are all reachable by an unauthenticated attacker from outside, and all three carried a CISA deadline of three days or fewer, which is the closest thing the catalogue offers to an urgency signal. The Lazarus campaign and the SVG phishing warning run the other way, through a person, and the AFD.sys flaw is what connects the two halves: the lure gets code running as a user, the driver flaw makes it SYSTEM, and the rootkit removes the evidence. The Akira intrusion sits outside both patterns and is the cheapest lesson of the week, in that MFA on one VPN account would have ended it before minute eight. This week's vendor sweep also checked Fortinet, Palo Alto Networks, Check Point, Juniper, Sophos, Barracuda, WatchGuard, Zscaler, Citrix NetScaler, Ivanti, F5 BIG-IP, Versa, VeloCloud and Aruba EdgeConnect by name. Palo Alto's 12 August bulletin covering eleven vulnerabilities topped out at 7.2 with none exploited, and Fortinet's FortiWeb and FortiManager authentication fixes carry no reported exploitation; neither displaced the six items above.
