A Security researchers disclosed CVE-2026-53413 on August 11, 2026, in Zoom's security bulletin ZSB-26015, following a coordinated disclosure process that began on June 10. The vulnerability is a stack buffer overflow in the CAnnoFormatBlock::Deserialize routine inside Zoom's annotation engine, the component that processes the drawing, highlighting, and text annotations participants can create during screen sharing sessions. Zoom's annotation feature uses a proprietary protocol that opens a direct communication channel between the screen sharer and each viewer. The parser in CAnnoFormatBlock::Deserialize accepts 32-bit character counts from the network for text-formatting blocks without checking those counts against the fixed 128-byte buffers that hold them. A crafted annotation message with an oversized fourth character count runs off the end of the containing object, overwrites saved registers and the return address on the stack, and transfers execution to attacker-controlled code. The victim must be participating in the meeting. No other interaction is required: no click, no download, no prompt, no visible indicator. A Security demonstrated the exploit by launching Safari on the victim's macOS machine. Their working exploit was built in under 24 hours using fewer than 20 prompts on publicly available AI models, a capability the researchers disclosed explicitly in their write-up. Zoom patched the vulnerability in Workplace 7.1.5 and 7.0.6 and Rooms 7.1.5, released August 11, 2026. Zoom also applied a server-side mitigation before the client patch shipped, filtering malicious annotation messages at the server, but noted that server filtering cannot inspect annotation traffic when end-to-end encryption is enabled, because the server cannot read the encrypted message contents. Three additional CVEs were patched in the same bulletin: CVE-2026-53414, a buffer over-read in the same annotation parser that can expose memory or crash participants; CVE-2026-53415, a use-after-free in annotation metadata that Zoom had already discovered internally; and CVE-2026-53416, a path traversal in the Zoom Workplace VDI Client for Windows. No exploitation in the wild has been confirmed.

Researchers documented Evooo1Bot on August 16, 2026, a botnet campaign targeting Linux-based small office and home office routers from manufacturers including Asus, TP-Link, Netgear, and D-Link. The campaign enters devices through two primary paths: known CVEs in router management interfaces and web administration panels that device owners have not patched, and default or weak administrative credentials that have not been changed from factory settings. Once inside, Evooo1Bot deploys a persistent agent that registers the device as a residential proxy node. Residential proxy nodes are valuable to threat actors because their traffic originates from IP addresses assigned to legitimate home and small business internet connections rather than data center IP ranges, making them significantly harder to block through IP reputation filtering. The botnet operators use the accumulated proxy network for three documented operations: credential stuffing attacks against web applications and enterprise login portals, where the distributed residential IPs make rate-limiting and IP-based lockouts less effective; DDoS amplification campaigns, where compromised routers relay and amplify attack traffic; and data exfiltration tunneling, where traffic from compromised enterprise environments is routed through the proxy network to obscure the destination. The persistence mechanism survives router reboots. Device owners whose routers were compromised before patching or credential rotation will continue to have compromised devices after any remediation of the downstream targets, because the router itself remains under attacker control.

Active exploitation of CVE-2026-58231 in SAP Commerce Cloud's Data Hub Adapter was confirmed at scale by August 14 and reported by SecurityWeek on August 17. The exploitation pattern observed matches the attack path described in the emergency advisory: unauthenticated code injection through the Data Hub Adapter endpoint that executes arbitrary code on the affected Commerce Cloud system. SecurityWeek reports that confirmed exploitation has allowed attackers to reach internal SAP components beyond the Data Hub Adapter itself, meaning the code execution foothold is being used to pivot within the SAP environment. CISA added forensics triage requirements to the CVE-2026-58231 KEV entry, consistent with its treatment of the LoadMaster and vCenter campaigns where confirmed exploitation at scale warranted explicit guidance that patching alone is insufficient. SAP Commerce Cloud is used by large retailers, manufacturers, distributors, and e-commerce operators to manage digital sales channels, order processing, pricing, product catalogs, and customer data. The Data Hub Adapter connects those commerce workflows to backend ERP systems, product information management platforms, external marketing systems, and logistics partners. An attacker with code execution inside the Data Hub Adapter has access to the integration credentials connecting those systems, the data flows between them, and in confirmed cases, the ability to pivot to adjacent internal SAP components. SAP released the emergency patch on August 13, one day after August Patch Day, at a moment when enterprise teams were already processing the Microsoft, Adobe, and Cisco patch batches. Organizations that deferred the emergency SAP note given the simultaneous patch volume are now among the confirmed exploitation cases.