Microsoft disclosed CVE-2026-69836 on August 20, 2026, confirming that the vulnerability had already been exploited in the wild and that Microsoft had already deployed the fix to Entra ID's infrastructure before public disclosure. The vulnerability is a deserialization of untrusted data flaw classified under CWE-502 in Microsoft Entra ID, the cloud-based identity and access management platform formerly known as Azure Active Directory. Entra ID is the authentication and authorization backbone for Microsoft 365, Azure services, and any third-party application that uses Entra for single sign-on or OAuth integration. The flaw allowed an unauthenticated remote attacker to send specially crafted serialized data to a vulnerable Entra ID endpoint. Without adequate validation of the incoming data, the service reconstructed the malicious object, enabling the attacker to execute arbitrary code in the context of the affected service. No authentication was required. No user interaction was required. The CVSS score is 10.0, the maximum possible. Microsoft's advisory states the vulnerability has been fully mitigated and that there is no action for customers to take regarding patching. Microsoft has not disclosed when exploitation began, how long it was active, who was behind it, how many tenants were affected, or what the attacker did with code execution on Entra's backend. Microsoft has also not disclosed whether the code execution could be used to access tenant data, manipulate authentication tokens, alter access policies, or perform any specific action against connected Microsoft 365 or Azure environments. The disclosure exists under Microsoft's cloud service CVE transparency policy, which surfaces exploited flaws even when the fix is infrastructure-side, so customers can investigate whether they were affected.

WatchTowr's honeypot network detected the first confirmed in-the-wild exploitation attempts targeting CVE-2026-19478 in GitLab as of August 21, 2026. GitLab issued its emergency patch on August 17, four days ago. This brief covered the vulnerability in Issue 111, at which point no exploitation had been confirmed. The NSA and CISA published a joint advisory on August 21 covering CVE-2026-19478, providing specific detection guidance and recommending immediate remediation for all self-managed GitLab instances. The joint advisory names the specific GraphQL directive involved in the attack as @gl_introduced, which was the detail under a 90-day technical embargo since the August 17 patch. With exploitation now confirmed and the joint advisory publishing this indicator, WatchTowr's principal security researcher Jake Knott recommended that unpatched organizations immediately audit web server logs for requests containing @gl_introduced and identify any signs of probing or exploitation. Knott noted that the flaw enables unauthenticated attackers to delete public GitLab projects, rewrite their state, or manipulate merge records with a single HTTP request, and that WatchTowr was able to demonstrate the vulnerability within minutes using the advisory details and patch diffing. The 18.2 through 18.10 branch gap remains unresolved. GitLab has not published a patch for those versions. No specific attribution for the exploitation attempts has been published.

Hunt.io researchers disclosed Operation CameraSwarm on August 21, 2026, a campaign targeting Dahua IP cameras that ran from June 17 through July 22, 2026. Dahua is a major Chinese manufacturer of IP cameras used in physical security, surveillance, and monitoring deployments worldwide. The campaign was not discovered through traditional threat intelligence channels. Instead, Hunt.io found an exposed working directory on the attackers' own infrastructure, an open web-accessible directory containing 407MB of data spread across 2,616 files in 234 subdirectories. The exposed data included attack tooling, session logs, shell history, campaign records, and configuration files that allowed Hunt.io to reconstruct the campaign in detail. The attackers used three entry methods: credential attacks against cameras with default or weak passwords, exploitation of two authentication bypass vulnerabilities in Dahua products, and a peer-to-peer relay technique that abused Dahua's own P2P cloud connectivity feature. The P2P feature is designed to allow remote access to cameras through Dahua's cloud relay without opening ports, which means cameras reachable through this method are accessible even if they are not directly internet-exposed. Of the 14,530 cameras reached during the campaign, 1,923 were configured with a persistent backdoor administrative account during the operation and 283 were accessed specifically through the P2P relay path. Compromised cameras were concentrated in Ukraine and Russia, according to Hunt.io's geographic analysis of the campaign records. The specific Dahua authentication bypass CVEs used were not named in the initial disclosure but are described as two separate flaws documented in the working directory. Hunt.io recommended that Dahua camera operators install corresponding fix software or newer firmware, disable the P2P feature where it is not actively required, and verify firmware against the vendor's download site to ensure it has not been tampered with.