CISA added four vulnerabilities to its Known Exploited Vulnerabilities catalog on August 18, 2026, setting a federal remediation deadline of August 21 under Binding Operational Directive 26-04. Two of the four were already in Still Watching from prior CyberSip issues: CVE-2026-59310 in VMware vCenter, covered since Issue 97, and CVE-2026-65400 in Apple macOS Screen Sharing, covered since Issue 109. The two that had not previously appeared as confirmed exploited in this brief are new urgency items today. CVE-2026-33824 is a double-free memory corruption vulnerability in the Windows Internet Key Exchange Service Extensions component. The IKE service handles IPsec key negotiation for VPN connections and is enabled by default on Windows systems that use IPsec or L2TP VPN configurations. An unauthenticated remote attacker can send specially crafted network packets to trigger the double-free, corrupting memory in a way that allows arbitrary code execution with the privileges of the affected service. The flaw is scored CVSS 9.8. No credentials and no user interaction are required. Blocking UDP ports 500 and 4500 at the network perimeter reduces exposure from external sources but does not protect against lateral movement within the network from an attacker who has already established a foothold. The patch is in the August 2026 Patch Tuesday release. CVE-2026-55040 is a weak authentication vulnerability in Microsoft Office SharePoint. An unauthenticated remote attacker can exploit the flaw to bypass a security feature over the network. SharePoint is used as a document management, intranet, and collaboration platform in most large enterprises, and authentication bypass at the network layer has historically been the entry point for data exfiltration campaigns targeting SharePoint content. The CVSS score is 9.1. No credentials and no user interaction are required. The patch is also in the August 2026 Patch Tuesday release. CISA confirmed that both are being exploited in the wild as of the August 18 addition date.

WatchTowr and VulnCheck published independent analyses on August 18 of active exploitation activity targeting two recently disclosed vulnerabilities in platforms at opposite ends of the enterprise technology stack. MLflow CVE-2026-64849 is a CVSS 9.3 server-side request forgery vulnerability in MLflow versions before 3.15.0. MLflow is the dominant open-source platform for AI and machine learning lifecycle management, used for experiment tracking, model registry, and deployment across both research and production AI environments. The flaw is in the unauthenticated POST /api/2.0/mlflow/webhooks/{id}/test endpoint. MLflow's webhook validation function checks only the original URL for safety, while the webhook delivery function follows HTTP redirects and re-resolves the hostname at the new destination without pinning the validated address. An attacker who can reach the MLflow Tracking Server, which is often exposed on port 5000 or 5001, can craft a webhook test request with a URL that redirects to an internal cloud metadata endpoint, such as http://169.254.169.254 on AWS, Azure, or GCP. MLflow follows the redirect and returns the response body to the attacker, including the instance identity document, IAM role credentials, and any secrets stored in the metadata service. WatchTowr confirmed active exploitation of CVE-2026-64849 as of August 18. The patch is MLflow 3.15.0. FUXA CVE-2026-25895 is a CVSS 9.5 vulnerability that combines missing authentication for a critical function with a path traversal component. FUXA is an open-source web-based SCADA/HMI platform for operational technology and industrial automation. The flaw allows an unauthenticated remote attacker to write arbitrary files to the server file system through path traversal. Writing to a location that the FUXA application loads or executes from converts the file write into remote code execution. VulnCheck observed a single source IP actively scanning for exposed FUXA instances beginning August 18, attempting to overwrite a core application file with empty data. VulnCheck estimates approximately 60 FUXA installations are publicly internet-accessible. No successful code execution has been confirmed in the wild for FUXA as of August 18, but the scanning pattern confirms attacker awareness of the flaw and active probing of exposed instances.

Oracle released its August 2026 Critical Patch Update on August 19, 2026. The CPU is Oracle's quarterly security release, addressing vulnerabilities across its full product portfolio. This release covers more than 1,000 CVEs across more than two dozen product families. More than 460 of the patched vulnerabilities are remotely exploitable without requiring authentication, the highest-severity category in terms of attack accessibility. Affected product families include Oracle Database Server, Oracle WebLogic Server, Oracle MySQL, Oracle E-Business Suite, Oracle Fusion Middleware, Oracle Java SE, Oracle Communications applications, Oracle Retail applications, and Oracle Financial Services applications. CVE-2026-60702, rated CVSS 9.9, is a critical flaw in Oracle WebLogic Server. WebLogic is an application server widely deployed for Java EE applications in enterprise environments, including financial services, insurance, and government systems. The CVSS 9.9 score indicates an unauthenticated, remotely exploitable flaw with near-maximum impact on confidentiality, integrity, and availability. SecurityWeek described the flaw as allowing complete server takeover. Oracle published nine specific WebLogic fixes in the August CPU. Exploitation has not been confirmed in the wild as of August 19. Oracle's security advisory recommends applying the CPU patches to all affected product versions without delay and notes that customers who delay applying patches expose themselves to risk from exploits that specifically target the vulnerabilities addressed in the current CPU.