FOCUS FRIDAY: TPRM Insights on Critical Vulnerabilities in Rockwell PLCs, Metabase, Cisco ASA & FTD, Cisco IMC, Cisco IOS XE, Adobe ColdFusion, SharePoint, Exchange Server, ClamAV, pgAdmin, Django, and Jenkins

Introduction

This week's Focus Friday covers twelve FocusTags spanning industrial control systems at water utilities, business intelligence platforms, network security infrastructure, out-of-band server management, network operating systems, web application frameworks, database administration tools, antivirus engines, and CI/CD automation. The week is anchored by an active FBI- and EPA-confirmed cyber campaign against U.S. water utilities and a sweeping Microsoft Patch Tuesday addressing vulnerabilities across both SharePoint and Exchange Server.

The most operationally significant event is the active campaign targeting internet-facing Rockwell Automation MicroLogix PLCs at water and wastewater utilities across at least seven U.S. states — with confirmed operational disruptions including pressure loss, flooding, and modified PLC ladder logic. Metabase's maximum-severity zero-day SQL injection, confirmed exploited before disclosure with breach victims including Framework, n8n, and Kilo Code, is the highest-urgency software vulnerability of the week. Cisco's August security releases simultaneously address three product lines: ASA and FTD VPN gateways under active exploitation, IMC server management controllers with a public PoC enabling low-privilege to root escalation, and IOS XE with seven vulnerabilities across the enterprise routing and switching estate.

Filtered view of vendors with Water Sector Campaign FocusTag® on the Black Kite platform.

Water Sector Campaign

What is this vulnerability?

Since July 27, 2026, the FBI and EPA have confirmed a coordinated cyber campaign targeting internet-facing Rockwell Automation/Allen-Bradley MicroLogix 1100 and 1400 series PLCs deployed at water and wastewater utilities across at least seven U.S. states. The observed attack methodology requires no software vulnerability exploit: attackers are abusing direct, unauthenticated EtherNet/IP exposure on port 44818 present in default or misconfigured deployments. After remotely accessing internet-facing PLCs, threat actors changed IP addresses and set unauthorized passwords, causing operators to lose visibility and control of connected equipment. At least one victim discovered modified PLC project files with altered ladder logic. No formal attribution has been made by any government agency. The campaign carries a distinct ICS-specific risk dimension through the presence of CVE-2017-16740 (Rockwell CVSS 8.6) — a Modbus TCP buffer overflow in MicroLogix 1400 Series B and C firmware 21.002 and earlier, fixed in revision 21.003. Security researchers identified 22 internet-facing Rockwell controllers in cities matching reported attack locations, 19 of which ran firmware susceptible to CVE-2017-16740.

The Forescout August 3 scan counted 4,407 exposed Rockwell controllers worldwide, including 2,844 in the United States. Over 70% of U.S.-based exposed controllers were connected via large mobile carrier networks (Verizon Business, AT&T Mobility, T-Mobile USA accounting for 59% of Censys results). Similarities in third-party network configurations across multiple victim organizations suggest the campaign may scale systematically across customers sharing common provider setups. Critically, MicroLogix 1100 reached end-of-life on April 30, 2022 and receives no further security patches, making network isolation and compensating controls the only viable protection for organizations still operating this hardware. The FBI and EPA joint PSA published on July 30, 2026 provides IoC lists and recommends immediate disconnection from the public internet as the highest-impact single mitigation available.

Why should TPRM professionals care?

This event represents the intersection of operational technology security and public health: reported effects include water pressure loss — which can allow untreated groundwater to seep into distribution pipes — and flooding caused by uncontrolled equipment behavior. Modified PLC ladder logic discovered at at least one utility indicates attackers moved beyond lockout to actively altering industrial control sequences. For TPRM professionals, this event highlights two distinct third-party risk exposure classes: vendors operating water utility infrastructure directly, and managed service providers or remote access solution vendors whose configurations may create shared attack surface across multiple utility customers. The mobile carrier network concentration means a single successfully profiled remote access architecture can enable repeated compromise across customers sharing the same provider setup. The absence of any CVE requirement for the primary attack vector — direct unauthenticated EtherNet/IP exposure — underscores that OT risk assessment cannot rely solely on CVE-based vulnerability tracking.

What questions should TPRM professionals ask vendors?

1. Have you updated all MicroLogix 1400 Series B and C devices to firmware revision 21.003 or later to remediate the Modbus TCP buffer overflow vulnerability (CVE-2017-16740) identified on controllers in attack-affected cities?
2. Can you confirm whether you have disconnected all Rockwell Automation MicroLogix 1100 and 1400 Series PLCs from direct public internet accessibility and mediated all remote access through a secure gateway or jump host?
3. Have you audited all cellular modem configurations used for remote PLC access and implemented strong authentication, firmware updates, and logging for all connected modems?
4. Have you reviewed all project files running on PLCs for unauthorized modifications using vendor-provided integrity-checking tools and visually compared the running programs against known-good logic?

Remediation recommendations

• Immediately disconnect all Rockwell Automation MicroLogix 1100 and 1400 PLCs from direct public internet exposure. Remove all inbound port exposure and require all remote access to be mediated through a secure gateway. This single action eliminates the primary attack vector for the ongoing campaign.
• Audit all cellular modem configurations used for remote PLC access. Implement strong authentication, firmware updates, and logging. Isolate remote access architectures using private APN, 5G PNI-NPN, SD-WAN, ZTNA, or site-to-site VPN to eliminate direct EtherNet/IP exposure via carrier networks.
• Update MicroLogix 1400 Series B and C firmware to revision 21.003 or later. Set strong, unique passwords on all PLC devices and configure ACLs to allow only authorized communications from expected control system devices. Place physical and software key switches in the run position to block unauthorized logic or config changes.
• Audit all PLC project files against known-good offline backups. Use vendor integrity checking tools and visually compare running programs against reference logic. Cross-reference access logs for unexpected online programming sessions. If integrity cannot be confirmed, restore from a verified backup before returning to operation.
• Review logs against the malicious IP addresses and network indicators published in the FBI/EPA PSA. Any confirmed interaction with published IoCs warrants immediate incident response escalation and contact with the local FBI field office or CISA ([email protected] / 1-844-729-2472). Initiate immediate hardware replacement planning for MicroLogix 1100 devices with firm decommission dates.

Black Kite's Water Sector Campaign FocusTag® details critical insights on the event for TPRM professionals.

Metabase (CVE-2026-72898)

What is this vulnerability?

CVE-2026-72898 (CVSS 10.0, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) is a maximum-severity SQL injection vulnerability in Metabase, a widely deployed open-source business intelligence and data visualization platform. The flaw resides in the /api/session/reset_password endpoint — unauthenticated by design as part of the password reset flow. An attacker can submit a crafted POST request that injects arbitrary SQL into the Metabase application database, bypassing all authentication controls and gaining full administrator-level access without credentials. From admin access, attackers can modify application configuration, steal credentials for all connected databases and data warehouses, read and export any data accessible through those connections, and manipulate administrator accounts and API keys. Metabase confirmed the vulnerability was exploited as a zero-day against Metabase Cloud instances before public disclosure. The Changed Scope CVSS indicator confirms impact extends beyond Metabase itself to all connected data sources.

Confirmed breach victims include Framework (PC manufacturer — customer names, IPs, addresses, phone numbers, and emails accessed), n8n workflow automation platform (136 customer records including bcrypt-hashed passwords, accessed August 8, 2026), and Kilo Code (Slack access tokens exposed during a four-hour breach window on August 2, 2026). The exploitation pattern is deterministic and publicly documented: POST /api/session/reset_password returning a 400 status code, immediately followed by GET /api/user/current returning a 200 status code from the same source IP, constitutes strong evidence of successful exploitation. CISA added CVE-2026-72898 to the Known Exploited Vulnerabilities catalog on August 11, 2026, with a required federal agency remediation deadline of August 14, 2026. A temporary workaround exists by blocking the /api/session/reset_password endpoint. Metabase Cloud instances have been automatically updated. Affected self-hosted version ranges span x.58.0 through x.63.3 across six major branches. Wiz estimated approximately 2,500 Metabase instances are accessible over the internet.

Why should TPRM professionals care?

Metabase is architecturally distinct from typical web applications: it holds direct, authenticated connections to an organization's data warehouses, databases, and analytics backends — credentials that are stored within the application and accessible to any admin-level attacker. A successful CVE-2026-72898 exploitation therefore does not merely expose Metabase itself; it exposes every database and data source connected to the instance. The diverse confirmed victim profile — a hardware manufacturer, a workflow automation platform, and a developer tooling company — illustrates the breadth of organizational contexts where Metabase is deployed as a query gateway to sensitive data. With roughly 13% of cloud environments containing self-hosted Metabase instances and 25% of those being fully internet-accessible, the TPRM exposure surface is significant. The zero-day exploitation timeline means self-hosted deployments had no warning period before attacks began.

What questions should TPRM professionals ask vendors?

1. Have you upgraded all instances of Metabase to the minimum safe release for the installed major version branch to mitigate the risk of CVE-2026-72898?
2. Have you implemented the temporary workaround of blocking the /api/session/reset_password endpoint until patching is complete to prevent potential SQL injection attacks?
3. Can you confirm whether you have reviewed your Metabase application and ingress logs for the confirmed exploitation pattern: a POST /api/session/reset_password request with a 400 status code immediately followed by a GET /api/user/current request with a 200 status code from the same source IP?
4. After upgrading, have you completed full post-compromise remediation steps, including deleting all rows in the core_session table, reviewing and deleting unrecognized API keys, reviewing administrator accounts for unexpected changes, rotating credentials for all connected databases and data warehouses, and reviewing Metabase activity and query history for unexpected or unauthorized queries?

Remediation recommendations

• Upgrade the self-hosted Metabase instance to the minimum safe release for the installed major branch immediately. Identify the running version via Help → About Metabase, then apply the corresponding patched release. This is the only complete remediation; the endpoint-blocking workaround is temporary.
• If immediate upgrade is not feasible: block the /api/session/reset_password endpoint at the network or application layer to eliminate the attack vector while the upgrade is scheduled. Remove the block only after upgrade is confirmed.
• For any instance where the endpoint was publicly accessible: delete all rows in the core_session table to revoke active sessions; review and delete unrecognized API keys; review all administrator accounts; rotate credentials for every connected database and data warehouse; review data warehouse logs; and review Metabase activity and query history for unauthorized queries.
• Restrict public exposure of all Metabase instances. Place Metabase behind a reverse proxy or WAF that enforces endpoint-level access controls, and limit inbound access to authorized user IP ranges. Enforce VPN requirements where operationally feasible.
• Hunt for active exploitation using the published IoC pattern in both application logs and ingress logs. Any instance showing the POST 400 / GET 200 sequence from the same source IP should be treated as actively compromised and subjected to full incident response engagement.

Black Kite's Metabase FocusTag® details critical insights on the event for TPRM professionals.

Cisco ASA & FTD - Aug2026 (CVE-2026-20349)

What is this vulnerability?

CVE-2026-20349 (CVSS 8.6, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H) is a high-severity Denial of Service vulnerability in the Remote Access SSL VPN service of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software. The flaw is rooted in insufficient error checking when processing HTTP requests (CWE-244): an unauthenticated remote attacker can send a crafted HTTP request to the Remote Access SSL VPN service that causes the affected device to reload unexpectedly, resulting in a complete Denial of Service. The vulnerability is exploitable on devices configured with any of the following: IKEv2 Remote Access VPN with client services, SSL VPN, or Zero Trust Network Access (ZTNA, FTD only). These are internet-facing configurations common in enterprise remote access architectures. The Changed Scope CVSS indicator reflects that a device reload impacts all network traffic and security policies enforced by the device — including active VPN sessions and firewall-protected network segments. Cisco PSIRT confirmed active exploitation in the wild; CISA added CVE-2026-20349 to the KEV catalog on August 11, 2026. No workarounds exist.

Cisco released hot fixes across ASA and FTD software branches. For ASA Software: release 9.16 (hotfix 89.16.4.50), 9.18 (89.18.4.50), 9.20 (9.20.4.235), 9.22 (9.22.3.191), 9.23 (9.23.1.211), and 9.24 (9.24.1.221). Hot fixes beginning with '89' for ASA 9.16 and 9.18 require ASDM Release 7.24.1.374 or later. For FTD Software: hot fixes are available for releases 7.0, 7.2, 7.4, 7.6, 7.7, and 10.0 across multiple hardware platform variants. The vulnerability was independently discovered and reported by Valerio Brussani during security testing. Cisco Secure Firewall Management Center (FMC) Software is not affected.

Why should TPRM professionals care?

Cisco ASA and FTD devices routinely serve as the primary perimeter security gateway and remote access VPN concentrator for enterprise networks. A successful DoS attack against these devices is not an application-layer disruption — it drops all active VPN sessions, terminates remote access for the entire workforce, and potentially creates security gaps in network segments that were protected by the device's firewall policies during the reload cycle. The vulnerability is specifically triggered through the Remote Access SSL VPN service — precisely the internet-facing component most likely to be reachable by external attackers in organizations supporting hybrid and remote workforces. The KEV listing confirms real-world exploitation is occurring, and the absence of any workaround means every unpatched device in the affected configuration remains fully exposed. For TPRM professionals, any vendor running internet-facing Cisco ASA or FTD without the August 2026 hot fixes applied while SSL VPN or IKEv2 RA VPN is enabled represents an active availability risk.

What questions should TPRM professionals ask vendors?

1. Have you applied the hot fixes provided by Cisco for the affected versions of Cisco Secure Firewall ASA Software and Cisco Secure Firewall Threat Defense (FTD) Software to mitigate the risk of CVE-2026-20349?
2. Can you confirm whether you have implemented IP-based access restrictions on the SSL VPN and IKEv2 service interfaces to limit inbound HTTP requests to known authorized IP ranges as a temporary measure until the hot fixes are applied?
3. Have you audited all Cisco ASA and FTD deployments to identify devices with the vulnerable configurations, including IKEv2 Remote Access VPN with client services, SSL VPN, and ZTNA?
4. Have you set up real-time availability monitoring for all affected ASA and FTD devices to detect unexpected device reloads and trigger immediate incident response?

Remediation recommendations

• Deploy the appropriate Cisco hot fix for the installed ASA or FTD Software release immediately from the Cisco Software Center. This is the only remediation; no workaround exists. Use the Cisco Software Checker to confirm the applicable hot fix for each specific installed release and hardware platform variant.
• Audit all Cisco ASA and FTD deployments for the presence of the three vulnerable configurations: IKEv2 RA VPN with client services, SSL VPN, and ZTNA. Use show running-config and cross-reference against the vulnerable configuration patterns in the Cisco advisory. Any device with one or more configurations enabled on an internet-accessible interface is an immediate patching priority.
• Deploy or verify real-time availability monitoring for all affected ASA and FTD devices with automated alerts for unexpected device reloads. This is essential for detecting ongoing exploitation attempts given active KEV-confirmed exploitation.
• Review syslog, ASDM event logs, and crash dump files on all affected devices for evidence of unexpected reloads coinciding with unusual inbound HTTP requests. Repeated reload events from the same source IP should be treated as active exploitation and escalated immediately.
• Note that Cisco Secure Firewall Management Center (FMC) Software is not affected by CVE-2026-20349. Confirm that hot fix remediation covers ASA and FTD devices only, and do not conflate this advisory with the concurrent FMC vulnerabilities addressed in the Cisco FMC Jul2026 FocusTag.

Black Kite's Cisco ASA & FTD - Aug2026 FocusTag® details critical insights on the event for TPRM professionals.

Cisco IMC - Aug2026 (CVE-2026-20200, CVE-2026-20288)

What is this vulnerability?

CVE-2026-20200 (CVSS 8.8, CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) is a high-severity argument injection vulnerability in the web-based management interface of Cisco Integrated Management Controller (IMC) — the out-of-band server management platform embedded in Cisco UCS rack server hardware. The flaw resides in the SSH public key remote retrieval feature: when a user instructs IMC to fetch an SSH public key from a remote server, the backend executes a privileged script that calls curl for the network operation. Insufficient sanitization of user-controlled retrieval parameters allows an authenticated attacker to inject additional arguments into the curl invocation, altering how the privileged process behaves. Because the affected script operates with root privileges, the argument injection primitive enables arbitrary file read, arbitrary file write, and full reverse-shell code execution on the IMC — as demonstrated by NSIDE ATTACK LOGIC in the publicly released CIMCown toolkit. The attack requires only low-privileged IMC credentials, not administrator access. Cisco explicitly acknowledges the existence of public PoC code. The companion vulnerability CVE-2026-20288 (CVSS 6.5) requires admin privileges and covers a broader affected product scope.

Affected hardware is limited to standalone Cisco UCS C-Series M7 and M8 Rack Servers running Cisco UCS Server Software on the 4.3 branch prior to 4.3(6.260033) or the 6.0 branch prior to 6.0(2.260044). Explicitly not affected: UCS C-Series M5 and M6 standalone servers, UCS C-Series with Fabric Interconnects (managed via UCS Manager or IMM), UCS B-Series Blade Servers, UCS X-Series Modular Systems, UCS S-Series, UCS E-Series, 5000 Series ENCS, and Catalyst 8300 Edge uCPE. Cisco confirmed no malicious exploitation at time of advisory publication (August 5, 2026), though the CIMCown PoC toolkit was already publicly available. No workaround exists; firmware upgrade is the sole remediation. Approximately 872 Cisco IMC management interfaces are detectable on Shodan.

Why should TPRM professionals care?

CVE-2026-20200's most significant characteristic is the privilege transition it enables: a low-privileged IMC account — the kind routinely distributed to monitoring systems, junior operations staff, automation workflows, and third-party support personnel — is sufficient to achieve root-level command execution on the management controller. Cisco IMC operates beneath the host OS security boundary, providing remote KVM, virtual media, power control, and firmware management capabilities that function independently of the server's operating system state. Root execution within IMC is therefore control over the physical server's management plane — a layer where most EDR tooling has no visibility, and where an attacker can interact with BIOS and Secure Boot. The CIMCown PoC removes the engineering barrier between disclosure and practical exploitation. Organizations with broad low-privileged IMC credential distribution, weak management-network segmentation, or shared operational automation accounts face substantially elevated exploitation risk.

What questions should TPRM professionals ask vendors?

1. Have you upgraded the Cisco UCS Server Software to the fixed versions 4.3(6.260033) or 6.0(2.260044) to mitigate the risk of CVE-2026-20200?
2. Can you confirm whether you have audited and restricted low-privileged IMC account exposure across all affected hardware to prevent potential escalation paths on unpatched systems?
3. Are you monitoring Cisco IMC authentication logs for unexpected logins by low-privileged accounts, particularly those interacting with SSH key management or remote retrieval functionality, as part of your mitigation strategy for CVE-2026-20200?
4. Have you ensured that all Cisco IMC management interfaces are accessible only through a dedicated management network mediated by a privileged-access gateway, strong authentication, and allowlisted administrative hosts to reduce the attack surface for CVE-2026-20200?

Remediation recommendations

• Upgrade all affected standalone UCS C-Series M7 and M8 servers to 4.3(6.260033) or 6.0(2.260044) immediately. Cisco confirms no workaround exists; firmware upgrade is the only remediation. Verify the running firmware version directly after upgrade — do not rely on change ticket completion as evidence of remediation.
• Treat network isolation as a mitigation, not a fix. Restrict IMC management interface access via firewall rules, management-network segmentation, or by disabling the web interface where immediate patching is not possible. These are compensating controls only — the finding should remain open until firmware upgrade is confirmed.
• Audit and restrict low-privileged IMC account exposure. Because CVE-2026-20200 requires only low privileges, every such account is a potential escalation path on unpatched systems. Revoke or tightly restrict access for low-privileged accounts distributed to monitoring automation, shared tooling, or non-essential personnel.
• Enforce a dedicated management-network architecture for all Cisco IMC interfaces. Ensure management access requires traversal of a hardened gateway with strong authentication and allowlisted administrative hosts rather than being reachable from general server or user VLANs.
• Monitor management-plane telemetry as a separate detection domain from host OS-level security tooling. Review IMC authentication logs for unexpected interactions with the SSH key management feature, and alert on IMC-sourced outbound traffic to destinations outside the approved management dependency list.

Black Kite's Cisco IMC - Aug2026 FocusTag® details critical insights on the event for TPRM professionals.

Cisco IOS XE - Aug2026 (CVE-2026-20272, CVE-2026-20267, CVE-2026-20268, CVE-2026-20269, CVE-2026-20270, CVE-2026-20271, CVE-2026-20273)

What is this vulnerability?

Cisco published a proactive IOS XE Software Security Hardening Release on August 5, 2026 that addresses seven vulnerabilities discovered through internal testing and — notably — frontier AI-assisted code analysis. CVSSv3 scores range from 8.6 to 9.8. Each CVE ID represents the maximum severity of the most impactful individual bug within its CWE class, meaning each CVE may cover multiple underlying flaws. CVE-2026-20272 (CVSS 9.8) covers improper neutralization of special elements — command, OS, and argument injection — enabling potential full unauthenticated RCE on IOS XE devices. CVE-2026-20267 (CVSS 9.0) covers improper access control, addressing authorization failures, authentication bypass, and privilege escalation. The five remaining CVEs (all CVSS 8.6) address: memory buffer violations including buffer overflow and out-of-bounds write (CVE-2026-20268); resource lifecycle mismanagement including null pointer dereferences (CVE-2026-20269); integer overflow and arithmetic errors (CVE-2026-20270); insufficient control flow management including infinite loops and race conditions (CVE-2026-20271); and improper input validation including path traversal (CVE-2026-20273).

All seven vulnerabilities affect Cisco IOS XE Software regardless of device configuration across affected releases: 17.9 (fixed in 17.9.10), 17.12 (fixed in 17.12.8), 17.15 (fixed in 17.15.6), 17.18 (fixed in 17.18.4 or 17.18.4a), and 26.1 (fixed in 26.1.2). Cisco's evaluation was explicitly scoped to these five release trains; Catalyst 3650 and 3850 Series Switches do not run these releases and were not evaluated. No public PoC exploits exist, and no active exploitation has been reported. The use of AI-assisted code analysis in the discovery process is a methodological signal that the identified flaw classes may represent deeper architectural patterns warranting ongoing scrutiny.

Why should TPRM professionals care?

Cisco IOS XE is the operating system underpinning Cisco's enterprise routing, switching, SD-WAN, and wireless LAN controller product lines — deployed pervasively across enterprise network backbones globally. CVE-2026-20272's CVSS 9.8 command injection profile in a network operating system is synonymous with full device takeover potential: an attacker achieving command injection on IOS XE can modify routing tables, disable interfaces, exfiltrate configurations, establish persistent backdoors, or pivot to adjacent network segments. CVE-2026-20267's access control bypass class carries historical urgency in the Cisco IOS XE context — prior IOS XE access control bypass CVEs such as CVE-2023-20198 saw mass exploitation within days of disclosure. The fact that all seven vulnerabilities affect IOS XE regardless of device configuration eliminates configuration-based scope reductions and makes every device on an affected release a remediation target.

What questions should TPRM professionals ask vendors?

1. Have you upgraded all instances of Cisco IOS XE Software to the corresponding fixed releases (17.9.10 for the 17.9 branch, 17.12.8 for 17.12, 17.15.6 for 17.15, 17.18.4 or 17.18.4a for 17.18, and 26.1.2 for the 26.1 branch) to mitigate the risk of the seven vulnerabilities mentioned in the advisory?
2. Can you confirm whether you have implemented defense-in-depth controls such as Control Plane Policing (CoPP), Management Plane Protection (MPP), and infrastructure ACLs limiting device reachability to authorized administrative hosts and networks, as recommended by Cisco, to reduce the attack surface for network-accessible vulnerability classes?
3. Have you conducted a comprehensive inventory of all Cisco IOS XE devices in your environment to identify which devices are running releases 17.9, 17.12, 17.15, 17.18, or 26.1, considering that these vulnerabilities affect IOS XE regardless of device configuration?
4. Given the high CVSS scores and rapid weaponization timeline of CVE-2026-20272 and CVE-2026-20267, have you prioritized the remediation of these two vulnerabilities, especially for IOS XE devices that are internet-accessible or serve as perimeter routing and switching infrastructure?

Remediation recommendations

• Upgrade all IOS XE devices on affected release branches to the corresponding fixed release immediately. No workarounds exist for any of the seven CVEs. Use the Cisco Software Checker to confirm the appropriate fixed release for each specific device and prioritize internet-accessible routing and switching infrastructure.
• Prioritize CVE-2026-20272 (CVSS 9.8, command injection) and CVE-2026-20267 (CVSS 9.0, access control bypass) for the most urgent patching cycles given these vulnerability classes' historical rapid weaponization in Cisco IOS XE products.
• As a defense-in-depth measure pending patching, restrict management-plane access to IOS XE devices using CoPP, MPP, and infrastructure ACLs limiting device reachability to authorized administrative hosts and networks only.
• Conduct a complete inventory of all IOS XE devices in the environment, mapping each device to its specific release branch and confirming upgrade completion. Because the vulnerabilities affect IOS XE regardless of configuration, no device on an affected release train is out of scope.
• Monitor IOS XE telemetry for anomalous behavior during the patch window: syslog for unexpected authentication events and command-related errors, NetFlow for unusual control-plane traffic patterns, and SNMP for unexpected interface or routing table changes.

Black Kite's Cisco IOS XE - Aug2026 FocusTag® details critical insights on the event for TPRM professionals.

Adobe ColdFusion - Aug2026 (CVE-2026-48362, CVE-2023-38646, CVE-2026-48273, CVE-2026-71387, CVE-2026-71386, CVE-2026-34635, CVE-2026-48386, CVE-2026-71384, CVE-2026-21273, CVE-2026-71385, CVE-2026-48440, CVE-2026-21279, CVE-2026-25652, CVE-2026-71383, CVE-2026-7138)

What is this vulnerability?

Adobe published APSB26-90 in August 2026 as a Priority 1 security update for Adobe ColdFusion — Adobe's highest urgency classification, reserved for updates addressing vulnerabilities in products targeted by known attacks in the wild or with existing public proof-of-concept code. The bulletin addresses 15 CVEs with CVSS scores ranging from 7.3 to 10.0 across multiple vulnerability classes. The most critical is CVE-2026-48362 (CVSS 10.0, EPSS 2.07%), a maximum-severity vulnerability enabling unauthenticated remote code execution. The vulnerability cluster includes deserialization flaws, improper access control, code injection, path traversal, and information disclosure vulnerabilities — several of which can be chained to achieve full server compromise. The fixed releases are ColdFusion 2025.0.12 and ColdFusion 2023.0.23. ColdFusion 2021 reached end of life and is no longer supported with security updates.

Adobe ColdFusion has a significant prior exploitation history: APSB23-47 (CVE-2023-29300 and CVE-2023-38203) was actively exploited, and CVE-2023-38646 — included in this bulletin — was previously associated with targeted attacks. The Priority 1 classification and the breadth of the vulnerability cluster indicate Adobe has identified exploitation activity or imminent risk across the ColdFusion product line. The CVSS 10.0 score on CVE-2026-48362 combined with an EPSS of 2.07% and the Priority 1 rating makes this the highest-priority patch event in the Adobe ecosystem this cycle. Organizations running ColdFusion in internet-facing environments with delayed patching practices are at the highest risk.

Why should TPRM professionals care?

Adobe ColdFusion is a web application server deployed for enterprise web applications and internal business tooling, often in environments where it holds database connections and application logic for business-critical workflows. A CVSS 10.0 unauthenticated RCE vulnerability in a Priority 1 bulletin with a 2.07% EPSS score indicates a high probability of near-term exploitation in the wild. ColdFusion's historical exploitation profile — including previous CISA KEV additions for ColdFusion vulnerabilities — means threat actors actively maintain ColdFusion exploitation capabilities. The 15-CVE breadth of APSB26-90 suggests this is not a routine patch update but a substantive security remediation cycle. TPRM professionals should prioritize vendors with internet-facing ColdFusion deployments and confirm patch status against the specific fixed version numbers.

What questions should TPRM professionals ask vendors?

1. Have you upgraded all instances of Adobe ColdFusion to versions 2025.0.12 or 2023.0.23 to mitigate the risk of vulnerabilities including CVE-2026-48362, CVE-2026-48273, and CVE-2026-71384?
2. Have you reviewed and hardened deserialization controls as recommended by Adobe to protect against insecure deserialization attacks, specifically in relation to vulnerabilities such as CVE-2026-71386 and CVE-2026-71387?
3. Have you updated the MySQL Java Connector to the latest version as recommended by Adobe for security purposes, specifically in relation to vulnerabilities such as CVE-2026-34635 and CVE-2026-48440?
4. Have you restricted adjacent-network exposure to ensure ColdFusion administration and application interfaces are not accessible from untrusted network segments, specifically in relation to vulnerabilities such as CVE-2026-71384, CVE-2026-71386, and CVE-2026-71387?

Remediation recommendations

• Apply the ColdFusion 2025.0.12 or 2023.0.23 update immediately. Adobe classified APSB26-90 as Priority 1, which Adobe defines as warranting application within 72 hours for production systems. This is the highest urgency classification Adobe issues and should be treated as an emergency patching event.
• If ColdFusion 2021 is deployed: begin immediate migration planning to a supported version. ColdFusion 2021 is end-of-life and does not receive security updates. As an interim measure, implement strict network-level access controls restricting all ColdFusion interface access to authorized internal IP ranges.
• Restrict internet exposure of ColdFusion instances immediately pending patch confirmation. Place ColdFusion behind a WAF or reverse proxy with strict request filtering. Restrict ColdFusion Administrator access to management network IP ranges only.
• Apply the ColdFusion lockdown guide in conjunction with patching. The lockdown guide addresses configuration hardening that reduces ColdFusion's attack surface beyond what patches alone provide, including administrator access restrictions and file operation controls.
• Review ColdFusion server and application logs for exploitation indicators: unexpected serialized object submissions, file operation anomalies, unusual outbound connections from the ColdFusion process, and unexpected process spawns. Correlate with the APSB26-90 vulnerability classes to identify potential pre-patch exploitation activity.

Black Kite's Adobe ColdFusion - Aug2026 FocusTag® details critical insights on the event for TPRM professionals.

SharePoint - Aug2026 (CVE-2026-65665, CVE-2026-63514, CVE-2026-66808, CVE-2026-66805, CVE-2026-64901, CVE-2026-63520, CVE-2026-70324, CVE-2026-70326, CVE-2026-70321, CVE-2026-65663, CVE-2026-65658, CVE-2026-62827, CVE-2026-64921, CVE-2026-70355, CVE-2026-64900)

What is this vulnerability?

Microsoft's August 12, 2026 Patch Tuesday included 15 CVEs affecting Microsoft SharePoint Server, with CVSS scores ranging from 7.3 to 8.8. The vulnerability cluster is dominated by deserialization flaws and remote code execution vulnerabilities. The most notable is CVE-2026-63520, an unauthenticated vulnerability in SharePoint Server that does not require prior authentication to exploit — a distinction that significantly expands the exploitable attack surface compared to the authenticated RCE vulnerabilities in the same cluster. The remaining 14 CVEs include multiple authenticated remote code execution vulnerabilities via unsafe deserialization, privilege escalation, and information disclosure. Microsoft classified several of these vulnerabilities with 'Exploitation More Likely' ratings in the MSRC advisory, indicating elevated near-term exploitation probability.

SharePoint Server has a persistent history as a high-value target for advanced threat actors and ransomware operators. Prior SharePoint vulnerabilities including CVE-2019-0604, CVE-2022-29108, and CVE-2023-29357 have all been actively exploited and added to CISA's KEV catalog following disclosure. The August 2026 cluster's concentration of deserialization-based RCE vulnerabilities follows the same architectural vulnerability pattern that has driven previous SharePoint exploitation campaigns. The affected versions span SharePoint Server Subscription Edition, SharePoint Server 2019, and SharePoint Server 2016. All 15 CVEs are addressed by the August 2026 cumulative update for the applicable SharePoint version.

Why should TPRM professionals care?

SharePoint Server is deployed as an enterprise collaboration, document management, and intranet platform — a position that places it at the intersection of internal file storage, business workflows, and identity integration with Active Directory. Compromise of a SharePoint server provides access to shared documents, project files, and sensitive business data, and the server's Active Directory integration can be leveraged for lateral movement and credential access. The presence of an unauthenticated vulnerability (CVE-2026-63520) alongside 14 authenticated RCE flaws means the cluster covers both pre-authentication and post-authentication attack paths. Fourteen simultaneous SharePoint RCE vulnerabilities in a single patch cycle represents an exceptionally broad remediation event. TPRM professionals should confirm that vendors have applied August 2026 SharePoint cumulative updates and identify any internet-accessible SharePoint instances.

What questions should TPRM professionals ask vendors?

1. Have you updated all instances of Microsoft SharePoint Enterprise Server 2016 to build 16.0.5565.1001, Microsoft SharePoint Server 2019 to build 16.0.10417.20198, and Microsoft SharePoint Server Subscription Edition to build 16.0.19725.20522 to mitigate the risk of the fifteen vulnerabilities disclosed in August 2026 Patch Tuesday?
2. Have you implemented Web Application Firewall (WAF) rules to detect and block SSRF request patterns targeting internal network ranges and XSS injection payloads in SharePoint HTTP traffic as recommended in the advisory?
3. Can you confirm whether you have audited SharePoint ULS logs and Unified Audit Logs for unexpected deserialization errors, anomalous SSRF-related outbound connections from SharePoint servers, unusual administrative action patterns, unexpected script execution events, or session-based anomalies that may indicate exploitation attempts across the disclosed vulnerability classes?
4. Have you enforced strict Role-Based Access Control (RBAC) to minimize the exploitable account population and restrict site collection administrator, farm administrator, and elevated permissions to a minimal set of verified accounts as recommended in the advisory?

Remediation recommendations

• Apply the August 2026 SharePoint Server cumulative update for all deployed versions immediately. This is the only remediation for all 15 CVEs in the cluster. Verify installation via Central Administration or SharePoint Management Shell before closing the remediation ticket.
• Restrict internet access to SharePoint Server instances pending patch confirmation. CVE-2026-63520's unauthenticated attack vector makes any internet-facing unpatched SharePoint instance an immediate priority. Consider temporarily restricting access to trusted IP ranges at the perimeter while the cumulative update is applied.
• Review SharePoint audit logs and ULS logs for anomalous deserialization activity, unexpected file operations, unusual administrative account activity, and outbound connections from the SharePoint application pool process during the pre-patch window.
• Enforce least-privilege access controls across all SharePoint sites, site collections, and service accounts. Audit all accounts with Contribute or higher permissions across SharePoint site collections, and remove any access grants that cannot be justified by current operational requirements.
• Document the SharePoint Active Directory and Azure AD integration scope as part of incident response planning. If a SharePoint compromise is discovered, the identity integration scope determines whether lateral movement opportunities exist and what credential rotations are required as part of recovery.

Black Kite's SharePoint - Aug2026 FocusTag® details critical insights on the event for TPRM professionals.

Exchange Server - Aug2026 (CVE-2026-62912, CVE-2026-62913, CVE-2026-62911, CVE-2026-65813, CVE-2026-62910, CVE-2026-62915, CVE-2026-62914)

What is this vulnerability?

Microsoft's August 2026 Patch Tuesday included 7 CVEs for Microsoft Exchange Server with CVSS scores ranging from 6.5 to 8.8. The vulnerability cluster includes remote code execution, privilege escalation, and information disclosure vulnerabilities. CVE-2026-65813 (CVSS 8.8) is the highest-severity CVE in the cluster, addressing a remote code execution vulnerability in Exchange Server. The cluster also includes several CVSS 8.0–8.8 RCE vulnerabilities (CVE-2026-62912, CVE-2026-62913, CVE-2026-62911, CVE-2026-62915, CVE-2026-62914) and a 6.5-scored information disclosure vulnerability (CVE-2026-62910). The affected versions are Exchange Server 2016 Cumulative Update 23, Exchange Server 2019 Cumulative Update 14 and 15, and Exchange Server SE (Subscription Edition) RTM.

Exchange Server has a well-documented exploitation history that spans ProxyLogon (CVE-2021-26855), ProxyShell, and multiple CISA KEV additions across 2021–2026. The August 2026 cluster continues the pattern of clustered Exchange RCE disclosures that have characterized Microsoft's Patch Tuesday cycles in recent years. The affected versions represent currently supported Exchange deployments that remain broadly in enterprise use — particularly Exchange Server 2019, which is the most widely deployed on-premises Exchange version in enterprise environments. Microsoft provided security updates for each affected CU version via KB articles 5121573, 5121574, 5121575, and 5121576.

Why should TPRM professionals care?

Microsoft Exchange Server is email and calendar infrastructure — a position that makes it a persistent, high-value target for espionage actors, ransomware operators, and business email compromise campaigns. Compromise of Exchange provides access to email archives, calendar data, and often Active Directory integration paths. The server's network position — receiving inbound SMTP from the internet and providing OWA, EAP, and Exchange Web Services endpoints — creates a large external attack surface. Exchange Server's prior exploitation history means threat actors maintain active Exchange exploitation capabilities, and new Exchange RCE disclosures have historically been weaponized rapidly. Seven simultaneous Exchange vulnerabilities in a single patch cycle represents a substantive remediation event. TPRM professionals should confirm patch status by CU version for all on-premises Exchange deployments.

What questions should TPRM professionals ask vendors?

1. Have you applied the Microsoft-issued security updates released on August 11, 2026 for all affected Exchange Server versions, specifically KB5121573 for Subscription Edition RTM, KB5121574 for Exchange 2019 CU15, KB5121575 for Exchange 2019 CU14, and KB5121576 for Exchange 2016 CU23?
2. Can you confirm whether you have implemented SMB signing, LDAP signing, and Extended Protection for Authentication (EPA) across all Exchange-integrated services to mitigate the risk of CVE-2026-62911, an authentication bypass by capture-replay vulnerability?
3. Have you set up monitoring for unusual deserialization-related errors in Exchange application event logs and alerts for unexpected Exchange service restarts or mail flow interruptions that may indicate active exploitation attempts related to CVE-2026-62912?
4. Have you audited Exchange OWA access logs and IIS logs for anomalous POST requests containing script injection payloads (CVE-2026-62914), unexpected server-side HTTP requests to internal network ranges (CVE-2026-65813), and unusual resource reference patterns (CVE-2026-62910) from authenticated user sessions?

Remediation recommendations

• Apply the August 2026 Exchange Server security update immediately for all deployed CU versions. Use the applicable KB article for each version: 5121573 for Exchange 2016 CU23, 5121574 for Exchange 2019 CU14, 5121575 for Exchange 2019 CU15, and 5121576 for Exchange SE RTM. Run the HealthChecker.ps1 script after patching to confirm successful application.
• If the deployed Exchange CU is not on the supported list (2016 CU23, 2019 CU14/15, or SE RTM): upgrade to a supported CU first, then apply the August security update. Unsupported CU versions are fully unpatched for all August 2026 Exchange CVEs.
• Restrict internet access to Exchange OWA, EAP, and EWS endpoints to authorized IP ranges pending patch confirmation. This is a compensating control for internet-facing deployments and does not substitute for applying the security update.
• Review Exchange protocol logs, IIS logs, and Windows Event Logs for anomalous authentication events, unexpected process spawns from the Exchange application pool service account, and unusual outbound network connections from Exchange servers during the pre-patch exposure window.
• Ensure the Exchange Health Manager service is running and review the Exchange Health Report post-patching. Confirm that all Exchange services and databases are functioning normally after the security update is applied, as cumulative update installation can occasionally require additional remediation steps.

Black Kite's Exchange Server - Aug2026 FocusTag® details critical insights on the event for TPRM professionals.

ClamAV - Aug2026 (CVE-2026-20337, CVE-2026-20338, CVE-2026-20339, CVE-2026-20345, CVE-2026-20346, CVE-2026-20347, CVE-2026-20348)

What is this vulnerability?

Cisco published a security advisory for ClamAV in August 2026 addressing 7 CVEs (all CVSS 7.5) across the open-source ClamAV antivirus engine maintained by Cisco Talos. The vulnerability cluster is concentrated in ClamAV's file format parsers — specifically the ZIP archive parser — and affects the antivirus scanning pipeline. A public proof-of-concept exploit was published demonstrating that a specially crafted ZIP archive submitted for scanning can trigger out-of-bounds reads or other memory safety violations in the parser, potentially resulting in a Denial of Service condition that crashes the ClamAV scanning service. The fixed releases are ClamAV 1.5.4 and 1.4.6. All prior releases on the affected branches are vulnerable. ClamAV is maintained by Cisco Talos and deployed both as a standalone antivirus engine and as the scanning backend in various email security gateways, file upload inspection systems, and endpoint protection products.

The 7 CVEs are distributed across multiple parser components: CVE-2026-20337 and related ZIP parser CVEs address the file archive inspection functionality, while companion CVEs address additional file format parsers within the scanning engine. The DoS impact means that a malicious file designed to trigger the vulnerability can disable the AV scanning service — a particularly impactful outcome for security infrastructure where ClamAV serves as a required inspection layer for email attachments, file uploads, or endpoint security. The CVSS 7.5 score applies across all seven CVEs, reflecting the DoS impact without confidentiality or integrity consequences in the primary disclosed vulnerability class.

Why should TPRM professionals care?

ClamAV occupies a unique position in the security ecosystem: it is an antivirus engine rather than a typical application, meaning a vulnerability in ClamAV is a vulnerability in a security control itself. A DoS attack against a ClamAV scanning service does not merely disrupt an application — it disables the malware detection capability for the email or file flow that ClamAV was protecting. The public PoC means the attack is accessible to any threat actor who can submit a malicious archive through a protected channel — email attachment scanning, file upload inspection, or web content filtering. Organizations using ClamAV as the scanning backend for email security gateways face a risk of email-delivered malware bypassing scanning while the service is crashed. TPRM professionals should identify vendors whose email security, file inspection, or endpoint protection infrastructure relies on ClamAV as the scanning engine.

What questions should TPRM professionals ask vendors?

1. Have you updated all instances of ClamAV to versions 1.5.4 or 1.4.6 to mitigate the risk of the seven vulnerabilities (CVE-2026-20337, CVE-2026-20338, CVE-2026-20339, CVE-2026-20345, CVE-2026-20346, CVE-2026-20347, and CVE-2026-20348)?
2. Can you confirm whether you have implemented the recommended actions, such as enabling verbose logging for ClamAV and monitoring for repeated scanner crashes or restarts, which are the primary observable indicators of exploitation attempts against these vulnerabilities?
3. Have you reviewed and adjusted your MaxScanSize, MaxFileSize, and archive scanning limits in response to the identified vulnerabilities, particularly CVE-2026-20348, which bypasses scan limit enforcement during XAR table of contents decompression?
4. Have you taken steps to limit network accessibility to ClamAV services and scanning endpoints, and avoided exposing clamd daemons directly to the internet unless strictly necessary and protected by appropriate firewall rules, as recommended in the advisory?

Remediation recommendations

• Upgrade ClamAV to version 1.5.4 (for the 1.5.x branch) or 1.4.6 (for the 1.4.x branch) immediately. These are the only releases addressing all 7 CVEs in the August 2026 Cisco advisory. Verify the upgrade across all ClamAV deployments — standalone instances, email gateway backends, and any product that bundles ClamAV.
• Implement ClamAV service health monitoring with automated restart and alerting. A successful DoS against the ClamAV scanner will manifest as a service crash; automated restart can restore scanning capability while alerting enables incident response to identify the source of the crash-triggering submission.
• For email security gateways using ClamAV as the sole scanning engine: evaluate adding a secondary scanning layer as a defense-in-depth measure. A multi-engine scanning architecture ensures continued detection coverage if any single engine encounters a DoS condition or failure.
• Review ClamAV deployment architecture to identify all systems where ClamAV is bundled as a scanning backend, including third-party products and appliances that include ClamAV. Vendor appliances may have their own update cadence that lags behind the ClamAV community release.
• Ensure ClamAV's freshclam process for virus definition updates is functioning correctly alongside the engine upgrade. Verify that definition updates are being pulled successfully and that the clamd service recognizes the updated definitions after the engine upgrade is applied.

Black Kite's ClamAV - Aug2026 FocusTag® details critical insights on the event for TPRM professionals.

pgAdmin - Aug2026 (CVE-2026-17566, CVE-2026-17349, CVE-2026-17351, CVE-2025-13780, CVE-2026-12045)

What is this vulnerability?

The pgAdmin 4 development team released version 9.18 in August 2026 addressing 5 CVEs. The most critical is CVE-2026-17566 (CVSS 9.9), a near-maximum-severity remote code execution vulnerability in pgAdmin 4 — the leading open-source administration and development platform for PostgreSQL databases. The CVSS 9.9 score and 'Changed Scope' component indicate that successful exploitation extends the impact beyond pgAdmin itself to the connected database infrastructure. The vulnerability enables remote code execution through unsafe deserialization or improper handling of attacker-controlled input within the pgAdmin server process. The companion CVEs — CVE-2026-17349, CVE-2026-17351, CVE-2025-13780, and CVE-2026-12045 — address additional privilege escalation, authentication, and information disclosure vulnerabilities within pgAdmin 4. All five CVEs are fixed exclusively in pgAdmin 4 version 9.18.

pgAdmin is deployed both as a local desktop application and as a web server — the web server deployment being the higher-risk configuration as it creates an internet-accessible endpoint. In web server mode, pgAdmin presents an authenticated web interface that manages PostgreSQL database connections with stored credentials and connection profiles. The near-maximum CVSS score of 9.9 places CVE-2026-17566 among the most severe pgAdmin vulnerabilities disclosed. A prior pgAdmin RCE — CVE-2024-9014 — was added to CISA's KEV catalog in 2024, confirming that pgAdmin web server deployments are actively targeted by threat actors. No public PoC was available at time of disclosure, but the severity score and CISA KEV precedent for pgAdmin vulnerabilities justify treating this as a high-priority patching event.

Why should TPRM professionals care?

pgAdmin sits at the database management layer — a position where compromise provides access not only to the pgAdmin application itself but to every PostgreSQL database instance that pgAdmin manages and has stored connection credentials for. In web server deployments, pgAdmin may be accessible from internal networks or the internet, making it a direct gateway into database infrastructure. Database administrators often use pgAdmin to manage multiple PostgreSQL instances across development, staging, and production environments — meaning a single pgAdmin compromise can expose the full database estate. The 9.9 CVSS score and prior CISA KEV history for pgAdmin RCE vulnerabilities make this a priority engagement for TPRM professionals assessing vendors with significant PostgreSQL deployments.

What questions should TPRM professionals ask vendors?

1. Have you upgraded all instances of pgAdmin 4 to version 9.18 or later to mitigate the risk of CVE-2026-17566, CVE-2026-17349, and CVE-2026-17351?
2. Can you confirm whether you have restricted the Import/Export Data permission to trusted users and ensured that the PostgreSQL service account used by pgAdmin cannot execute the COPY TO PROGRAM command, reducing the impact of CVE-2026-17566?
3. Have you audited shared (adhoc) server connections and stored credentials to limit exposure to CVE-2026-17349, and rotated any database passwords that may have been exposed to non-owners?
4. Have you disabled or restricted the AI Assistant to eliminate the CVE-2026-17351 attack vector, and if it must remain enabled, have you restricted the documents and data sources it can access to trusted content to reduce indirect prompt-injection risk?

Remediation recommendations

• Upgrade pgAdmin 4 to version 9.18 immediately across all deployments — desktop and web server installations. This is the only release addressing all 5 CVEs, including the CVSS 9.9 RCE vulnerability. Verify the installed version via the pgAdmin About dialog or package manager.
• Restrict pgAdmin web server access to internal management network IP ranges only. pgAdmin web server should never be internet-accessible. If it is currently exposed to the internet, implement immediate network-level access restrictions and evaluate migrating to a desktop-mode deployment for administrative tasks.
• Rotate credentials for all PostgreSQL database connections stored in pgAdmin following the patch, particularly for any pgAdmin web server deployment that was accessible from broader network segments. This ensures that any stored credentials that may have been accessed through pre-patch exploitation are invalidated.
• Enforce strong authentication for pgAdmin web server access. Require complex master passwords, implement MFA where supported by the deployed pgAdmin version, and configure pgAdmin session timeout settings to minimize credential exposure from unattended authenticated sessions.
• Review pgAdmin audit logs and PostgreSQL server logs for anomalous queries or connection patterns that may indicate pre-patch exploitation activity. Correlate these findings with network traffic logs to identify any unexpected connections to managed PostgreSQL instances during the vulnerable window.

Black Kite's pgAdmin - Aug2026 FocusTag® details critical insights on the event for TPRM professionals.

Django - Aug2026 (CVE-2026-15307, CVE-2026-15920, CVE-2026-15337, CVE-2026-15830)

What is this vulnerability?

The Django Software Foundation published security releases on August 4, 2026 addressing 4 CVEs in the Django web framework. The most severe is CVE-2026-15307 (CVSS 8.8), a high-severity vulnerability enabling remote code execution through unsafe deserialization or improper handling of attacker-controlled input in the Django framework. CVE-2026-15920, CVE-2026-15337, and CVE-2026-15830 address additional high-severity vulnerabilities in Django's session handling, input validation, and serialization components. The fixed releases are Django 6.0.8 and Django 5.2.17 for the respective maintained branches. Earlier branches (Django 5.1 and older) are no longer supported and do not receive security updates. Django applications must upgrade their Django dependency to the fixed version and redeploy — there are no server-level patches or workarounds that address the framework code vulnerabilities.

Django is the most widely deployed Python web framework globally, used across hundreds of thousands of web applications in enterprise, SaaS, and public sector environments. Security vulnerabilities in Django itself — rather than in Django applications — are relatively uncommon, making August 2026's four-CVE release a significant event. The CVE-2026-15307 CVSS 8.8 score indicates high severity with attack complexity 'Low' and no user interaction required, meaning exploitation does not depend on social engineering or complex preconditions beyond identifying a vulnerable Django application. The breadth of affected Django functionality across session handling, input validation, and serialization means diverse Django application types may be exposed through different code paths.

Why should TPRM professionals care?

Django framework vulnerabilities affect every Django application deployed on a vulnerable version simultaneously — not just a single product, but every web application using the affected Django version. Organizations that deploy multiple Django applications may have a large number of simultaneously vulnerable services. Unlike application-specific vulnerabilities, framework-level vulnerabilities require remediation across all affected applications in a portfolio. The Django ecosystem's breadth — SaaS platforms, API backends, data portals, internal tools — means the exposure profile is diverse and often difficult to enumerate without application-level inventory. TPRM professionals should inquire about Django framework versions across vendor web application portfolios and confirm that dependency updates have been applied.

What questions should TPRM professionals ask vendors?

1. Have you updated all instances of Django to versions 6.0.8 or 5.2.17 to mitigate the risk of CVE-2026-15307, CVE-2026-15920, CVE-2026-15337, and CVE-2026-15830?
2. Can you confirm that you have implemented the spatial-lookup hardening in CVE-2026-15307, which blocks dict and unsafe string values, to prevent server-side file-write and request-forgery flaws?
3. Have you applied the patched geometry-collection depth cap of 198 for CVE-2026-15830 and the language-code handling fix for CVE-2026-15337 to mitigate potential denial-of-service attacks?
4. Have you ensured that URLField values in the Django admin are rendered with the new scheme validation recommended for CVE-2026-15920 to prevent potential cross-site scripting attacks?

Remediation recommendations

• Update the Django dependency to 6.0.8 or 5.2.17 across all Django applications immediately. This requires updating the Python package (pip install Django==6.0.8 or equivalent), running the full test suite, and redeploying. There is no server-level fix; remediation requires a code-level dependency update and redeployment.
• Identify all Django applications in the deployment portfolio and confirm which version of Django each is running. Framework-level vulnerabilities affect every application on a vulnerable version, and a complete inventory is required to ensure no applications are missed in the remediation sweep.
• Migrate any Django applications on end-of-life branches (5.1 or earlier) to a supported branch (5.2.x or 6.0.x) immediately. Applications on unsupported branches will continue to accumulate unpatched vulnerabilities with no vendor-provided remediation path.
• Ensure Django's DEBUG mode is set to False in all production deployments. Review security middleware configuration (SECURE_BROWSER_XSS_FILTER, SECURE_CONTENT_TYPE_NOSNIFF, CSRF_COOKIE_SECURE, SESSION_COOKIE_SECURE) to confirm security-relevant settings are correctly configured across all production instances.
• Implement automated dependency scanning in the CI/CD pipeline for all Django applications. Tools such as pip-audit, Safety, or GitHub Dependabot can automatically detect when Django or other Python dependencies have known vulnerabilities, enabling rapid identification and remediation for future framework-level CVE disclosures.

Black Kite's Django - Aug2026 FocusTag® details critical insights on the event for TPRM professionals.

Jenkins - Aug2026 (CVE-2026-70426)

What is this vulnerability?

CVE-2026-70426 (CVSS 9.0) is a critical remote code execution vulnerability in Jenkins — the widely deployed open-source CI/CD automation server — disclosed in the Jenkins Security Advisory published August 6, 2026. The vulnerability is a bypass of JEP-200, the Java deserialization filter that Jenkins implemented in 2017 as the primary defense against Java deserialization attacks following the 2015-2017 Jenkins deserialization exploitation wave. JEP-200 established a class-allow-list that filters which Java classes can be deserialized from attacker-controlled input. CVE-2026-70426 identifies a class or code path that was not covered by the JEP-200 allow-list, enabling an attacker to supply a crafted serialized Java object through an exposed Jenkins interface that bypasses the filter and achieves arbitrary code execution on the Jenkins server. The affected versions are Jenkins 2.575 and LTS 2.568.1 and all earlier versions. The fixed versions are Jenkins 2.576 and LTS 2.568.2.

Java deserialization vulnerabilities in Jenkins have a severe historical exploitation record: multiple Jenkins deserialization CVEs (CVE-2015-8103, CVE-2016-0788, CVE-2017-1000353) were exploited at scale before JEP-200 was implemented. CVE-2026-70426 represents a new bypass of that defense, restoring the deserialization attack path that JEP-200 was designed to permanently close. The CVSS 9.0 score reflects high severity with network-accessible exploitation. Jenkins servers are particularly high-value targets because they hold CI/CD pipeline credentials, build artifacts, deployment tokens, and source code repository access — the same attacker-attractive credential profile that has made CI/CD pipeline compromise a primary initial access vector for supply chain attacks.

Why should TPRM professionals care?

Jenkins is CI/CD infrastructure — a server category where compromise reaches far beyond the build system itself into every system and credential the pipeline touches. Jenkins stores source control credentials, artifact signing keys, deployment tokens, and cloud provider credentials required to push code to production. A successful Jenkins RCE via CVE-2026-70426 grants access to the full scope of pipeline credentials and the capability to inject malicious code into build artifacts before they reach production — the classic supply chain attack scenario. Internet-facing Jenkins instances are the highest-risk exposure profile. The JEP-200 bypass nature of this vulnerability is particularly concerning: JEP-200 was the fundamental architectural fix for Jenkins deserialization attacks, and its bypass means that defenders who believed their Jenkins deployment was hardened against deserialization attacks must re-evaluate that assumption.

What questions should TPRM professionals ask vendors?

1. Have you upgraded all instances of Jenkins to version 2.576 (weekly) or Jenkins LTS 2.568.2 (LTS channel) to mitigate the risk of CVE-2026-70426?
2. Can you confirm whether you have audited and restricted Agent/Connect Permission assignments to minimize the risk of exploitation of the deserialization filter bypass vulnerability (CVE-2026-70426)?
3. Have you implemented the vendor-documented workaround available on GitHub for deployments unable to immediately upgrade to a fixed version, as a bridge measure against CVE-2026-70426?
4. Are you monitoring Jenkins controller logs and Remoting channel logs for unexpected deserialization errors, class resolution attempts involving unusual core classpath classes, or anomalous behavior originating from agent communication channels as indicators of potential exploitation of CVE-2026-70426?

Remediation recommendations

• Upgrade Jenkins to version 2.576 (weekly release) or LTS 2.568.2 immediately. These are the only releases that include the updated JEP-200 filter addressing CVE-2026-70426. All prior versions, including the previous LTS 2.568.1, are vulnerable.
• Restrict internet access to the Jenkins web interface and all Jenkins API endpoints. Jenkins should never be directly internet-accessible; all remote access should require VPN access or be restricted to allowlisted administrative IP ranges. This is the single most effective exposure-reduction measure for CI/CD infrastructure.
• Rotate all credentials, tokens, and secrets stored in Jenkins, including source control credentials, deployment tokens, cloud provider keys, artifact signing certificates, and any API keys stored in Jenkins credential stores or pipeline environment variables. Perform this rotation for any Jenkins instance that was internet-accessible and unpatched after August 6, 2026.
• Review Jenkins build logs, system logs, and audit plugin logs for evidence of unexpected deserialization events, unauthorized administrative changes, or unusual process activity during the pre-patch exposure window. For internet-accessible instances, this review should be treated as a mandatory forensic step.
• Conduct a full audit of the Jenkins plugin inventory and remove any plugins that are no longer actively maintained or required. Jenkins plugin vulnerabilities are a persistent secondary attack surface; reducing the plugin footprint lowers the overall Jenkins attack surface independently of the core CVE-2026-70426 remediation.

Black Kite's Jenkins - Aug2026 FocusTag® details critical insights on the event for TPRM professionals.

How TPRM Professionals Can Leverage Black Kite for These Vulnerabilities

This week's twelve FocusTags® span five distinct technology categories — OT/ICS, network security infrastructure, data platforms, development frameworks, and CI/CD automation — illustrating the breadth of the modern third-party attack surface that TPRM programs must track. The week's events demonstrate three recurring risk patterns: critical infrastructure directly threatened by unauthenticated access (Water Sector Campaign, Metabase, Cisco ASA), management and build infrastructure targeted for cascading downstream access (Cisco IMC, Jenkins), and Patch Tuesday volume events requiring precise version-specific remediation tracking across large vendor portfolios (SharePoint, Exchange Server).

The Water Sector Campaign illustrates why FocusTags® extend beyond CVE-based vulnerability tracking: the primary attack vector involves no software vulnerability exploit — just unauthenticated internet exposure on a protocol port. Conventional CVE-centered TPRM questionnaires would miss this entirely. Black Kite's external signal-based detection identifies internet-facing OT device exposure directly, enabling TPRM teams to assess vendor infrastructure risk before incidents occur.

•  Continuous External Attack Surface Monitoring: FocusTags® correlate vulnerability disclosures and active campaigns with vendor technology profiles derived from external signals — identifying internet-facing Rockwell PLCs, Metabase instances, Jenkins CI/CD servers, and Cisco management interfaces that vendors rarely disclose in formal questionnaire responses.

•  Breadth Across Technology Categories: This week's twelve-tag release spans OT, network security, database administration, web frameworks, antivirus infrastructure, and CI/CD automation — the full spectrum of modern enterprise technology that constitutes third-party risk surface. A single TPRM workflow generates actionable intelligence across all twelve simultaneously.

•  Precise Version-Specific Remediation Tracking: SharePoint's 15-CVE cluster and Exchange Server's 7-CVE cluster both require version-specific cumulative update verification. FocusTag® engagement questions embed the precise version criteria, enabling TPRM teams to conduct technically accurate vendor verification without requiring deep product expertise.

•  Continuous Risk Score Integration: FocusTag® exposure updates vendor risk ratings in real time, ensuring that active exploitation events — confirmed by FBI/EPA PSA for the Water Sector Campaign and by CISA KEV for Metabase and Cisco ASA — are immediately reflected in vendor risk scores without waiting for scheduled assessment cycles.

Strengthening TPRM Outcomes with Black Kite’s FocusTags®

Black Kite's FocusTag® technology gives TPRM teams the operational intelligence needed to keep pace with an accelerating threat landscape — from CISA KEV-listed active exploitation events affecting CI/CD infrastructure and RMM platforms, to critical unauthenticated vulnerabilities in AI workflow orchestration and self-hosted developer tooling.

Black Kite's FocusTag® technology gives TPRM teams the operational intelligence needed to keep pace with an accelerating threat landscape — from active FBI-confirmed campaigns against critical infrastructure and maximum-severity zero-day exploits in widely deployed data platforms, to clustered Microsoft Patch Tuesday events requiring precise version tracking across large vendor portfolios and CI/CD infrastructure vulnerabilities with supply chain implications.

•  Automated Vendor Scoring: Each FocusTag® automatically affects the risk scores of vendors detected running the affected technology, enabling portfolio-wide risk visibility without manual assessment effort — across all twelve of this week's tags simultaneously.

•  Targeted Vendor Engagement: FocusTags® generate specific, structured vendor questions for each vulnerability — enabling TPRM teams to send targeted remediation inquiries rather than generic questionnaires, and to verify patch status against precise version requirements including CU levels, hotfix package names, and branch-specific release numbers.

•  TPRM-Contextualized Analysis: Every FocusTag® is evaluated through a TPRM lens — assessing not just the technical severity of the vulnerability, but its implications for third-party breach scenarios, supply chain risk, critical infrastructure exposure, and vendor assessment prioritization.

About Focus Friday

Every week, we delve into the realms of critical vulnerabilities and their implications from a Third-Party Risk Management (TPRM) perspective. This series is dedicated to shedding light on pressing cybersecurity threats, offering in-depth analyses, and providing actionable insights.

FocusTags® in the Last 30 Days

• Water Sector Campaign: CVE-2017-16740, Active Cyber Campaign Targeting Internet-Facing Rockwell MicroLogix PLCs Causing Operational Disruptions at U.S. Water and Wastewater Utilities.
• Metabase: CVE-2026-72898, Unauthenticated SQL Injection via /api/session/reset_password enabling Full Administrator Takeover in Metabase Business Intelligence Platform.
• Cisco ASA & FTD - Aug2026: CVE-2026-20349, Unauthenticated Denial of Service via Crafted HTTP Request to Remote Access SSL VPN Service in Cisco Secure Firewall ASA and FTD.
• Cisco IMC - Aug2026: CVE-2026-20200, CVE-2026-20288, Argument Injection via SSH Public Key Retrieval Feature enabling Low-Privilege to Root Escalation in Cisco Integrated Management Controller.
• Cisco IOS XE - Aug2026: CVE-2026-20272, CVE-2026-20267, and 5 additional CVEs, Multiple Critical and High-Severity Vulnerabilities including Command Injection and Authentication Bypass in Cisco IOS XE Software.
• Adobe ColdFusion - Aug2026: CVE-2026-48362, and 14 additional CVEs (CVSS up to 10.0), Multiple Critical Remote Code Execution and Deserialization Vulnerabilities in Adobe ColdFusion.
• SharePoint - Aug2026: CVE-2026-63520, CVE-2026-66808, and 13 additional CVEs, Multiple Deserialization and Unauthenticated Remote Code Execution Vulnerabilities in Microsoft SharePoint Server.
• Exchange Server - Aug2026: CVE-2026-62912, CVE-2026-65813, and 5 additional CVEs, Multiple Remote Code Execution and Privilege Escalation Vulnerabilities in Microsoft Exchange Server.
• ClamAV - Aug2026: CVE-2026-20337, CVE-2026-20338, and 5 additional CVEs, Multiple ZIP Parser and File Processing Denial of Service Vulnerabilities in ClamAV Antivirus Engine.
• pgAdmin - Aug2026: CVE-2026-17566, CVE-2026-17349, CVE-2026-17351, CVE-2025-13780, CVE-2026-12045, Remote Code Execution via Unsafe Deserialization and Multiple Critical Vulnerabilities in pgAdmin 4.
• Django - Aug2026: CVE-2026-15307, CVE-2026-15920, CVE-2026-15337, CVE-2026-15830, Remote Code Execution and Multiple High-Severity Vulnerabilities in Django Web Framework.
• Jenkins - Aug2026: CVE-2026-70426, JEP-200 Deserialization Filter Bypass enabling Remote Code Execution in Jenkins Automation Server.
• TeamCity - Jul2026: CVE-2026-63077, Unauthenticated Authentication Bypass via Agent Polling Protocol leading to Remote Code Execution in JetBrains TeamCity On-Premises.
• Cisco FMC - Jul2026: CVE-2026-20316, CVE-2026-20079, Static Credential Authentication Bypass and Critical Authentication Bypass (CVSS 10.0) leading to Root Execution in Cisco Secure Firewall Management Center.
• SolarWinds WHD - Aug2026: CVE-2026-28323, CVE-2026-28299, SAML Authentication Bypass and Denial of Service Vulnerability in SolarWinds Web Help Desk.
• N-central - Aug2026: CVE-2026-18577, CVE-2026-18556, Authentication Bypass via Alternate Path leading to Full Account Takeover and RMM-Level Access in N-able N-central.
• Langflow - Aug2026: CVE-2026-9198, Unauthenticated Superuser Token Minting via /api/v1/auto_login enabling Remote Code Execution in Langflow.
• Apache Tomcat - Aug2026: CVE-2026-34486, CVE-2026-29146, EncryptInterceptor Bypass enabling Unauthenticated Remote Code Execution via Java Deserialization in Apache Tomcat Clustering.
• Gitea - Aug2026: CVE-2026-59774, Org-mode #+INCLUDE Path Traversal enabling Arbitrary File Read and Remote Code Execution in Gitea.
• WordPress - wp2shell : CVE-2026-63030, CVE-2026-60137, REST API Batch-Route Confusion Vulnerability and SQL Injection Vulnerability Leading to Unauthenticated Remote Code Execution in WordPress Core.
• NGINX - Jul2026 : CVE-2026-42533, CVE-2026-60005, CVE-2026-56434, Heap-Based Buffer Overflow Vulnerability, Uninitialized Memory Access Vulnerability, and Use-After-Free Vulnerability in NGINX.
• SolarWinds Serv-U - Jul2026 : CVE-2026-28302, CVE-2026-28304, CVE-2026-28305, CVE-2026-28306, CVE-2026-28307, CVE-2026-28308, CVE-2026-28309, CVE-2026-28310, CVE-2026-28311, CVE-2026-28312, CVE-2026-28313, CVE-2026-28314, CVE-2026-28315, CVE-2026-28316, CVE-2026-28317, CVE-2026-28321, Insecure Direct Object Reference, Privilege Escalation, Remote Code Execution, Broken Access Control, and Stored Cross-Site Scripting Vulnerabilities in SolarWinds Serv-U.
• Oracle WebLogic - Jul2026 : CVE-2026-60206, CVE-2026-60205, CVE-2026-60204, CVE-2026-60202, CVE-2026-60198, CVE-2026-60294, CVE-2026-60200, CVE-2026-60291, CVE-2026-60292, CVE-2026-60199, CVE-2026-60208, Unauthenticated Remote Code Execution and Unauthorized Data Access Vulnerabilities in Oracle WebLogic Server.
• Zimbra - Jul2026 (Latest) : No CVE, Command Injection Vulnerability in SNMP Monitoring Component and Cross-Site Scripting Vulnerabilities in Zimbra Collaboration Suite Classic Web Client.
• Exim Mail - Jul2026 : GCVE-25-2026-07-45-1, Local Directory Traversal Vulnerability Leading to Privilege Escalation in Exim Mail Transfer Agent.
• RabbitMQ : CVE-2026-57219, CVE-2026-57221, TLS Client Authentication Bypass Vulnerability, OAuth2 JWKS Verification Bypass Vulnerability, OAuth Client Secret Exposure Vulnerability, and Cross-Tenant Authorization Bypass Vulnerability in RabbitMQ Server.
• Langflow - Jul2026 (Latest) : CVE-2026-0770, CVE-2026-5027, Unsafe Code Execution Vulnerability Leading to Unauthenticated Remote Code Execution in Langflow.
• Gitea : CVE-2026-58443, Incorrect Authorization Vulnerability Allowing Public-Only API Tokens to Trigger Writes to Private Repository Branches in Gitea.
• Progress ShareFile SZC : CVE Pending, Authenticated Path Traversal Vulnerability Allowing Arbitrary File Read, Arbitrary File Write, and Directory Enumeration in Progress ShareFile Storage Zone Controller.
• SonicWall SMA1000 - Jul2026 : CVE-2026-15409, CVE-2026-15410, Unauthenticated Server-Side Request Forgery Vulnerability and Post-Authentication Code Injection Vulnerability in SonicWall SMA1000.
• MSSQL - Jul2026 : CVE-2026-42990, CVE-2026-54117, CVE-2026-54118, CVE-2026-47295, CVE-2026-54116, CVE-2026-50468, Heap-Based Buffer Overflow Vulnerability, Deserialization of Untrusted Data Vulnerabilities, SQL Injection Vulnerability, and Information Disclosure Vulnerabilities in Microsoft SQL Server.
• Exchange Server - Jul2026 : CVE-2026-55008, CVE-2026-55005, CVE-2026-55009, CVE-2026-55006, Cross-Site Scripting Vulnerability, Heap-Based Buffer Overflow Vulnerability, Deserialization of Untrusted Data Vulnerability, and Privilege Escalation Vulnerability in Microsoft Exchange Server.
• Zimbra - Jul2026 : No CVE, Stored Cross-Site Scripting Vulnerability in Zimbra Collaboration Suite Classic Web Client.
• Roundcube - Jul2026 : CVE-2026-54433, Zero-Click Stored Cross-Site Scripting Vulnerability in Roundcube Webmail.
• FreeBSD - Jul2026 : CVE-2026-49418, CVE-2026-49419, CVE-2026-49415, Use-After-Free Vulnerability, Jail Reference Count Underflow Vulnerability, and Time-of-Check Time-of-Use Race Condition Vulnerability in FreeBSD.
• JoomShaper SP Page Builder : CVE-2026-48908, Critical Unauthenticated Remote Code Execution Vulnerability in JoomShaper SP Page Builder.
• Langflow - Jul2026 : CVE-2026-55255, High-Severity Insecure Direct Object Reference Vulnerability in Langflow.

See Black Kite's full CVE Database and the critical TPRM vulnerabilities that have an applied  FocusTags® at https://blackkite.com/cve-database.

References

https://www.fbi.gov/investigate/cyber/alerts/2026/malicious-cyber-actors-targeting-water-and-wastewater-sector-internet--facing-programmable-logic-controllers-causing-operational-disruptions
https://thehackernews.com/2026/08/over-4400-rockwell-plcs-exposed-online.html
https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1790.html
https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.PN1010.html
https://www.cve.org/CVERecord?id=CVE-2026-72898
https://github.com/metabase/metabase/security/advisories/GHSA-vwf4-m7j8-wcjf
https://www.metabase.com/blog/security-advisory-upgrade-now
https://thehackernews.com/2026/08/metabase-zero-day-exploited-in-wild.html
https://www.cve.org/CVERecord?id=CVE-2026-20349
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-vpn-dos-dzv4mQFF
https://www.bleepingcomputer.com/news/security/cisco-warns-of-asa-and-ftd-vpn-flaw-exploited-to-crash-devices/
https://www.cve.org/CVERecord?id=CVE-2026-20200
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cimc-cmd-inj-bv5nNzaB
https://www.penligent.ai/hackinglabs/cve-2026-20200/
https://www.cve.org/CVERecord?id=CVE-2026-20272
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-iosxe-V8NMuMZJ
https://securityonline.info/cisco-ios-xe-cve-2026-20272/
https://www.cve.org/CVERecord?id=CVE-2026-48362
https://helpx.adobe.com/security/products/coldfusion/apsb26-90.html
https://cybersecuritynews.com/adobe-coldfusion-vulnerabilities-code-execution/
https://www.cve.org/CVERecord?id=CVE-2026-63520
https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2026-66808
https://www.bleepingcomputer.com/microsoft-patch-tuesday-reports/Microsoft-Patch-Tuesday-August-2026.html
https://www.cve.org/CVERecord?id=CVE-2026-65813
https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2026-65813
https://support.microsoft.com/help/5121573
https://support.microsoft.com/help/5121574
https://support.microsoft.com/help/5121575
https://support.microsoft.com/help/5121576
https://blog.clamav.net/2026/08/clamav-154-and-146-security-patch.html
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-clamav-WuuvVd26
https://securityonline.info/clamav-vulnerabilities-cisco-dos-advisory/
https://www.cve.org/CVERecord?id=CVE-2026-17566
https://www.pgadmin.org/docs/pgadmin4/latest/release_notes_9_18.html
https://securityonline.info/pgadmin-4-rce-flaw-leads-three-critical-fixes-in-version-9-17/
https://www.cve.org/CVERecord?id=CVE-2026-15307
https://www.djangoproject.com/weblog/2026/aug/04/security-releases/
https://securityonline.info/django-vulnerability-cve-2026-15307-can-enable-remote-code-execution/
https://www.cve.org/CVERecord?id=CVE-2026-70426
https://www.jenkins.io/security/advisory/2026-08-06/
https://securityonline.info/jenkins-cve-2026-70426-rce/