Microsoft confirmed exploitation of a perfect-score flaw in Entra ID, the identity service behind most Microsoft 365 and Azure estates, then fixed it on its own infrastructure with nothing for customers to install. SAP's commerce platform came under attack three days after its patch, with no public exploit code to work from. CISA added a VMware vCenter flaw to the Known Exploited catalogue on 18 August, where a campaign has already reached victims in 47 countries and left persistence behind, and an MLflow flaw on 19 August now being used to steal cloud credentials out of AI engineering stacks. Citrix published a critical gateway authentication bypass on 19 August with no exploitation yet reported, which makes this the rare week where the patch window on a NetScaler flaw is still open.
1CriticalCVSS 10.0
Microsoft Entra ID Deserialisation Flaw Exploited in the Wild — CVE-2026-69836
CVSS 10.0 | Microsoft advisory, 20 August 2026* Deserialisation of untrusted data in Entra ID allows an unauthenticated attacker to execute code over a network. It scores 10.0 because it is network reachable, needs no credentials, requires no user interaction and is low in complexity. Microsoft credited its own principal security engineer Robert Fitzpatrick with the discovery, confirmed exploitation had occurred, and declined to name the actors, the timeframe, the number of tenants affected or what the attackers were after. Because Entra ID is a managed service, Microsoft says it has already mitigated the flaw across its infrastructure: no patch, no KB article, no configuration change for customers.
India exposureIndian BFSI, IT services, GCCs and government departments run authentication, conditional access and single sign-on through Entra ID without operating any of it. The exposure here is not a device to patch but a dependency to account for: an identity provider compromise reaches every application behind it, and the customer has no way to inspect the platform independently.
ActionTreat this as a detection and assurance task rather than a patching one. Review sign-in logs, privileged role assignments and application consent grants for the period before 20 August. Confirm that Microsoft service health and security messages route to the SOC rather than to an unread mailbox. Test that break-glass accounts work and are alerted on. Record the dependency in the risk register, because "no customer action" is not the same as "no customer impact".
SourceMicrosoft advisory, 20 August 2026; Help Net Security, 21 August 2026; The Hacker News and BleepingComputer, August 2026.
2CriticalCVSS 9.8
VMware vCenter Path Traversal Exploited for Persistent Access — CVE-2026-59310
CVSS 9.8 | Broadcom patch 29 July; CISA KEV, 18 August 2026* A path traversal weakness in the vCenter Syslog Server component allows an attacker with network access to write outside the intended directory and execute code without authenticating. Broadcom released fixes on 29 July 2026. The German security firm QUIRSO reports that exploitation began on 3 August, five days later, and counted 361 unique victim IP addresses across 47 countries, with Germany, the United States, Turkey, Iran and France most represented. The intrusions install a cron job that runs reverse_ssh, an open-source tool that dials out to attacker infrastructure. Attribution remains unclear, though the tradecraft has been described as consistent with an APT actor.
India exposurevCenter is the control plane, not just another server. Indian data centres, BFSI private clouds, hospital virtualisation estates, manufacturing plant IT and managed service providers frequently expose vCenter to a wider management network than intended, and one compromised vCenter is administrative reach over every workload beneath it.
ActionMove to Broadcom's fixed builds now if you have not already, given the patch is over three weeks old and exploitation began within a week of it. Patching does not evict an attacker who arrived earlier, so hunt separately: unexplained cron entries, outbound SSH or long-lived encrypted sessions from vCenter, new vSphere SSO administrator accounts, and unusual REST API activity. Restrict vCenter management access to a dedicated administrative network.
SourceThe Hacker News, 12 August 2026; Infosecurity Magazine, August 2026; CISA KEV addition, 18 August 2026.
3CriticalCVSS 9.3
MLflow SSRF Bypass Used to Steal Cloud Credentials — CVE-2026-64849
CVSS 9.3 | CISA KEV, 19 August 2026* MLflow is a Linux Foundation-supported open-source platform for machine learning and LLM engineering, with reported downloads in the tens of millions per month. Its default tracking server exposes the model-registry webhooks API without authentication, including a test endpoint that returns the upstream response body to the caller. That turns the server into a server-side request forgery primitive, bypassing protections added in version 3.10.0, and lets an unauthenticated attacker make it fetch internal, loopback and cloud metadata endpoints and read the answers. watchTowr observed scanning within hours of the CVE being assigned on 17 August, and confirmed incidents where AWS IAM credentials were exfiltrated and then used to enumerate cloud resources, run cryptominers, or create new IAM users for persistence.
India exposureIndian IT services firms, GCCs, fintechs and product companies have stood up MLflow quickly during the current wave of AI work, often on cloud instances managed by data science teams rather than by infrastructure security. Those servers sit inside the cloud account with an instance role attached, which is precisely what makes the metadata endpoint worth reaching.
ActionUpgrade to MLflow 3.15.0 or later. Remove any tracking server from internet exposure and put authentication in front of it. Enforce IMDSv2 so metadata access requires a session token, and scope instance roles to the minimum the workload needs. Review CloudTrail or the equivalent for credential use from unexpected addresses, new IAM principals, and unexplained compute.
SourceBleepingComputer and SecurityWeek, 20 August 2026; CISA KEV addition, 19 August 2026.
4CriticalCVSS 10.0
SAP Commerce Cloud Flaw Attacked Three Days After Patch — CVE-2026-58231
CVSS 10.0 | SAP Security Patch Day, 11 August 2026* Insufficient authorisation checks and input validation let an unauthenticated attacker abuse a default authentication client, submit crafted input to functions that do not validate it, and execute arbitrary code, compromising internal components. SAP shipped the fix on 11 August. Defused recorded exploitation attempts against its honeypots on 14 August, at a point when there was no public proof-of-concept and no reported in-the-wild activity; KEVIntel independently confirmed attempts the same week, and SecurityWeek reported exploit material available by 15 August. Three days from patch to attack, with no PoC to work from, is the number to note.
India exposureSAP Commerce Cloud underpins storefronts and B2B ordering for Indian retail, automotive, FMCG and industrial distribution. These platforms hold order, pricing and customer data and connect back into ERP, so code execution on the commerce tier is rarely contained to the commerce tier.
ActionApply the 11 August SAP patch and confirm it reached every environment, including staging systems that share credentials with production. Restrict the platform's externally reachable endpoints to what the business actually needs. Review access logs from 11 August onward, and rotate credentials used for downstream ERP and payment integrations if anything unexplained appears.
SourceThe Hacker News, 15 August 2026; SecurityWeek, 17 August 2026.
5CriticalCVSS 9.3
Citrix NetScaler Gateway Authentication Bypass Published Before Exploitation — CVE-2026-19490
CVSS 9.3 | Citrix bulletin CTX696939, 19 August 2026* An authentication bypass through an alternative path affects NetScaler ADC and Gateway appliances configured as a gateway, covering SSL VPN, ICA Proxy, CVPN and RDP Proxy, or as an AAA virtual server. On newer firmware the appliance must also have a SAML action configured; on older builds the gateway or AAA configuration alone is enough. The same bulletin covers CVE-2026-19489, a memory overflow scored 8.8 that applies only where SIP ALG is enabled on a Large Scale NAT group and can cause unpredictable behaviour or denial of service. Rapid7 reported no observed exploitation as of 19 August, while noting that authentication bypasses in this product line have historically not stayed unexploited for long.
India exposureNetScaler carries remote access, application delivery and partner portals for Indian banks, insurers, IT services firms and hospital chains, and those appliances are internet-facing by design. An authentication bypass on a gateway is a bypass of the control that everything behind it assumes is working.
ActionUpgrade to 14.1-73.32 or later, or 13.1-63.21 or later; FIPS builds move to 14.1-73.32 FIPS or 13.1-37.277 for FIPS and NDcPP. Check whether a SAML action is configured on gateway or AAA virtual servers, and whether SIP ALG is enabled on any LSN group. Prioritise internet-facing appliances, and verify that cloud marketplace images you deploy from carry a patched build.
SourceCitrix bulletin CTX696939, 19 August 2026; Rapid7, 19 August 2026; Help Net Security, 21 August 2026.
6
Evooo1Bot Converts Routers and Firewalls into Outbound Proxy Relays
No CVE | FortiGuard Labs, 13 August 2026* FortiGuard Labs documented a previously unreported Linux botnet, named for a hardcoded string present in every sample. It reuses the leaked Mirai DDoS engine and adds encrypted command and control, SSH credential scanning, a credential sniffer, interactive shell access, sixteen flooding methods, and checks for debuggers, sandboxes and virtual machines. Its exploit dispatcher works through known vulnerabilities going back as far as 2007 in products from Alcatel, NETGEAR, Tenda, D-Link, TP-Link, Zyxel, Telesquare, Hikvision and Mitsubishi Electric, alongside Atlassian, Kubernetes, PHP-CGI and WSO2. The relay mode deserves attention: rather than opening a listening port, the infected device dials out to an operator-controlled server, making it a durable anonymisation proxy that outbound-permissive firewall rules will not stop. FortiGuard reports activity since July 2026.
India exposureThe exposure sits in branch offices, retail outlets, clinics, campuses and plant networks, where SOHO routers, CCTV recorders and small firewalls run firmware nobody owns and default credentials nobody rotated. A relay generates no ransom note and no outage, so it can sit for months while traffic leaves through an Indian commercial IP address, which is the attacker's reason for wanting it.
ActionInventory internet-facing edge devices, including cameras and recorders procured outside IT. Update firmware, remove WAN-side management interfaces, disable Telnet, and rotate default credentials. Restrict outbound traffic from device VLANs to what those devices genuinely need, and alert on sustained outbound encrypted sessions or proxy-like behaviour from an appliance that should only be talking to a handful of destinations.
SourceFortiGuard Labs, 13 August 2026; The Hacker News and BleepingComputer, August 2026.
Takeaway
The highest-severity items this week were the ones furthest from the patch cycle. Entra ID was fixed without customer involvement, MLflow was installed by data science teams rather than infrastructure teams, and the Evooo1Bot devices sit in no one's asset register. Where a patch did exist, the interval kept shrinking: five days for vCenter, three for SAP Commerce Cloud. Against that, NetScaler is the one genuine opportunity, with fixed builds available and no exploitation reported as of 19 August. Two of the six items end at stolen cloud credentials rather than at the compromised host, which is the direction worth planning for.
This week's vendor sweep named Fortinet, Cisco, Palo Alto Networks, Check Point, Juniper, SonicWall, Sophos, Barracuda, WatchGuard, Zscaler, Citrix NetScaler, Ivanti, F5 BIG-IP, Versa, VeloCloud, Aruba EdgeConnect and Seqrite. Fortinet's 18 August advisories across FortiWeb, FortiClient Windows and FortiManager carry no reported exploitation. Three further KEV additions did not displace the items above but merit patching where they apply: Windows IKE Service Extensions CVE-2026-33824, a double free in IKEv2 fragment reassembly patched in April and escalated to known-exploited on 18 August, which matters wherever Windows terminates IPsec VPNs; SharePoint CVE-2026-55040, a JWT forgery bypass added the same day as exploitation rose after a public proof-of-concept; and TrueConf Server CVE-2026-72529 and CVE-2026-72530, added on 20 August.
Nirad Threat Research
WeeklyLatest Weekly Brief21 August 2026Open issue →
Microsoft confirmed exploitation of a perfect-score flaw in Entra ID, the identity service behind most Microsoft 365 and Azure estates, then fixed it on its own infrastructure with nothing for customers to install. SAP's commerce platform came under attack three days after its patch, with no public exploit code to work from. CISA added a VMware vCenter flaw to the Known Exploited catalogue on 18 August, where a campaign has already reached victims in 47 countries and left persistence behind, and an MLflow flaw on 19 August now being used to steal cloud credentials out of AI engineering stacks. Citrix published a critical gateway authentication bypass on 19 August with no exploitation yet reported, which makes this the rare week where the patch window on a NetScaler flaw is still open.
1CriticalCVSS 10.0
Microsoft Entra ID Deserialisation Flaw Exploited in the Wild — CVE-2026-69836
CVSS 10.0 | Microsoft advisory, 20 August 2026* Deserialisation of untrusted data in Entra ID allows an unauthenticated attacker to execute code over a network. It scores 10.0 because it is network reachable, needs no credentials, requires no user interaction and is low in complexity. Microsoft credited its own principal security engineer Robert Fitzpatrick with the discovery, confirmed exploitation had occurred, and declined to name the actors, the timeframe, the number of tenants affected or what the attackers were after. Because Entra ID is a managed service, Microsoft says it has already mitigated the flaw across its infrastructure: no patch, no KB article, no configuration change for customers.
India exposureIndian BFSI, IT services, GCCs and government departments run authentication, conditional access and single sign-on through Entra ID without operating any of it. The exposure here is not a device to patch but a dependency to account for: an identity provider compromise reaches every application behind it, and the customer has no way to inspect the platform independently.
ActionTreat this as a detection and assurance task rather than a patching one. Review sign-in logs, privileged role assignments and application consent grants for the period before 20 August. Confirm that Microsoft service health and security messages route to the SOC rather than to an unread mailbox. Test that break-glass accounts work and are alerted on. Record the dependency in the risk register, because "no customer action" is not the same as "no customer impact".
SourceMicrosoft advisory, 20 August 2026; Help Net Security, 21 August 2026; The Hacker News and BleepingComputer, August 2026.
2CriticalCVSS 9.8
VMware vCenter Path Traversal Exploited for Persistent Access — CVE-2026-59310
CVSS 9.8 | Broadcom patch 29 July; CISA KEV, 18 August 2026* A path traversal weakness in the vCenter Syslog Server component allows an attacker with network access to write outside the intended directory and execute code without authenticating. Broadcom released fixes on 29 July 2026. The German security firm QUIRSO reports that exploitation began on 3 August, five days later, and counted 361 unique victim IP addresses across 47 countries, with Germany, the United States, Turkey, Iran and France most represented. The intrusions install a cron job that runs reverse_ssh, an open-source tool that dials out to attacker infrastructure. Attribution remains unclear, though the tradecraft has been described as consistent with an APT actor.
India exposurevCenter is the control plane, not just another server. Indian data centres, BFSI private clouds, hospital virtualisation estates, manufacturing plant IT and managed service providers frequently expose vCenter to a wider management network than intended, and one compromised vCenter is administrative reach over every workload beneath it.
ActionMove to Broadcom's fixed builds now if you have not already, given the patch is over three weeks old and exploitation began within a week of it. Patching does not evict an attacker who arrived earlier, so hunt separately: unexplained cron entries, outbound SSH or long-lived encrypted sessions from vCenter, new vSphere SSO administrator accounts, and unusual REST API activity. Restrict vCenter management access to a dedicated administrative network.
SourceThe Hacker News, 12 August 2026; Infosecurity Magazine, August 2026; CISA KEV addition, 18 August 2026.
3CriticalCVSS 9.3
MLflow SSRF Bypass Used to Steal Cloud Credentials — CVE-2026-64849
CVSS 9.3 | CISA KEV, 19 August 2026* MLflow is a Linux Foundation-supported open-source platform for machine learning and LLM engineering, with reported downloads in the tens of millions per month. Its default tracking server exposes the model-registry webhooks API without authentication, including a test endpoint that returns the upstream response body to the caller. That turns the server into a server-side request forgery primitive, bypassing protections added in version 3.10.0, and lets an unauthenticated attacker make it fetch internal, loopback and cloud metadata endpoints and read the answers. watchTowr observed scanning within hours of the CVE being assigned on 17 August, and confirmed incidents where AWS IAM credentials were exfiltrated and then used to enumerate cloud resources, run cryptominers, or create new IAM users for persistence.
India exposureIndian IT services firms, GCCs, fintechs and product companies have stood up MLflow quickly during the current wave of AI work, often on cloud instances managed by data science teams rather than by infrastructure security. Those servers sit inside the cloud account with an instance role attached, which is precisely what makes the metadata endpoint worth reaching.
ActionUpgrade to MLflow 3.15.0 or later. Remove any tracking server from internet exposure and put authentication in front of it. Enforce IMDSv2 so metadata access requires a session token, and scope instance roles to the minimum the workload needs. Review CloudTrail or the equivalent for credential use from unexpected addresses, new IAM principals, and unexplained compute.
SourceBleepingComputer and SecurityWeek, 20 August 2026; CISA KEV addition, 19 August 2026.
4CriticalCVSS 10.0
SAP Commerce Cloud Flaw Attacked Three Days After Patch — CVE-2026-58231
CVSS 10.0 | SAP Security Patch Day, 11 August 2026* Insufficient authorisation checks and input validation let an unauthenticated attacker abuse a default authentication client, submit crafted input to functions that do not validate it, and execute arbitrary code, compromising internal components. SAP shipped the fix on 11 August. Defused recorded exploitation attempts against its honeypots on 14 August, at a point when there was no public proof-of-concept and no reported in-the-wild activity; KEVIntel independently confirmed attempts the same week, and SecurityWeek reported exploit material available by 15 August. Three days from patch to attack, with no PoC to work from, is the number to note.
India exposureSAP Commerce Cloud underpins storefronts and B2B ordering for Indian retail, automotive, FMCG and industrial distribution. These platforms hold order, pricing and customer data and connect back into ERP, so code execution on the commerce tier is rarely contained to the commerce tier.
ActionApply the 11 August SAP patch and confirm it reached every environment, including staging systems that share credentials with production. Restrict the platform's externally reachable endpoints to what the business actually needs. Review access logs from 11 August onward, and rotate credentials used for downstream ERP and payment integrations if anything unexplained appears.
SourceThe Hacker News, 15 August 2026; SecurityWeek, 17 August 2026.
5CriticalCVSS 9.3
Citrix NetScaler Gateway Authentication Bypass Published Before Exploitation — CVE-2026-19490
CVSS 9.3 | Citrix bulletin CTX696939, 19 August 2026* An authentication bypass through an alternative path affects NetScaler ADC and Gateway appliances configured as a gateway, covering SSL VPN, ICA Proxy, CVPN and RDP Proxy, or as an AAA virtual server. On newer firmware the appliance must also have a SAML action configured; on older builds the gateway or AAA configuration alone is enough. The same bulletin covers CVE-2026-19489, a memory overflow scored 8.8 that applies only where SIP ALG is enabled on a Large Scale NAT group and can cause unpredictable behaviour or denial of service. Rapid7 reported no observed exploitation as of 19 August, while noting that authentication bypasses in this product line have historically not stayed unexploited for long.
India exposureNetScaler carries remote access, application delivery and partner portals for Indian banks, insurers, IT services firms and hospital chains, and those appliances are internet-facing by design. An authentication bypass on a gateway is a bypass of the control that everything behind it assumes is working.
ActionUpgrade to 14.1-73.32 or later, or 13.1-63.21 or later; FIPS builds move to 14.1-73.32 FIPS or 13.1-37.277 for FIPS and NDcPP. Check whether a SAML action is configured on gateway or AAA virtual servers, and whether SIP ALG is enabled on any LSN group. Prioritise internet-facing appliances, and verify that cloud marketplace images you deploy from carry a patched build.
SourceCitrix bulletin CTX696939, 19 August 2026; Rapid7, 19 August 2026; Help Net Security, 21 August 2026.
6
Evooo1Bot Converts Routers and Firewalls into Outbound Proxy Relays
No CVE | FortiGuard Labs, 13 August 2026* FortiGuard Labs documented a previously unreported Linux botnet, named for a hardcoded string present in every sample. It reuses the leaked Mirai DDoS engine and adds encrypted command and control, SSH credential scanning, a credential sniffer, interactive shell access, sixteen flooding methods, and checks for debuggers, sandboxes and virtual machines. Its exploit dispatcher works through known vulnerabilities going back as far as 2007 in products from Alcatel, NETGEAR, Tenda, D-Link, TP-Link, Zyxel, Telesquare, Hikvision and Mitsubishi Electric, alongside Atlassian, Kubernetes, PHP-CGI and WSO2. The relay mode deserves attention: rather than opening a listening port, the infected device dials out to an operator-controlled server, making it a durable anonymisation proxy that outbound-permissive firewall rules will not stop. FortiGuard reports activity since July 2026.
India exposureThe exposure sits in branch offices, retail outlets, clinics, campuses and plant networks, where SOHO routers, CCTV recorders and small firewalls run firmware nobody owns and default credentials nobody rotated. A relay generates no ransom note and no outage, so it can sit for months while traffic leaves through an Indian commercial IP address, which is the attacker's reason for wanting it.
ActionInventory internet-facing edge devices, including cameras and recorders procured outside IT. Update firmware, remove WAN-side management interfaces, disable Telnet, and rotate default credentials. Restrict outbound traffic from device VLANs to what those devices genuinely need, and alert on sustained outbound encrypted sessions or proxy-like behaviour from an appliance that should only be talking to a handful of destinations.
SourceFortiGuard Labs, 13 August 2026; The Hacker News and BleepingComputer, August 2026.
Takeaway
The highest-severity items this week were the ones furthest from the patch cycle. Entra ID was fixed without customer involvement, MLflow was installed by data science teams rather than infrastructure teams, and the Evooo1Bot devices sit in no one's asset register. Where a patch did exist, the interval kept shrinking: five days for vCenter, three for SAP Commerce Cloud. Against that, NetScaler is the one genuine opportunity, with fixed builds available and no exploitation reported as of 19 August. Two of the six items end at stolen cloud credentials rather than at the compromised host, which is the direction worth planning for.
This week's vendor sweep named Fortinet, Cisco, Palo Alto Networks, Check Point, Juniper, SonicWall, Sophos, Barracuda, WatchGuard, Zscaler, Citrix NetScaler, Ivanti, F5 BIG-IP, Versa, VeloCloud, Aruba EdgeConnect and Seqrite. Fortinet's 18 August advisories across FortiWeb, FortiClient Windows and FortiManager carry no reported exploitation. Three further KEV additions did not displace the items above but merit patching where they apply: Windows IKE Service Extensions CVE-2026-33824, a double free in IKEv2 fragment reassembly patched in April and escalated to known-exploited on 18 August, which matters wherever Windows terminates IPsec VPNs; SharePoint CVE-2026-55040, a JWT forgery bypass added the same day as exploitation rose after a public proof-of-concept; and TrueConf Server CVE-2026-72529 and CVE-2026-72530, added on 20 August.
Four internet-facing management planes were pulled into active exploitation over the past three weeks — an SD-WAN orchestrator, an SSL-VPN gateway pair, a firewall manager, and a wave of exposed water-utility controllers in the United States — and every one of those product families sits inside Indian power, oil and gas, telecom, and transport estates. Add a pending Bill on critical-infrastructure accountability and a CERT-In push on AI-accelerated exploitation, and August opens with the sector's remote-access layer as the defining risk.
1. Sector snapshot
The pattern across July was consistent: attackers went after the systems that manage other systems, not end-user endpoints. SD-WAN orchestrators, SSL-VPN concentrators, and firewall management consoles gained three separate CISA Known Exploited Vulnerabilities entries in the last ten days of July, while a joint FBI-CISA-EPA advisory tracked hands-on-keyboard intrusion into internet-exposed PLCs at water utilities. None of these incidents named an Indian victim. All of them depend on product families and exposure patterns that are common in Indian CI operators' estates, which is the lens this issue applies throughout.
An unauthenticated attacker with network access to the on-premises VeloCloud Orchestrator web interface can run arbitrary operating-system commands, giving full control of the SD-WAN fabric it manages. No credentials are required and internet exposure is the appliance's default posture.
India exposuretelecom carriers, power utilities, and multi-site industrial operators using on-prem VCO to manage branch and substation SD-WAN links.
Actionpatch to 5.2.3.14 / 6.1.3.4 / 6.4.2.4 / 7.0.0.1 or later immediately; if patching is delayed, remove VCO from direct internet exposure and review edge configuration for unauthorised changes.
SourceArista PSIRT; BleepingComputer; The Register (27–28 Jul 2026).
2CriticalCVSS 10.0
SonicWall SMA1000 CVE-2026-15409 (CVSS 10.0 SSRF) chained with CVE-2026-15410 (CVSS 7.2 code injection) — SSL-VPN gateways compromised in the wild
The unauthenticated SSRF flaw in the Work Place interface gives initial access; chained with the post-authentication injection bug, it yields full appliance compromise and credential theft. SonicWall and CISA confirmed active exploitation.
India exposureany CI operator using SMA1000 as the remote-access front door for OT vendors, contractors, or distributed field staff.
Actionapply firmware 12.4.3-03453 / 12.5.0-02835 or later now; rotate all SMA1000 admin and Work Place credentials and enforce MFA regardless of patch status.
SourceSonicWall PSIRT; Arctic Wolf; Canadian Centre for Cyber Security (14–15 Jul 2026).
A built-in account with a static credential lets an unauthenticated attacker log in to FMC and read sensitive configuration data; Cisco rates it High severity because it can be chained with other FMC flaws to escalate privilege over firewall policy.
India exposureany operator centralising firewall policy for CI segments through FMC, including managed-security arrangements.
Actionapply Cisco's hotfix across 7.0–7.7 and 10.0 branches; hunt for the account's use via FMC license and access logs.
SourceCisco PSIRT; The Hacker News; CISA KEV (29–30 Jul 2026).
4
Suspected Iran-linked actor exploiting exposed water-utility PLCs across multiple US states — a global TTP, not an India-targeting claim
Actors believed by investigators to be CyberAv3ngers (also tracked as Storm-0784, Bauxite, UNC5691) accessed internet-facing Rockwell/Allen-Bradley, Schneider Electric, and Siemens PLCs, changed device passwords and IP addresses to lock out operators, and altered HMI displays; over thirty Minnesota systems and utilities in at least a dozen states were affected, forcing several back to manual operation. No ransom demand was made.
India exposurethe same PLC brands and internet-exposed-controller pattern are present in Indian water treatment, power distribution, and manufacturing OT; the technique, not the target, is the transferable risk.
Actioninventory every internet-facing PLC; remove direct exposure, restrict engineering-workstation access, and rehearse a manual-operations fallback.
- Management-plane concentration risk. All three July KEV additions above are administrative interfaces, not user-facing services — a single compromised orchestrator, VPN gateway, or firewall manager gives an attacker control over an entire fleet of devices at once, a disproportionate return for one exploit chain. - OT threat-actor growth. Dragos now tracks 26 distinct OT-focused threat groups worldwide, 11 confirmed active through 2025, alongside a documented rise in ransomware reaching industrial operators; the same report flagged over 100 internet-exposed battery energy storage system inverters, a device class expanding fast in India's renewable rollout. Source (with date): Dragos 2026 OT Cybersecurity Year in Review (17 Feb 2026). - Pakistan-nexus APT36/SideCopy continue cross-platform RAT campaigns, now spanning Linux as well as Windows hosts, against Indian defence, government, and CI-adjacent targets — a standing backdrop rather than a new incident this cycle. Source (with date): The Hacker News (11 Feb 2026).
4. Regulatory & compliance watch
- CERT-In frontier-AI exercises and OEM directive. Between June and July 2026, CERT-In ran ten drills on defending against AI-accelerated exploitation, with 1,470 participants from 345 organisations spanning power, telecom, and BFSI, and issued a June directive requiring OEMs and technology providers to build in AI-assisted security testing and faster patch response. Source (with date): CERT-In; The News Mill (30 Jul 2026). - Critical Infrastructure (Resilience, Protection and Accountability) Bill, 2026 remains a pending private member's Bill in the Rajya Sabha, proposing criminal liability for negligent CI failures, a national CI classification framework, and mandatory monitoring dashboards for power grids, dams, ports, and transit systems; it has not yet been taken up for passage. Source (with date): ANI (6 Feb 2026); OpIndia (Jul 2026). - NCIIPC/CERT-In baseline obligations — annual third-party audit for Protected Systems, six-hour incident reporting, and 180-day in-India log retention under the CERT-In Cyber Security Directions, 2022 — are the practical test bench the July water-utility incident argues for rehearsing now, before an equivalent event, not after. Source (with date): CERT-In Cyber Security Directions, 2022, issued under Section 70B(6) IT Act (28 Apr 2022).
5. Actor in focus
CyberAv3ngers (Storm-0784 / Bauxite / UNC5691) — attribution suspected, not independently confirmed. Publicly tracked as an Iran-linked, IRGC-associated cluster, CyberAv3ngers' hallmark is opportunistic compromise of internet-exposed industrial controllers rather than a single software vulnerability: default or reused credentials, direct PLC web-interface access, and manipulation of device configuration to disrupt rather than destroy. The late-July water-utility campaign fits that pattern and again avoided a ransom demand, consistent with a disruption or messaging motive over financial gain. For Indian CI operators the relevance is the access pattern: any PLC or RTU reachable from the open internet without compensating controls is a candidate for the same opportunistic compromise, regardless of who is behind the next attempt. Source (with date): CISA/FBI/EPA advisory AA26-097A; Tenable (22, 28 Jul 2026).
6. IOC pack
Only public, attributed indicators; defang before operational use and pull exact values from the primary advisories. - CVE-2026-16812 (Arista VCO): exploitation source IPs from Arista's security advisory — 8[.]19[.]75[.]217, 206[.]72[.]242[.]124, 206[.]72[.]242[.]162 (Arista Security Advisory 0144, Jul 2026). - CVE-2026-15409/15410 (SonicWall SMA1000):extraweb_access.log entries showing /wsproxy requests with suspicious localhost or loopback host parameters returning HTTP 101, and rogue /__api__/login or /__api__/logout routes inside /var/lib/unit/conf.json (SonicWall PSIRT; Rapid7, Jul 2026). - CVE-2026-20316 (Cisco FMC): unexplained entries referencing /var/tmp/license.tmp in /var/log/messages (Cisco/The Hacker News, 30 Jul 2026). - AA26-097A PLC intrusions: unscheduled PLC password/IP changes, altered Add-On Instruction code modules, and HMI display values inconsistent with field readings — full indicator set in the CISA advisory (22 Jul 2026 update).
7. Tiered actions (Board / CISO / SOC)
Board: Commission a 72-hour inventory of every internet-facing management interface — SD-WAN orchestrator, SSL-VPN, firewall manager, PLC/HMI remote access — across CI estates, and track the pending CI Accountability Bill for governance implications.
CISO: Patch CVE-2026-16812, CVE-2026-15409/15410, and CVE-2026-20316 on an emergency track; rotate all SonicWall and Arista admin credentials; commission compromise assessments wherever vulnerable versions were internet-facing; align vulnerability SLAs to CERT-In's AI-accelerated exploitation guidance.
SOC: Hunt the published Arista VCO IPs and SonicWall log artefacts; audit every PLC/RTU for direct internet exposure and unscheduled configuration changes; validate MFA on OT remote-access paths; confirm 180-day log retention and rehearse manual-operations fallback for at least one CI process line.
8. Source index
Arista PSIRT / Security Advisory 0144, CVE-2026-16812 · BleepingComputer (27 Jul 2026) · The Register (28 Jul 2026) · cybersecuritynews.com (3 Aug 2026) · SonicWall PSIRT, CVE-2026-15409/15410 · Arctic Wolf (15 Jul 2026) · Canadian Centre for Cyber Security AV26-699 (14 Jul 2026) · Cisco PSIRT, CVE-2026-20316 · The Hacker News (30 Jul 2026) · CISA KEV catalog (27, 29 Jul 2026) · CISA/FBI/EPA advisory AA26-097A (7 Apr 2026, updated 22 Jul 2026) · Tenable (28 Jul 2026) · Dragos 2026 OT Cybersecurity Year in Review (17 Feb 2026) · The Hacker News, APT36/SideCopy (11 Feb 2026) · CERT-In; The News Mill (30 Jul 2026) · ANI (6 Feb 2026) · OpIndia (Jul 2026) · CERT-In Cyber Security Directions, 2022 (28 Apr 2022).
In each of this week's items the AI is doing something ordinary, only cheaply. It writes an exploit script for an industrial controller from documentation that was already public. It scaffolds the back end of a fraud operation and cleans up the target list. It reads a project file, or a web page, that somebody else controls. No new capability was required, and in three of the four cases the boundary that failed was one the vendor had already built. What changed is the cost of the work on the other side of it.
1
American agencies warn that exploit scripts built with AI assistance are being used against internet-exposed Siemens S7 controllers
Joint advisory AA26-231A was released on 18 August 2026 by the NSA, CISA, the FBI, the Department of Energy and the Environmental Protection Agency. It describes an active campaign against Siemens S7 Series programmable logic controllers that are reachable from the internet or poorly separated from enterprise networks. The agencies state that the actors used AI to quickly produce and refine exploit scripts from public technical documentation and known vulnerabilities, then packaged them to look like legitimate operational-technology monitoring utilities. Targets were located through internet-wide scanning services including Censys and ZoomEye. The S7-200, S7-300, S7-400, S7-1200, S7-1500 and F-series safety controllers are all named, across critical manufacturing, energy, water and wastewater, chemical, food and agriculture, and commercial facilities. The advisory records disruption at more than thirty community water systems in Minnesota and reported activity across at least twelve states.
Why it matters for IndiaThe documented incidents are American and the advisory does not attribute any of this activity to targeting of India. The transferable part is the economics. S7 controllers run water boards, state generation and distribution utilities, refineries, fertiliser and cement plants and metro systems here, often on networks where the plant and corporate sides were joined years ago for reporting convenience. Writing reliable code against an unfamiliar controller was the step that kept smaller operators out of scope. When that step costs a few hours, the long tail of municipal utilities and mid-sized plants becomes worth an attacker's time, and those are precisely the operators without an OT security team.
ActionInventory every S7 controller with its firmware version, including units a machinery vendor installed and nobody entered in the asset register. Confirm exposure empirically by searching your own address ranges on a public scanning service, rather than trusting the network diagram. Block S7comm on TCP port 102 at the perimeter and separate plant from corporate networks through a properly configured DMZ. Enable PLC password protection, require multi-factor authentication for remote engineering access, and monitor for unauthorised commands and unexpected program downloads. Compromise of a controller is reportable to CERT-In within six hours.
SourceJoint advisory AA26-231A, NSA, CISA, FBI, Department of Energy and Environmental Protection Agency (18 August 2026); CNBC (19 August 2026); GBHackers (20 August 2026).
2HighCVSS 8.8
One link was enough to make Microsoft's consumer Copilot read a user's mail and files and send the contents out
Varonis Threat Labs published research on 18 August 2026, credited to Lior Adar, on a flaw it calls CoSnitch, tracked as CVE-2026-24301 and rated critical. Public reporting places it at CVSS 8.8. Three weaknesses chain. An undocumented autorun=1 parameter, used alongside the existing query parameter, caused an attacker-supplied prompt to run on page load with no confirmation. The assistant could then reach data through connectors the victim had already authorised and send it out using its own page-fetch capability, with base64 encoding used to get past content filtering. Instructions could also be written into the assistant's persistent memory through ordinary web-page summarisation, so the poisoning outlived the session that introduced it. Mail contents and metadata, calendar entries, Google Drive file metadata, chat history and stored memory were reachable. Varonis reported the issue in December 2025, Microsoft shipped a server-side fix on 18 August 2026, and Varonis found no evidence of exploitation before that. The research covers the consumer Copilot Personal product and does not state that enterprise Microsoft 365 Copilot behaved the same way.
Why it matters for IndiaThis is shadow AI rather than an enterprise exposure, which is what makes it hard to see. Consultants, founders, finance staff and engineers connect personal assistant accounts to the mailbox and cloud storage where their work actually sits, with no licence, no tenant policy and no log the organisation can read. Nothing in a Microsoft 365 audit trail records what a personal Copilot account was asked to do. For anyone handling customer records that is an exposure under the Digital Personal Data Protection Act, whichever product the data passed through. The memory step deserves separate attention, because persistence in a consumer assistant is not something awareness training has prepared users for.
ActionNo client patching is needed, but the exposure window ran from December 2025 to August 2026. Establish which staff have connected a personal AI assistant to an account holding work material, revoke the relevant authorisations, and have anyone who used the product before 18 August clear its stored memory rather than assume the fix removed injected entries. Put in writing that official documents and customer data are not processed through consumer assistant accounts, and fund a sanctioned alternative, because a prohibition without one is ignored. Add unsolicited AI-assistant links to phishing awareness material as their own category.
SourceVaronis Threat Labs (18 August 2026); The Hacker News (18 August 2026).
3
A coding agent ran attacker-supplied code the moment a developer opened a repository
GitLab's Threat Research Group disclosed on 17 August 2026 a server-side template injection in Serena, which GitLab describes as a popular MCP coding agent. The flaw is tracked as GHSA-pp25-4cg4-qcr9 and gives arbitrary code execution inside the Serena process. An attacker places a crafted .serena/project.yml file in a repository under their control, and the code runs as soon as a developer opens that repository through the Serena MCP server. The mechanism defeats trusted_project_path_patterns, the control Serena had added specifically to prevent execution from untrusted repositories, so teams that had configured it were not protected. Versions of serena-agent up to and including 1.6.1 are affected and 1.7.0 carries the fix. GitLab reported the issue confidentially on 1 August 2026 and the maintainers fixed it eight days later. Serena is used alongside Claude Code, Codex, Gemini CLI, Roo Code and Cursor.
Why it matters for IndiaOpening somebody else's repository is routine work in Indian services firms and GCC engineering teams. Candidate take-home submissions, client branches, vendor deliverables and forked libraries all arrive as repositories that someone clones and opens with an agent already attached. The agent runs at the developer's own privilege, which on a delivery machine usually means SSH keys, cloud credentials, environment files and VPN reach into a client network. Under a services agreement, that turns one workstation compromise into a customer notification obligation.
ActionUpgrade serena-agent to 1.7.0. Build an inventory of MCP servers on developer endpoints, since these are installed by individuals rather than issued by IT and most organisations have no list at all. Make it policy that untrusted repositories are cloned and reviewed before an agent is pointed at them. Treat agent configuration directories as executable content in code review, alongside build scripts. Alert on coding assistants spawning unexpected child processes or opening new local listeners.
SourceGitLab Threat Research Group (17 August 2026).
4
Rapid7 recovered a crypto fraud operator's working directory, and the development logs show coding assistants doing the engineering
Rapid7 Labs published an analysis on 17 August 2026 by Anna Širokova and Jan Recinsky of an operation it tracks as ASTERIX, found through an inadvertently exposed web directory holding the operator's datasets, tooling, malware and development logs. The target lists covered roughly 885,000 phone numbers across 54 countries, the largest being 316,002 German mobile numbers. Validation tooling queried cryptocurrency exchange interfaces to confirm which numbers belonged to account holders, at roughly a 13.6 per cent hit rate, producing about 43,066 confirmed holders from the German list alone. Those enriched leads fed branded phishing email carrying fabricated verification codes, then a voice call in which the operator cited the same details to impersonate exchange support, then counterfeit wallet applications that harvested recovery phrases. The AI involvement is development assistance rather than autonomy. The logs show GitHub Copilot and Claude Code used for back-end development, project scaffolding, data processing and infrastructure configuration, including the phone-validation pipeline and working around rate limiting. When one assistant declined to help obfuscate malware, the operator moved to a different provider and submitted a structured jailbreak prompt.
Why it matters for IndiaThe significant figure is 13.6 per cent, not 885,000. Bulk lists have always been cheap. What was expensive was the engineering to turn a list into confirmed account holders with enough context to make a convincing call. Indian exchanges, fintechs, wallet providers and bank support desks face the same construction, and the standard advice to customers, that they should verify who is calling, fails against a caller who can already quote a real-looking verification code and recent account details. The provider-hopping is the point for security teams: refusal by one model was a delay, not a control, and no risk register should record a vendor's safety behaviour as a defence.
ActionRate-limit and authenticate any interface that reveals whether an account exists for a given phone number or email, since enumeration is the first stage of this pipeline and the cheapest to disrupt. Alert on validation-shaped traffic, meaning high-volume lookups with little follow-on activity. State in every customer message that staff will never ask for a verification code or a recovery phrase, and publish one support number customers can check against. Monitor app stores and advertising networks for counterfeit applications carrying your brand, and register takedown contacts in advance rather than during an incident.
SourceRapid7 Labs (17 August 2026).
AI defender tip: Google's Threat Intelligence Group published a useful counterweight on 18 August 2026. Its Agentic Vulnerability Discovery Harness, an agent pipeline that has run inside Mandiant for ten months with human validation of every finding, produced more than a hundred confirmed critical vulnerabilities in two days during one incident response engagement against stolen corporate repositories, and twelve CVEs have been assigned from its output. Read that as a clock, not a product claim. If a copy of your source code left the building today, the window in which an attacker can find exploitable flaws in it is now measured in days, and the same class of tooling is available to you beforehand. So pick one system that matters and establish two things about it. How quickly could you find and fix flaws in your own code if an outsider held a copy of it. And which inputs does that system read without a human seeing them first: a repository from a client, a page an assistant summarises, a project file, a scan result from an unfamiliar controller. Each of those is a path where the effort an attacker used to need has already been removed, while the boundary you are relying on was built when it had not been.
Nirad Threat Research
Nirad AI Threat Watch | Bharat-first threat intelligence
