Live Cybersecurity Brief for August 7, 2026: Active Threats, CVEs, and Vendor Advisories

CVE-2026-63077: JetBrains TeamCity Deserialization of Untrusted Data Vulnerability

CISA Cybersecurity Advisories | August 5, 2026 5:30 pm IST | Known Exploited

CISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation. CVE-2026-63077 JetBrains TeamCity Deserialization of Untrusted Data Vulnerability This type of vulnerability is a frequent attack vector for malicious cyber actors and poses significant risks to the federal enterprise. Binding Operational Directive (BOD) 26-04: Prioritizing Security Updates Based on Risk establishes vulnerability management requirements for Federal Civilian Executive Branch (FCEB) agencies. BOD 26-04 reinforces the importance…

Why it matters: CISA Cybersecurity Advisories TeamCity belongs in an exploit-led queue only after the affected product is matched to a reachable asset and accountable owner.

What to verify: Confirm the affected version and reachable component, preserve useful telemetry, apply the publisher guidance, and record the evidence used to close the item.

Open the original source record

CVE-2026-18577: N-able N-central Authentication Bypass Using an Alternate Path or Channel Vulnerability

CISA Known Exploited Vulnerabilities | August 3, 2026 5:30 pm IST | Known Exploited | CVSS 8.2

CISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation. CVE-2026-18577 N-able N-central Authentication Bypass Using an Alternate Path or Channel Vulnerability This type of vulnerability is a frequent attack vector for malicious cyber actors and poses significant risks to the federal enterprise. Binding Operational Directive (BOD) 26-04: Prioritizing Security Updates Based on Risk establishes vulnerability management requirements for Federal Civilian Executive Branch (FCEB) agencies. BOD…

Why it matters: N-able N-central concerns a trust decision rather than a cosmetic defect. If the affected path is reachable, an attacker may cross a role, tenant, or login boundary.

What to verify: Reproduce the expected access checks safely, identify exposed roles and tenants, invalidate risky sessions or tokens, patch the decision point, and retest denied cases.

Open the original source record

CVE-2026-9198: IBM Langflow Code Injection Vulnerability

CISA Cybersecurity Advisories | August 4, 2026 5:30 pm IST | Known Exploited

CISA has added three new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation. CVE-2026-9198 IBM Langflow Code Injection Vulnerability CVE-2026-18556 N-able N-central Authentication Bypass Using an Alternate Path or Channel Vulnerability CVE-2026-34486 Apache Tomcat Missing Encryption of Sensitive Data Vulnerability These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risks to the federal enterprise. Binding Operational Directive (BOD) 26-04: Prioritizing Security Updates…

Why it matters: CISA Cybersecurity Advisories Langflow can combine untrusted text with connectors, stored credentials, and tool permissions. The meaningful risk is what the surrounding agent is allowed to read, change, or send.

What to verify: Test with hostile input in an isolated environment, inspect connector scopes and retained context, require approval for sensitive actions, and confirm that tool calls are logged and attributable.

Open the original source record

CVE-2026-18556: N-able N-central Authentication Bypass Using an Alternate Path or Channel Vulnerability

CISA Known Exploited Vulnerabilities | August 4, 2026 5:30 am IST | Known Exploited | CVSS 8.2

Authentication bypass using an alternate path or channel vulnerability in N-able N-central allows Authentication Bypass. This issue affects N-central: through 2026.1.

Why it matters: N-able N-central concerns a trust decision rather than a cosmetic defect. If the affected path is reachable, an attacker may cross a role, tenant, or login boundary.

What to verify: Reproduce the expected access checks safely, identify exposed roles and tenants, invalidate risky sessions or tokens, patch the decision point, and retest denied cases.

Open the original source record

CVE-2026-34486: Apache Tomcat Missing Encryption of Sensitive Data Vulnerability

CISA Known Exploited Vulnerabilities | August 4, 2026 5:30 am IST | Known Exploited

Apache Tomcat contains a missing encryption of sensitive data vulnerability that allows the bypass of the EncryptInterceptor. This vulnerability can be chained with CVE‑2025‑24813.

Why it matters: Apache Tomcat belongs in an exploit-led queue only after the affected product is matched to a reachable asset and accountable owner.

What to verify: Start with asset ownership and exposure, compare the fixed release with the deployed build, and validate both security behavior and service health afterward.

Open the original source record

CVE-2026-65600: Traefik: Authentication Bypass via Path Traversal in ReplacePathRegex Middleware

GitHub Advisory Database | August 6, 2026 10:21 pm IST | CRITICAL | CVSS 9.1

## Summary There is a critical authentication-bypass vulnerability in Traefik's `ReplacePathRegex` middleware. When it is configured with a regular expression that captures user-controlled path segments without a mandatory separator (for example `regex: "^/api(.*)"`, `replacement: "/$1"`), a crafted request can produce an un-normalized replacement path such as `/../admin`, which Traefik forwarded to the backend without validation. A backend that normalizes the path may resolve it to a protected route, letting an unauthenticated attacker reach resources located…

Why it matters: GitHub Advisory Database github.com/traefik/traefik/v2, github.com/traefik/traefik/v3, github.com/traefik/traefik participates in the path from source code to production. A weakness can inherit runner permissions, build secrets, trusted artifacts, or deployment access.