Live Cybersecurity Brief for August 8, 2026: Active Threats, CVEs, and Vendor Advisories

CVE-2026-8037: Progress LoadMaster Command Injection Vulnerability

CISA Cybersecurity Advisories | August 7, 2026 5:30 pm IST | Known Exploited

CISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation. CVE-2026-8037 Progress LoadMaster Command Injection Vulnerability This type of vulnerability is a frequent attack vector for malicious cyber actors and poses significant risks to the federal enterprise. Binding Operational Directive (BOD) 26-04: Prioritizing Security Updates Based on Risk establishes vulnerability management requirements for Federal Civilian Executive Branch (FCEB) agencies. BOD 26-04 reinforces the importance of the…

Why it matters: CISA Cybersecurity Advisories LoadMaster may let attacker-controlled input cross into an interpreter or executable path, which can turn a reachable application feature into data access or code execution.

What to verify: Confirm the vulnerable route and authentication state, deploy the fixed release, review suspicious parameters and child processes, and test authorization boundaries after patching.

Open the original source record

CVE-2026-63077: JetBrains TeamCity Deserialization of Untrusted Data Vulnerability

CISA Cybersecurity Advisories | August 5, 2026 5:30 pm IST | Known Exploited

CISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation. CVE-2026-63077 JetBrains TeamCity Deserialization of Untrusted Data Vulnerability This type of vulnerability is a frequent attack vector for malicious cyber actors and poses significant risks to the federal enterprise. Binding Operational Directive (BOD) 26-04: Prioritizing Security Updates Based on Risk establishes vulnerability management requirements for Federal Civilian Executive Branch (FCEB) agencies. BOD 26-04 reinforces the importance…

Why it matters: CISA Cybersecurity Advisories TeamCity belongs in an exploit-led queue only after the affected product is matched to a reachable asset and accountable owner.

What to verify: Start with asset ownership and exposure, compare the fixed release with the deployed build, and validate both security behavior and service health afterward.

Open the original source record

CVE-2026-18577: N-able N-central Authentication Bypass Using an Alternate Path or Channel Vulnerability

CISA Known Exploited Vulnerabilities | August 3, 2026 5:30 pm IST | Known Exploited | CVSS 8.2

CISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation. CVE-2026-18577 N-able N-central Authentication Bypass Using an Alternate Path or Channel Vulnerability This type of vulnerability is a frequent attack vector for malicious cyber actors and poses significant risks to the federal enterprise. Binding Operational Directive (BOD) 26-04: Prioritizing Security Updates Based on Risk establishes vulnerability management requirements for Federal Civilian Executive Branch (FCEB) agencies. BOD…

Why it matters: N-able N-central concerns a trust decision rather than a cosmetic defect. If the affected path is reachable, an attacker may cross a role, tenant, or login boundary.

What to verify: Reproduce the expected access checks safely, identify exposed roles and tenants, invalidate risky sessions or tokens, patch the decision point, and retest denied cases.

Open the original source record

CVE-2026-9198: IBM Langflow Code Injection Vulnerability

CISA Cybersecurity Advisories | August 4, 2026 5:30 pm IST | Known Exploited

CISA has added three new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation. CVE-2026-9198 IBM Langflow Code Injection Vulnerability CVE-2026-18556 N-able N-central Authentication Bypass Using an Alternate Path or Channel Vulnerability CVE-2026-34486 Apache Tomcat Missing Encryption of Sensitive Data Vulnerability These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risks to the federal enterprise. Binding Operational Directive (BOD) 26-04: Prioritizing Security Updates…

Why it matters: CISA Cybersecurity Advisories Langflow can combine untrusted text with connectors, stored credentials, and tool permissions. The meaningful risk is what the surrounding agent is allowed to read, change, or send.

What to verify: Test with hostile input in an isolated environment, inspect connector scopes and retained context, require approval for sensitive actions, and confirm that tool calls are logged and attributable.

Open the original source record

CVE-2026-71851: crypto-js: Insufficient Entropy in Cryptographic Secret Generation via Vulnerable CryptoJS Dependency Chain

GitHub Advisory Database | August 8, 2026 12:18 am IST | CRITICAL | CVSS 9.0

### Summary `CryptoJS.lib.WordArray.random()` in affected versions is not a cryptographically secure random number generator. Nominal requests for 128 or 256 bits of entropy produce effective search spaces of approximately 2^39 and 2^47 possibilities — small enough to enumerate on commodity hardware. Coinspect's [Ill Bloom](https://www.coinspect.com/blog/ill-bloom-investigation/) investigation confirmed that downstream wallet applications used this function as the entropy source for BIP39 recovery phrases. **An application is affected only if it uses the vulnerable function to generate security-sensitive…

Why it matters: GitHub Advisory Database crypto-js participates in the path from source code to production. A weakness can inherit runner permissions, build secrets, trusted artifacts, or deployment access.

What to verify: Trace untrusted input through pull requests and jobs, review token scope, isolate runners, pin trusted dependencies, and rebuild affected artifacts after remediation.

Open the original source record

CVE-2026-63223: CodeIgniter: Uploaded file extension validation bypass in `is_image` and `mime_in` rules

GitHub Advisory Database | August 7, 2026 11:54 pm IST | CRITICAL | CVSS 9.8

### Impact This is an unsafe file upload validation vulnerability that can lead to remote code execution in vulnerable application configurations. Applications are impacted when they: – validate uploads using `is_image` or `mime_in` without an independent safe extension check, such as `ext_in` on patched versions – save uploaded files using the client-supplied filename – place uploads in a web-accessible directory where PHP files can execute ### Patches Upgrade to v4.7.4 or later. ### Workarounds -…