Saturday, August 22, 2026 Archive

Archived Security Snapshot

Critical vulnerabilities, curated daily for security professionals

Archived Security Brief

Container and cloud infrastructure carried the weight of yesterday's disclosures, with LXC Incus, Microsoft Azure SQL Database, and AWS Athena Federated Query all receiving critical ratings. The set totals 22 critical CVEs, down 15% from the prior day's 26, alongside 86 high-priority items, a 54% increase over the prior day's 56. CVE-2026-61539 in xorbitsai inference and CVE-2026-69502 in Microsoft Azure SQL Database both score CVSS 10, while CVE-2026-62283 in nezhahq nezha and CVE-2026-63125 in LXC Incus sit at 9.9. Remote code execution and authentication bypass patterns dominate, spanning open-source AI and monitoring tooling, WordPress plugins such as Mailgun for WordPress, network hardware including the Comfast CF-N1-S, and managed cloud data services. Patch data is unavailable for the full set at publication (0% confirmed), so treat vendor advisories as the authoritative source and prioritize by exposure rather than by patch status; 9 entries carry confirmed active exploitation, including Microsoft SharePoint, VMware Cloud Foundation, Apple macOS, and Zimbra Collaboration.

  • LXC Incus accounts for two critical container escape class issues (CVE-2026-63125 and CVE-2026-63343, both CVSS 9.9), affecting hosts running multi-tenant workloads
  • 22 critical CVEs (CVSS 9.0+), down 15% from 26 the prior day
  • 86 high-priority CVEs (CVSS 7.0-8.9), up 54% from 56 the prior day
  • Remote code execution and authentication bypass dominate the critical set, including CVE-2026-61539 (xorbitsai inference, CVSS 10), CVE-2026-69502 (Microsoft Azure SQL Database, CVSS 10), and CVE-2026-77806 (SPIP)
  • Patch availability is recorded at 0% across the 108 disclosed CVEs, including managed cloud services (Azure SQL Database, AWS Athena Neptune Connector) where remediation may be provider-side
  • 9 CVEs have confirmed active exploitation, covering Microsoft Windows and SharePoint, VMware Cloud Foundation and vCenter, Apple macOS, Zimbra Collaboration, TrueConf Server, Ray, and mlflow

Immediate action: Prioritize the actively exploited set first: Microsoft Windows and SharePoint, VMware Cloud Foundation and vCenter, Apple macOS, Zimbra Collaboration, and TrueConf Server, followed by internet-facing LXC Incus hosts, SPIP installations, and WordPress sites running the Mailgun plugin. Confirmed patch data is not yet available for this batch, so check vendor advisories directly for fixed versions and apply interim mitigations (network restriction, disabling exposed services) where no fix has shipped. For Azure SQL Database and AWS Athena Federated Query, verify whether the provider has already remediated server-side and what customer-side connector updates remain.

How to read this brief

CVSS score (e.g. 9.1) — severity from 0–10. Red marks critical (9+), orange high (7–8.9).

Exploitability — how hard the flaw is to attack, read from the CVSS vector:

  • Network / Adjacent / Local / Physical — how close an attacker must get. Network means reachable over the internet.
  • No / Low / High privileges — the access they need first. No privileges means no login required.
  • No interaction / User interaction — whether a victim has to do something (open a file, click a link). No interaction means fully automatable.

The lower the bar on all three, the easier to exploit at scale — “Network · No privileges · No interaction” is the worst case: hit from anywhere, no credentials, no victim action.

Actively exploited — confirmed under attack in the wild (CISA’s Known Exploited Vulnerabilities catalog). Prioritize these regardless of score.

EPSS · Nth percentile — FIRST.org’s estimated chance a flaw is exploited within 30 days. We flag it only in the top 10% — a statistical signal it’s unusually likely to be targeted, separate from whether attacks are confirmed.

💡 Tip: Swipe CVE cards left to ⭐ star, right to ❌ remove

Section Navigation