ThreatScope

Monthly Cybersecurity Report 

August 2026

Reporting Period: August 1 – August 31, 2026
Threat Level: Critical

🎧 Listen to July’s ThreatScope (audio brief)

Executive Summary

August marked a clear concentration of cyber activity around platforms that control access, administration, software distribution and downstream systems. Rather than focusing primarily on individual endpoints, attackers repeatedly targeted technologies capable of extending compromise across multiple users, systems and business services.

CISA added 31 vulnerabilities with confirmed active exploitation to its Known Exploited Vulnerabilities (KEV) Catalog during the month. Among the most significant developments were attacks affecting N-able N-central, PaperCut NG/MF, NetScaler ADC/Gateway, Metabase, TrueConf, Zimbra, Oracle HTTP/WebLogic Proxy and several development and software-distribution platforms.

One of the strongest patterns was the targeting of centralised management and security infrastructure. N-central was abused to gain remote administrative access to managed endpoints, while NetScaler and FortiWeb vulnerabilities affected technologies positioned directly at network and application-security boundaries.

August also brought increased pressure on the software development and supply chain. TeamCity, Gitea, JFrog Artifactory, Ray and other platforms exposed paths toward source code, build infrastructure, trusted packages and downstream deployments.

Identity, collaboration and data platforms remained important targets. Active exploitation affected Metabase, Zimbra and ownCloud, while a critical Keycloak vulnerability highlighted the potential impact of weaknesses in password-recovery and identity workflows.

Operational technology also remained under pressure. Government agencies warned of active targeting of Siemens S7 programmable logic controllers (PLCs), while additional advisories affected industrial gateways, fleet-management systems and other operational devices.

The broader lesson from August is that vulnerability priority increasingly depends on what a system controls and how far compromise can travel from it.

For internet-facing systems with confirmed exploitation, patching remains essential — but it should be followed by compromise assessment, credential review and validation of connected systems.

This Month at a Glance

Key Threat Trends

Centralised Management Became a High-Value Target

One of August’s clearest trends was the targeting of platforms capable of managing other systems.

The compromise of N-able N-central demonstrated the potential impact particularly clearly. Attackers bypassed authentication, gained remote administrative access and used legitimate remote-control functionality against managed endpoints. Observed persistence included Cloudflare tunnels, unauthorized accounts and suspicious remote-control sessions.

PaperCut NG/MF showed a similar concentration of risk. Two vulnerabilities were combined into a pre-authentication remote-code-execution chain, with observed activity including reconnaissance, remote-access software and attempts to establish persistent privileged access.

These incidents demonstrate why centralised platforms require higher remediation priority than their technical function alone may suggest. A compromised management server can become a trusted route toward many downstream systems.

Security and Remote-Access Infrastructure Remained Under Pressure

Security technologies themselves were among the month’s actively exploited targets.

NetScaler ADC/Gateway, Fortinet FortiWeb and Cisco ASA/FTD all experienced confirmed exploitation.

These systems occupy particularly sensitive positions because they control VPN access, application traffic, security policies and connectivity between external and internal environments.

Compromise assessment for security appliances should therefore extend beyond the appliance itself. Administrative accounts, stored credentials, certificates, VPN sessions, configuration changes and connected systems may all require review.

Identity, Collaboration and Data Platforms Remained Attractive Targets

August also highlighted continued targeting of platforms that hold identities, communications and organisational data.

Metabase CVE-2026-72898 allowed unauthenticated SQL injection with potential consequences including administrator takeover, creation of sessions or API keys, theft of connected-database credentials and access to business data.

Zimbra Collaboration was affected by an actively exploited vulnerability capable of triggering operating-system commands through crafted SMTP requests under affected configurations.

ownCloud faced active exploitation that could allow unauthenticated access, modification or deletion of files.

Meanwhile, a critical Keycloak vulnerability demonstrated the potential impact of weaknesses in password-recovery processes, even though active exploitation had not been confirmed at the reporting cut-off.

Together, these issues reinforce the need to treat identity, collaboration and data platforms as high-trust infrastructure rather than ordinary applications.

Software Development Infrastructure Became Part of the Attack Surface

August brought significant activity across software development and delivery environments.

Actively exploited vulnerabilities affected JetBrains TeamCity, Gitea, JFrog Artifactory and Ray, while Jenkins addressed a broader cluster of security weaknesses.

The risk extends beyond compromise of the development server itself.

A successful attack against source-code repositories, build systems or artifact stores may allow malicious changes to propagate into software packages, container images and production deployments.

The Artifactory vulnerability was particularly illustrative. Its CVSS score of 5.3 appears moderate, yet confirmed exploitation and Artifactory’s role in distributing trusted software artifacts substantially increase its operational importance.

This reinforces a broader principle: technical severity and operational risk are not always the same thing.

Operating Systems Remained an Important Escalation Layer

Microsoft’s August security release addressed approximately 415 vulnerabilities, including one actively exploited zero-day and 62 Critical vulnerabilities.

The actively exploited Windows AFD CVE-2026-68820 could enable local privilege escalation to SYSTEM, while additional critical vulnerabilities affected Windows DNS Server, Deployment Services, QUIC, iSCSI Target and DHCP Server.

Linux infrastructure also required attention. CVE-2026-53362, affecting the IPv6 networking subsystem, can provide privilege escalation and potentially container escape under affected configurations.

These issues are particularly relevant to shared servers, container hosts, development infrastructure and other environments where an attacker may already possess limited access and seek higher privileges.

Automation Is Increasing the Scale of Exploitation

August also provided further evidence that automation is changing the economics of vulnerability exploitation.

Observed campaign activity against Windows and Linux servers involved large-scale target lists, public exploits, automated reconnaissance and agentic AI used to assist exploit refinement and post-compromise operations.

One observed target list contained approximately 170,000 URLs.

The implication is not that every attack is becoming fully autonomous. Rather, automation allows known vulnerabilities and exposed services to be identified and tested at much greater scale.

This makes reducing unnecessary internet exposure increasingly important, even for vulnerabilities that are not new.

Operational Technology Faced Active Targeting

Operational Technology (OT) and Industrial Control Systems (ICS) remained an important part of the August threat landscape.

CISA, NSA, FBI, DOE and EPA warned of active targeting of Siemens S7-series programmable logic controllers, including S7-200, S7-300, S7-400, S7-1200 and S7-1500 systems.

Threat actors were observed using internet scanning and AI-generated scripts to interact with exposed industrial protocols.

Additional August advisories affected ABB, AVEVA, Johnson Controls, Rockwell Automation, Ebyte, Fuel-Boss and other industrial technologies.

For operational environments, the priority remains a combination of controlled patching, network segmentation, restricted engineering access, monitoring and tested recovery.

Ransomware Continued to Exploit Security Infrastructure

August also brought a joint government advisory regarding Gunra ransomware.

Observed initial access included exploitation of internet-facing Fortinet appliances. Affiliates combined encryption with data theft, creating both operational disruption and extortion pressure.

The campaign reinforces a recurring pattern: exposed VPN, firewall and remote-access infrastructure remains an attractive initial-access route.

Organisations should therefore review vulnerable appliances not only for patch status, but also for historical compromise, suspicious VPN sessions, administrative changes and evidence of data exfiltration.

Key Vulnerabilities

Industry Exposure

August’s threat activity affected a broad range of organisations, but several sectors face elevated exposure because of their reliance on centralised management, remote access, development infrastructure and operational technology.

The highest-risk environments are those where a compromised platform can provide access to multiple customers, identities, endpoints, applications or software components.

For these systems, downstream reach should be considered directly when determining remediation priority.

Operational Priorities

Immediate Actions (0–7 Days)

Organisations should first identify systems affected by confirmed active exploitation and determine whether they were internet-accessible during the vulnerable period.

Recommended actions include:

• Apply emergency updates to exposed KEV systems.
• Prioritise N-central, PaperCut, NetScaler, FortiWeb, Metabase, TrueConf, Zimbra and Oracle proxy infrastructure.
• Remove unnecessary administrative interfaces from public access.
• Preserve relevant logs and evidence before rebuilding potentially compromised systems.
• Search for unauthorized accounts, web shells, remote-access tools, tunnels and suspicious administrative activity.
• Rotate credentials stored or processed by systems where compromise cannot be excluded.
• Review connected endpoints and systems where a management platform was potentially compromised.
• Validate backup integrity before major recovery actions.

Actions Within 30 Days

Once immediate exposure has been addressed, organisations should:

• patch affected Windows, Linux and macOS infrastructure;
• update TeamCity, Gitea, Artifactory, Ray and Jenkins environments;
• validate software artifacts and container images generated during potential exposure periods;
• review privileged sessions, service accounts, API tokens and application secrets;
• assess external exposure of management and remote-access services;
• verify security monitoring coverage across high-value infrastructure;
• review OT exposure and industrial programming pathways;
• complete documented compromise assessments for internet-facing KEV assets.

Strategic Priorities (Within 90 Days)

Long-term improvements should focus on reducing the impact of compromise, not only reducing vulnerability counts.

Organisations should:

• integrate CISA KEV status into vulnerability prioritisation;
• combine active exploitation, internet exposure, privilege and downstream reach when assigning remediation priority;
• require strong multi-factor authentication and privileged access controls for management platforms;
• segment CI/CD systems, artifact repositories and administrative infrastructure;
• maintain an authoritative inventory of externally accessible assets;
• implement software-artifact signing and provenance verification;
• improve logging and endpoint monitoring on critical management systems;
• regularly test compromise scenarios involving centralised management platforms;
• strengthen segmentation and controlled administrative access within OT environments.

Executive Questions

Executive leadership and security teams should consider:

• Which of our systems were affected by confirmed active exploitation during August?
• Which management, VPN, security and collaboration platforms remain accessible from the internet?
• Have all 31 August KEV additions been compared against our asset inventory?
• Did any affected platform have privileged access to other systems?
• Have compromise assessments been completed after emergency patching?
• Have credentials and certificates been rotated where exposure cannot be excluded?
• Could compromised development infrastructure have affected trusted software artifacts?
• Are MSP or remote-management platforms sufficiently isolated and monitored?
• Are industrial controllers or management interfaces accessible outside dedicated OT networks?
• Can critical platforms be restored from known-clean backups?
• Are unresolved remediation exceptions documented and owned?

These questions move vulnerability management from a list of technical findings toward an assessment of actual organisational exposure and downstream business risk.

What This Means for Organizations

August highlights an important shift in how vulnerability risk should be evaluated.

First, the system’s role matters. A vulnerability in a platform capable of managing hundreds of endpoints, controlling remote access or distributing trusted software may represent significantly greater organisational risk than a technically more severe vulnerability on an isolated system.

Second, successful patching does not automatically restore trust. When an internet-facing system was vulnerable during a period of confirmed exploitation, organisations need to determine whether access occurred before remediation.

Third, downstream validation is becoming increasingly important. Compromise of N-central may affect managed endpoints. Compromise of Artifactory or TeamCity may affect software builds. Compromise of identity or remote-access infrastructure may expose credentials and connected applications.

Finally, automation is reducing the time organisations have to respond. Large-scale scanning, publicly available exploitation techniques and AI-assisted attacker workflows allow known weaknesses to be tested across extensive target sets.

The practical response is therefore not simply faster patching. It is better prioritisation based on exposure, exploitation, privilege and downstream reach.

Monthly Risk Outlook

Based on August’s activity, several risks are likely to remain relevant during the coming weeks:

• continued targeting of centralised management and remote-access platforms;
• active exploitation of internet-facing security appliances;
• increased attention to development and software-supply-chain infrastructure;
• continued targeting of identity, email and collaboration platforms;
• exploitation of older vulnerabilities where legacy systems remain exposed;
• growing use of automation to identify and exploit vulnerable services at scale;
• persistent targeting of operational technology and industrial control environments;
• ransomware use of vulnerable security appliances for initial access.

Organisations should expect attackers to continue favouring systems that provide high privilege and broad downstream access, particularly where those systems remain directly reachable from the internet.

Conclusion

August 2026 reinforced a significant trend: attackers are increasingly targeting platforms that control other systems.

A compromised endpoint may affect one user. A compromised N-central server may provide access to many managed endpoints. A compromised NetScaler or FortiWeb appliance may affect trusted access into internal services. A compromised TeamCity, Gitea or Artifactory environment may influence software delivered far beyond the original server.

This changes how remediation priority should be calculated.

The number attached to a vulnerability is only one part of the decision. Active exploitation, external exposure, privilege and downstream reach determine the real operational risk.

August also demonstrated why patching should not automatically be treated as closure. If a vulnerable internet-facing system was exposed during a period of confirmed exploitation, organisations should establish whether attackers gained access before the update was installed.

The appropriate response sequence is therefore:

Contain → Patch → Investigate → Rotate credentials → Validate downstream trust → Document closure

The objective is not simply to remove a vulnerability.

It is to establish that the organisation can safely trust the affected system — and the systems that depend on it — again.

ISO 27001 Alignment

The priorities identified during August support several areas of an Information Security Management System (ISMS) aligned with ISO/IEC 27001, including:

• Asset Management
• Vulnerability and Exposure Management
• Identity and Access Management
• Privileged Access Control
• Secure Configuration
• Network Security and Segmentation
• Logging and Monitoring
• Incident Detection and Response
• Supplier and Software Supply Chain Security
• Backup and Recovery
• Operational Technology Security
• Business Continuity
• Risk Assessment and Risk Treatment

Organisations should maintain evidence not only that security updates were deployed, but also that remediation was validated and compromise assessments were completed where appropriate.

ISO 9001 Alignment

The recommendations also support quality-management principles defined by ISO 9001, including:

• risk-based decision-making;
• controlled change management;
• documented corrective actions;
• validation of remediation results;
• evidence-based decision-making;
• management review;
• continual improvement.

Integrating vulnerability and incident-response activities into established operational processes improves consistency, accountability and resilience.

Need Help Assessing Your Exposure?

Identifying an affected vulnerability is only the first step.

Organisations should also establish:

• whether the affected technology is present;
• whether the vulnerable system was externally accessible;
• whether exploitation may have occurred before remediation;
• whether privileged credentials or administrative access were exposed;
• whether connected systems or software artifacts require validation;
• whether recovery from a known-clean state is possible.

DIAMATIX helps organisations move from vulnerability identification toward continuous visibility, validation and operational resilience through:

• Security Operations Center as a Service (SOCaaS)
• Managed Detection and Response as a Service (MDRaaS)
• Incident Response
• Vulnerability Management
• Digital Forensics
• Virtual Chief Information Security Officer (vCISO)

Contact DIAMATIX

Sources

This review is based on publicly available information published throughout August 2026, including:

• CISA Known Exploited Vulnerabilities (KEV) Catalog
• Vendor security advisories from N-able, PaperCut, NetScaler, Fortinet, Microsoft, ownCloud, JFrog and other affected vendors
• Microsoft Security Response Center
• Cisco Talos
• CISA Industrial Control Systems advisories
• Joint government cybersecurity advisories
• Publicly available technical research published during the reporting period

Methodology

ThreatScope by DIAMATIX provides a monthly operational review of vulnerabilities, threat activity and security developments with the greatest potential impact on enterprise environments.

It is not intended to reproduce every vulnerability disclosed during the month. Instead, ThreatScope prioritises issues according to factors including:

• confirmed active exploitation;
• inclusion in the CISA Known Exploited Vulnerabilities (KEV) Catalog;
• internet exposure;
• operational importance of the affected technology;
• privilege available after exploitation;
• potential downstream reach;
• persistence opportunities;
• business and operational impact.

For August, these factors can be summarised through a simple prioritisation principle:

Exposure × Exploitation × Privilege × Downstream Reach = Remediation Priority

The objective is to help security teams and leadership prioritise remediation according to real operational risk rather than technical severity alone.

Trusted · Innovative · Vigilant