What to patch now — 24 August 2026
Source: CISA Known Exploited Vulnerabilities (KEV) catalog — the most recently added entries as of today. Every vulnerability below has been confirmed by CISA as actively exploited in the wild, meaning attackers are already using it, not just researching it. If you (or a supplier) run any of this software, treat it as urgent.
1. Zimbra Collaboration Suite — no login needed to take over your mail server (CVE-2026-73570)
🛠️ Synacor Zimbra Collaboration Suite (ZCS) · added 21 Aug 2026 · CISA fix-by date 24 Aug 2026 (due today)
What it is: "OS command injection" means a flaw lets an attacker sneak operating-system commands into a request the software processes, and the server runs them as if they were legitimate. Here, an attacker with no login at all can send a crafted email-server request to Zimbra and have it execute arbitrary commands as the Zimbra system user — effectively full control of the mail server.
Who's affected: Businesses that self-host Zimbra as their email and webmail platform rather than using a hosted provider — common among smaller companies, schools and nonprofits running their own mail server to save cost.
What to do: Apply Zimbra's fix today — CISA's deadline is today. If a developer or IT provider manages your mail server, ask specifically whether it's Zimbra and whether it's patched; a compromised mail server can read, send and intercept all of a company's email.
2–3. TrueConf Server — two flaws that skip the login on a video-conferencing server (CVE-2026-72530, CVE-2026-72529)
🛠️ TrueConf Server · added 20 Aug 2026 · CISA fix-by dates 3 Sep / 23 Aug 2026 (one now 1 day overdue)
What it is: Two related flaws in TrueConf, a self-hosted video-conferencing platform. One is "missing authentication for a critical function" — a control channel that should require a login doesn't, letting an outsider run scripts on it with no credentials at all. The other is "code injection" reachable through that same channel, letting an attacker break out of the software's normal boundaries and run their own code on the server.
Who's affected: Businesses running their own TrueConf video-conferencing server, usually for privacy or compliance reasons rather than a mainstream hosted service such as Zoom or Teams — typically an IT-literate company or one in a regulated sector.
What to do: Apply both TrueConf fixes — patching only one still leaves the other door open. If your business runs its own video-conferencing infrastructure, confirm with whoever manages it that both fixes are installed and that the server isn't unnecessarily exposed to the open internet.
4. MLflow — an AI tool that can be tricked into leaking your cloud credentials (CVE-2026-64849)
🛠️ MLflow · added 19 Aug 2026 · CISA fix-by date 2 Sep 2026
What it is: "Server-side request forgery" (SSRF) means an attacker tricks a server into making requests on their behalf — including to internal systems it was never meant to expose, like the "metadata service" cloud providers (AWS, Azure, GCP) run on every virtual machine to hand out temporary credentials. MLflow is an open-source tool used to track and manage machine-learning experiments; this flaw lets an attacker use it as a stepping stone to reach that internal service and read back what it returns.
Who's affected: Businesses or teams running their own MLflow server for in-house AI projects — increasingly common as small businesses build custom AI tooling rather than only buying finished AI products.
What to do: Update MLflow to the fixed version. If your business or a contractor runs it, especially in the cloud, check it isn't reachable from the public internet — this class of flaw is particularly damaging there, because the "internal" data it can reach often includes credentials for everything else in that cloud account.
5. Windows VPN component — a remote hole with no login required (CVE-2026-33824)
🛠️ Microsoft Windows (Internet Key Exchange / IKE Service Extensions) · added 18 Aug 2026 · CISA fix-by date 21 Aug 2026 (3 days overdue)
What it is: A "double free" bug is when software releases the same piece of memory twice, corrupting its own bookkeeping in a way an attacker can exploit to run their own code. This one sits in the Windows service that negotiates encrypted VPN and IPsec connections, and it's remotely exploitable — meaning no prior foothold on the machine is needed at all.
Who's affected: Any business running Windows Server (or Windows machines) that terminate VPN or IPsec connections — common wherever a company runs its own site-to-site or remote-access VPN rather than a dedicated third-party VPN appliance.
What to do: Install this month's Windows updates — the CISA deadline has passed. If an IT provider manages your VPN infrastructure, ask whether it runs on Windows and whether this update is applied; a VPN endpoint is, by definition, reachable from the internet.
6. VMware vCenter — one flaw away from control of every virtual server it manages (CVE-2026-59310)
🛠️ Broadcom VMware vCenter · added 18 Aug 2026 · CISA fix-by date 21 Aug 2026 (3 days overdue)
What it is: "Path traversal" means a flaw lets an attacker step outside the folder or function a piece of software is supposed to confine them to. In vCenter — the console that manages a fleet of VMware virtual servers — this lets someone who already has network access to it run their own code, effectively taking over the console that controls everything it manages.
Who's affected: Businesses, or their IT provider, running VMware vCenter to manage virtual servers — more common in mid-sized companies and hosting/MSP environments than a typical small office.
What to do: Apply Broadcom's fix — the deadline has passed. If your infrastructure runs on VMware, ask your IT provider whether vCenter is patched, and whether its management interface is reachable from anywhere other than a restricted internal network; it should never be exposed to the open internet.
7. SharePoint — a login check that can be sidestepped (CVE-2026-55040)
🛠️ Microsoft SharePoint (on-premises) · added 18 Aug 2026 · CISA fix-by date 21 Aug 2026 (3 days overdue)
What it is: "Weak authentication" here means a flaw in how SharePoint checks who's allowed in lets an attacker bypass a security control over the network — getting past a lock that should have stopped them.
Who's affected: Businesses running their own on-premises SharePoint server for internal document sharing and collaboration — not Microsoft's cloud-hosted SharePoint Online, which Microsoft patches centrally. Common in companies that kept SharePoint in-house for compliance or legacy reasons.
What to do: Apply Microsoft's fix — the deadline has passed. If you're on SharePoint Online, this is very likely already handled by Microsoft; if you or an IT provider run SharePoint on your own servers, confirm the patch is installed.
8. macOS Screen Sharing — remote access without a valid password (CVE-2026-65400)
🛠️ Apple macOS · added 18 Aug 2026 · CISA fix-by date 21 Aug 2026 (3 days overdue)
What it is: "Improper authentication" here means a specific built-in feature — macOS's Screen Sharing (remote-desktop) tool — can be tricked into letting a network attacker connect without a valid password at all.
Who's affected: Any business using Mac computers with Screen Sharing turned on — a common way small teams remotely support each other's machines, or let an IT contractor troubleshoot a Mac.
What to do: Install Apple's macOS security update. If you don't actively use Screen Sharing, turn it off in System Settings → General → Sharing — it's a strikingly common feature to leave enabled by default and forget about.
9. Ray — full takeover of an AI/data-processing cluster (CVE-2025-62593)
🛠️ Ray-Project Ray · added 17 Aug 2026 · CISA fix-by date 20 Aug 2026 (4 days overdue)
What it is: "Code injection" means an attacker can insert their own instructions into data the software processes and have those instructions run as if they were part of the program. Ray is an open-source framework developers use to scale AI and data-processing jobs across multiple machines; this flaw lets an attacker achieve full remote code execution on a Ray deployment.
Who's affected: Businesses or development teams running their own Ray cluster for in-house AI or data workloads — part of the same growing trend as MLflow above: small businesses standing up their own AI infrastructure rather than only consuming AI as a finished service.
What to do: Update Ray to the fixed version — the deadline has passed. If a developer or data-science contractor set up AI infrastructure for you, ask specifically whether Ray is part of it and whether it's reachable from the internet; like MLflow, this kind of tool is often left open during a proof-of-concept and never locked down afterwards.
This is an awareness summary of public CISA KEV data, not professional security advice. CISA "fix-by" dates are US federal deadlines; for everyone else they're a strong urgency signal, not a legal obligation. Always confirm the affected versions and the fix against the vendor's own advisory.