Skip to dossier
←fruition.net
just verified
The Perimeter · Issue 08-28-2026

KEV surge, Elementor Pro RCE, and a fresh Twig-sandbox escape

CISA added eight KEV entries in the past two weeks — Zimbra, TrueConf, MLflow, VMware vCenter, SharePoint, macOS Screen Sharing, Windows AFD, and Metabase — a sustained cadence that says defenders should treat KEV as a weekly patch driver, not a quarterly one. On the CMS side, Elementor Pro (6M installs) shipped an unauthenticated arbitrary file upload fix, and Pods (100k installs) an unauth privilege escalation; both are the kind of bugs that turn into mass-defacement campaigns within days. Supply-chain signal is heavy: JSONata RCE across three CVEs, GeoTools unauth SQLi in the PostGIS JSON filter, and a Twig-sandbox escape in Winter CMS that bypasses the CVE-2024-54149 patch. Next.js pre-announced an August 26 security release — plan for a Wednesday patch window. Recalculate: which of your production surfaces (WordPress plugins, Kubernetes-hosted Java/Go services, vCenter, SharePoint) can actually accept an unscheduled patch this week, and which are still gated on a manual change window you no longer have time for.
Published
Friday, August 28, 2026
Entries
12
Cadence
Weekly · Sundays
Curator
Brad Anderson
Wire
cisa.govNew addition to the Known Exploited Vulnerabilities catalog·
github.comGHSA: critical npm package compromise affecting CI pipelines·
wordfence.comWordPress plugin vulnerability with active exploitation·
drupal.orgHighly critical core security advisory published·
aws.amazon.comAWS security bulletin: IAM policy evaluation update·
unit42.paloaltonetworks.comThreat actor expands toolkit targeting public-facing PHP apps·
krebsonsecurity.comBreach disclosure with named victim and confirmed initial vector·
snyk.ioComposer dependency advisory affecting production framework versions·
cisa.govNew addition to the Known Exploited Vulnerabilities catalog·
github.comGHSA: critical npm package compromise affecting CI pipelines·
wordfence.comWordPress plugin vulnerability with active exploitation·
drupal.orgHighly critical core security advisory published·
aws.amazon.comAWS security bulletin: IAM policy evaluation update·
unit42.paloaltonetworks.comThreat actor expands toolkit targeting public-facing PHP apps·
krebsonsecurity.comBreach disclosure with named victim and confirmed initial vector·
snyk.ioComposer dependency advisory affecting production framework versions·
01

Web Application

frameworks · browsers · authentication flows

nextjs.org2d

Next.js scheduled security release lands August 26

Vercel pre-announced a scheduled Next.js security release for August 26, 2026. No CVE details published yet; the pre-announcement pattern historically indicates at least one impactful vulnerability with coordinated disclosure and patched versions across current release lines.

Next.js
Fruition take

Book a Wednesday-afternoon deploy window for every Next.js production surface now. Pin your ISR/edge-runtime images so you can rebuild once the fixed versions publish rather than hunting versions live.

02

Supply Chain

packages · build systems · dependency attacks

github.com1d

JSONata: three RCE CVEs via crafted expressions

Three GHSAs (CVE-2026-77413/77414/77415) cover arbitrary code execution in JSONata via prototype-pollution paths, hasOwnProperty bypass in `environment.lookup`, and `$clone` overwrite chains. Fixed in JSONata 2.2.1 and 1.8.8. Any Node service that evaluates JSONata expressions from user input is trivially RCE-able.

CVE-2026-77413CVE-2026-77414CVE-2026-77415jsonata (npm)
Fruition take

Grep your package-lock files for `jsonata` — it's a common transitive dep in IBM App Connect, Node-RED and low-code tooling. If any surface accepts JSONata expressions from users (even authenticated), pin to 2.2.1 / 1.8.8 this week.

github.com1dCVSS 9.8

GeoTools: unauthenticated SQL injection in PostGIS jsonArrayContains filter

CVE-2026-76904 (CVSS 9.8): GeoTools' `jsonArrayContains` OGC filter function inlines the JSON path argument into generated SQL without escaping when running against PostGIS 12+. Any GeoServer/GeoNetwork deployment exposing OGC filters is unauth-exploitable to arbitrary SQL. Fixed in GeoTools 33.5, 34.4, and 35.1.

CVE-2026-76904GeoToolsGeoServerPostGIS
Fruition take

Airport and government GIS stacks routinely front GeoServer with public OGC endpoints. If that's you, patch GeoTools, and — because there's no runtime mitigation — verify the PostGIS role your connection pool uses is not a superuser.

github.com1dCVSS 5.5

Unleash: SSRF via addon webhooks to cloud metadata endpoints

CVE-2026-63004: Unleash's addon/webhook subsystem (Slack, Teams, Datadog, New Relic, generic webhook) passes the configured URL straight to the HTTP client with no loopback/link-local/RFC1918 filtering. An operator can point the server at `http://169.254.169.254/…` to read cloud IMDS or exfiltrate configured request headers to internal services. A second advisory (CVE-2026-63462) crashes the server via deeply nested JSON to `/edge/validate`.

CVE-2026-63004CVE-2026-63462Unleash
Fruition take

Feature-flag services usually run with a fat service account and network access to your prod segments — perfect SSRF pivot. Patch Unleash, and confirm your IMDSv2 hop-limit is set so token theft from the pod is not one curl away.

sonatype.com1d

Broadcom drops 91 Spring CVEs in a single batch

Broadcom published 91 CVEs across Spring Framework and related projects on Aug 20. Sonatype estimates 209,569 components downstream. Broadcom previously reported a >1,700% month-over-month rise in Spring advisories driven by AI-assisted discovery — signaling a sustained volume shift, not a one-off.

Spring FrameworkSpring Boot
Fruition take

Don't chase every CVE. Rank them against services actually deserializing untrusted input or exposing Spring Web MVC endpoints externally, and let the rest ride your normal quarterly bump.

03

Infrastructure

kubernetes · cloud · network · ingress

no entries this week

04

PHP & CMS

wordpress · drupal · plugins · php frameworks

wordfence.com2d
▲ headline

Elementor Pro: unauthenticated arbitrary file upload (6M installs)

Wordfence disclosed an unauthenticated arbitrary file upload in Elementor Pro affecting an estimated 6,000,000 WordPress sites. Attackers can upload executable PHP and achieve RCE / full site takeover. Patched; sites not on the fixed release should update immediately given the install base and the low bar for exploitation.

Elementor Pro
Fruition take

Elementor Pro is on enough client sites that this belongs on Monday's patch list, not next sprint. If you manage WordPress at scale, query your fleet for the plugin slug and version this morning and force-update anything below the fixed release.

wordfence.com1d

Pods plugin unauth privilege escalation to admin (100k installs)

Wordfence reports an unauthenticated privilege-escalation flaw in the Pods WordPress plugin (100,000+ active installs) that lets attackers overwrite any user's password, including the site owner's, resulting in complete site takeover. A patched release is available.

Pods (WordPress plugin)
Fruition take

Password-overwrite bugs get weaponized fast because they're trivial to script. If Pods is anywhere in your managed WordPress estate, patch and audit `wp_users` for out-of-band password changes in the last two weeks.

github.com2dCVSS 8.4

Winter CMS: Twig sandbox escape bypasses CVE-2024-54149 patch

GHSA-8cfw-pcwh-v63w (CVSS 8.4) documents an incomplete-fix follow-up to CVE-2024-54149: authenticated backend users with `cms.manage_pages`, `manage_layouts`, or `manage_partials` can escape the Twig SecurityPolicy blocklist to read/modify DB records, run arbitrary SQL, and reach RCE by injecting PHP into CMS templates. Part of a broader Winter security batch including LFI via LESS `@import` and JS `=include`, and stored XSS in cached brand styles.

CVE-2024-54149Winter CMS
Fruition take

If you run Winter CMS with delegated content editors, the template-edit permissions are effectively RCE — treat them as admin. Patch to the fixed release and audit which non-admin roles hold `cms.manage_*`.

05

Identity & Auth

oauth · saml · iam · session attacks

unit42.paloaltonetworks.comthis week

Unit 42: large-scale Entra credential theft claims by TheHatman

Unit 42 updated its threat brief on actor TheHatman's August 2026 claims of stealing large volumes of credentials from Microsoft Entra tenants. Guidance emphasizes disabling legacy auth, enforcing phishing-resistant MFA, conditional-access location/device gates, and hunting for anomalous token-replay and non-interactive sign-ins.

Microsoft Entra ID
Fruition take

If you still allow SMTP AUTH, IMAP, or POP against Entra for any tenant you manage, close it this week. Then pull sign-in logs for non-interactive tokens issued to unfamiliar IPs since Aug 1.

06

Threat Intel

active exploitation · breaches · ransomware

nvd.nist.gov2dKEV
▲ headline

CISA KEV: Zimbra ZCS SMTP command injection actively exploited

CISA added CVE-2026-73570 to KEV: an unauthenticated OS command injection in Zimbra Collaboration Suite reachable via crafted SMTP requests, executing as the Zimbra user. BOD 26-04 timelines apply to federal agencies; historical Zimbra KEVs have seen broad opportunistic exploitation within days of listing.

CVE-2026-73570Zimbra Collaboration Suite
Fruition take

If any client still runs on-prem Zimbra, treat this as an emergency change — SMTP is internet-exposed by definition. Patch this week and pull mailbox logs for anomalous shell activity under the zimbra user since the advisory dropped.

nvd.nist.govthis weekKEV

CISA KEV wave: SharePoint auth bypass, vCenter path traversal, macOS Screen Sharing, Windows AFD

CISA added four Microsoft/Apple/Broadcom bugs to KEV on Aug 18: SharePoint weak-authentication bypass (CVE-2026-55040), VMware vCenter path traversal to RCE (CVE-2026-59310), macOS Screen Sharing improper authentication (CVE-2026-65400), and a Windows AFD.sys UAF privilege escalation (CVE-2026-68820). All are confirmed exploited in the wild.

CVE-2026-55040CVE-2026-59310CVE-2026-65400+1 moreMicrosoft SharePointVMware vCenterApple macOSWindows AFD
Fruition take

vCenter and SharePoint patches typically require change windows most orgs don't have this week — start the approvals now. For AFD.sys, prioritize any shared jump hosts or Citrix/RDS estates where local users can chain to SYSTEM.

nvd.nist.gov1wKEV

CISA KEV: Metabase unauthenticated SQL injection

CVE-2026-72898 in Metabase — an unauthenticated SQL injection into the application database — was added to KEV. Successful exploitation yields admin access to the Metabase instance, stored credentials for every connected data source, and full read/export of connected databases.

CVE-2026-72898Metabase
Fruition take

Metabase is the kind of internal BI tool that's often exposed to the internet 'just for the office VPN' and never re-audited. Confirm your instance is patched, rotate every data-source credential Metabase holds, and check egress logs for bulk queries you didn't run.