Lazarus Windows Zero-Day, vCenter RCE, and Cisco VPN Exploitation Lead This Week’s CVE Priorities

By SAFE Threat Research Team

This week’s exploitation activity spans zero-day privilege escalation, persistent access, service disruption, and enterprise application compromise. Lazarus exploited Windows CVE-2026-68820 to elevate privileges to SYSTEM and deploy the FudModule rootkit, while exploitation of VMware vCenter CVE-2026-59310 has been associated with reverse_ssh persistence. At the network edge, Cisco ASA/FTD CVE-2026-20349 is being actively exploited to disrupt Remote Access SSL VPN services.

Enterprise applications drawing this week’s attention – SharePoint CVE-2026-55040, SAP Commerce Cloud CVE-2026-58231, Adobe Commerce CVE-2026-71362, and Ray CVE-2025-62593 all carry real-world exploitation signals. The pattern reinforces a key prioritization principle: exploit evidence, exposure, attack path, and post-compromise impact matter more than severity scores alone.

Vulnerability Landscape

This week, NVD published 3,603 CVEs, including 1,830 rated critical or high severity. Public exploit or proof-of-concept code was available for 152 vulnerabilities, while 10 showed stronger weaponized-exploit signals.

The disclosure volume establishes the size of the vulnerability landscape, but severity alone does not determine remediation priority. A CVSS 7.0 privilege-escalation vulnerability already used by a nation-state actor, a critical vCenter vulnerability with confirmed post-exploitation persistence, and a critical vulnerability with no observed exploitation present very different operational risks.

Trending Vulnerabilities

This week, 13 CVEs showed confirmed real-world exploitation signals, including four newly published vulnerabilities and nine pre-existing issues.

The activity spans multiple stages of the vulnerability lifecycle. CVE-2026-68820 was exploited before a patch was available, SAP Commerce Cloud CVE-2026-58231 has seen exploitation attempts after remediation became available, and Ray CVE-2025-62593 is now included in CISA KEV months after its initial disclosure. The relevant question is therefore not simply when a CVE was published, but whether it is being exploited, how it can be reached in an organization’s environment, and what access successful exploitation provides.

Top CVEs to Watch

Microsoft Windows CVE-2026-68820: Lazarus Exploits AFD.sys Zero-Day to Reach SYSTEM

CVE-2026-68820 is a privilege-escalation vulnerability in the Windows Ancillary Function Driver for WinSock (AFD.sys). Lazarus exploited the flaw as a zero-day in its Operation Dream Job campaign targeting defense, aerospace, and aviation organizations. The vulnerability allowed attackers with an existing foothold to elevate privileges to SYSTEM, enabling deployment of a new FudModule kernel-mode rootkit designed to interfere with endpoint security and EDR visibility. Microsoft patched the vulnerability on August 11.

The flaw is particularly significant because it was used as a post-compromise privilege-escalation mechanism rather than for initial access. Lazarus first established access through its broader intrusion chain before exploiting CVE-2026-68820 to obtain higher privileges and deploy the rootkit. This distinction is important when assessing affected endpoints: patching addresses the vulnerability, but systems potentially exposed to the campaign should also be investigated for FudModule activity, privilege-escalation attempts, and other signs of endpoint security tampering.

Organizations should deploy Microsoft’s August security update and prioritize endpoints associated with the targeted environments. Because the vulnerability was exploited as a zero-day before a patch was available, potentially exposed systems should be assessed for evidence of compromise rather than treated as a patch-only remediation task.

VMware vCenter CVE-2026-59310: Active RCE Campaign Establishes Persistent Access

CVE-2026-59310 is a critical directory-traversal vulnerability in the VMware vCenter Syslog server that can allow an unauthenticated attacker with network access to execute arbitrary code. The vulnerability is under active exploitation, with compromised vCenter systems observed running reverse_ssh as a persistence mechanism. Because vCenter provides centralized control over virtualized infrastructure, a successful compromise can give attackers a valuable foothold to maintain access and support further activity across the environment.

Organizations should apply the applicable security updates immediately and, wherever possible, restrict network access to vCenter management interfaces. Previously exposed systems should also be investigated for reverse_ssh, unexpected processes, unauthorized configuration changes, suspicious outbound connections, and other indicators of persistence or post-exploitation activity. 

Cisco ASA and FTD CVE-2026-20349: Active Exploitation Targets Remote Access SSL VPN

CVE-2026-20349 is a high-severity denial-of-service vulnerability affecting Cisco Secure Firewall ASA and FTD deployments with Remote Access SSL VPN functionality enabled. An unauthenticated remote attacker can send a crafted HTTP request to the SSL VPN service, causing the affected device to reload and disrupting VPN and firewall availability. Cisco assigns the vulnerability a CVSS score of 8.6.

Cisco has confirmed active exploitation, making the vulnerability more than a theoretical availability risk. Successful exploitation can force affected devices to reload, disrupting remote-access connectivity and firewall availability. Organizations should identify affected ASA and FTD appliances, prioritize externally reachable production devices, apply the available updates or hotfixes, and review unexpected reloads or service interruptions that occurred before remediation.

Microsoft SharePoint CVE-2026-55040: Public PoC Quickly Moves Into Exploitation Attempts

CVE-2026-55040 is a critical authentication-bypass vulnerability in Microsoft SharePoint caused by weaknesses in the JWT token-validation pipeline. An unauthenticated remote attacker can forge authentication material to impersonate a SharePoint user or administrator.

Exploitation attempts have been observed targeting CVE-2026-55040 following the availability of public exploit code. Separately, CVE-2026-55040 can be chained with CVE-2026-63520 to achieve unauthenticated remote code execution, although exploitation of the complete chain has not been confirmed. Organizations should deploy the applicable security updates across supported on-premises SharePoint deployments and investigate previously exposed systems for suspicious user impersonation, administrative activity, or process execution.

SAP Commerce Cloud CVE-2026-58231: Exploitation Attempts Target Critical RCE

CVE-2026-58231 is a critical vulnerability affecting the SAP Commerce Cloud Data Hub Adapter. The flaw carries a CVSS score of 10.0 and allows an unauthenticated remote attacker to abuse a default authentication client and submit specially crafted input, potentially resulting in arbitrary code execution and compromise of internal application components.

Exploitation attempts have since been observed targeting the vulnerability, increasing the urgency for affected environments. While the activity does not establish widespread successful compromise, the combination of unauthenticated remote exploitation and potential arbitrary code execution makes exposed deployments a high-priority remediation target.

Organizations running affected COM_CLOUD 2211 and 2211-JDK21 deployments should apply the remediation provided in SAP Security Note 3771065 and assess whether vulnerable services were externally reachable before remediation.

Adobe Commerce CVE-2026-71362: Exploitation Attempts Target Critical Account-Takeover Flaw

CVE-2026-71362 is a critical incorrect-authorization vulnerability affecting Adobe Commerce and Magento Open Source. The flaw is remotely exploitable without authentication or user interaction and can provide elevated access to sensitive resources. Technical analysis has demonstrated that the flaw can be abused to switch a customer session to another account, exposing the victim’s account and private data.

Exploitation attempts targeting the vulnerability have been observed, raising the priority for exposed e-commerce environments. Organizations should apply the applicable security patch and review previously exposed deployments for anomalous customer sessions, unauthorized account access, and unexpected account changes.

Ray CVE-2025-62593: Browser-Based RCE Added to CISA KEV

CVE-2025-62593 is a critical code-injection vulnerability affecting Ray versions before 2.52.0. The attack path is unusual: a developer running Ray can be targeted after visiting attacker-controlled web content in Firefox or Safari. By combining DNS rebinding with weaknesses in Ray’s browser request protections, an attacker can use the browser to access locally or internally accessible Ray APIs and execute arbitrary commands on the developer’s system. Chrome is not affected by the technique described in the advisory.

CISA added CVE-2025-62593 to its Known Exploited Vulnerabilities (KEV) catalog on August 17, citing evidence of exploitation, making it an immediate remediation concern. However, the relevant exposure extends beyond internet-facing servers to developer workstations and development environments where Ray services are reachable from supported browsers. Organizations should upgrade to Ray 2.52.0 or later, restrict access to the Ray dashboard and job APIs, and identify developer environments where browsers can reach vulnerable Ray instances.

What Security Teams Should Prioritize

This week’s activity shows why confirmed exploitation, exposure, and post-compromise impact should be considered alongside severity. Windows CVE-2026-68820, VMware vCenter CVE-2026-59310, and Cisco CVE-2026-20349 demonstrate how exploitation can lead to privilege escalation, persistence, system compromise, or disruption.

• Prioritize systems with confirmed exploitation and high post-compromise impact. Windows endpoints potentially exposed to the Lazarus campaign, compromised or reachable vCenter deployments, affected Cisco VPN appliances, and Ray environments affected by CVE-2025-62593 warrant immediate attention.
• Treat patching and compromise assessment as separate actions. For vCenter in particular, installing the update does not remove attacker-established reverse_ssh persistence. Systems vulnerable during an exploitation window should be reviewed for credentials, persistence, unexpected administrative activity, and downstream access.
• Escalate vulnerabilities when real-world exploitation signals emerge. Observed attempts against SharePoint, SAP Commerce Cloud, and Adobe Commerce should increase remediation priority even where widespread successful compromise has not been established.
• Prioritize based on the affected system’s role. vCenter, Cisco firewalls, SharePoint, commerce platforms, and developer infrastructure occupy important trust boundaries, so successful exploitation can create impact beyond the vulnerable service itself.
• Keep watchlist vulnerabilities separate from confirmed exploitation. Critical severity and public PoCs justify accelerated remediation, but they should not be presented with the same threat confidence as vulnerabilities backed by telemetry of observed compromises.

The priority of a vulnerability can change as exploitation intelligence develops. Remediation decisions should reflect current evidence of exploitation, exposure, attack path, and business impact, rather than CVSS or disclosure date alone.

SAFE CTEM helps teams make those distinctions at scale by connecting vulnerability findings with exploit signals, exposure, asset criticality, compensating controls, and business context. Its Finding Score evaluates these factors together so that an actively exploited vulnerability on a critical, reachable asset is not treated the same as an equally severe vulnerability with limited exposure or no evidence of exploitation.