IN mid-August 2026, a wave of newly disclosed vulnerabilities began to be exploited in the wild, affecting widely used enterprise platforms such as Microsoft SharePoint, the Metabase analytics tool, Cisco Secure Firewall and the Windows kernel. The flaws, tracked as CVE-2026-55040, CVE-2026-63520, CVE-2026-20349, CVE-2026-68820 and CVE-2026-72898, have already been added to CISA’s Known Exploited Vulnerabilities catalogue here and are being leveraged by the Lazarus Group in targeted campaigns.
CVE-2026-55040 is an authentication bypass in SharePoint with a CVSS score of 9.1 that lets an attacker submit a specially crafted request to gain unrestricted access to site collections according to SecurityWeek. CVE-2026-63520, scored 8.1, is a remote code execution flaw in the SharePoint Business Data Connectivity component that can be triggered via unsafe .NET type instantiation after authentication as detailed by Rapid7. CVE-2026-20349, rated 8.6, is a heap inspection issue in Cisco Secure Firewall that can be sent a malicious packet to cause a denial‑of‑service condition. CVE-2026-68820 carries a 7.0 rating and is a use‑after‑free vulnerability in the Windows WinSock driver that permits execution with SYSTEM privileges. Finally, CVE-2026-72898 received a perfect 10.0 score for a SQL injection in Metabase that provides full administrative control over the application database.
Researchers at Rapid7 showed how CVE-2026-55040 can be chained with CVE-2026-63520 to achieve remote code execution without needing valid credentials. Proof‑of‑concept code for the SharePoint bypass appeared online shortly after the July Patch Tuesday release, prompting immediate active use by threat actors. The Metabase flaw allows an unauthenticated user to inject arbitrary SQL statements through the application’s search filter, leading to data extraction or destruction.
Cisco’s firewall defect can be triggered with a single UDP packet, overwhelming the device and disrupting legitimate traffic. The Windows zero‑day is being delivered via trojanised documents that load a malicious DLL, giving attackers a foothold for further lateral movement.
CISA added CVE-2026-20349, CVE-2026-68820 and CVE-2026-72898 to its Known Exploited Vulnerabilities catalog on 11 August 2026, signalling that these issues are already being seen in attacks as reported by Security Affairs. The agency noted that the Windows flaw is under active exploitation and that federal agencies must apply patches within the prescribed timeframe. Separate advisories from Microsoft and Cisco confirm that patches are available for all listed CVEs except CVE-2026-61514 and CVE-2026-61515, for which no fix has been released. The Lazarus Group, tracked as G0032, has been observed incorporating the Windows zero‑day into its Operation Dream Job campaign.
The group distributes fake job offers to defence and aerospace professionals, enticing targets to open a poisoned PDF or download a trojanised viewer. One chain uses a malicious DLL named ForestTiger, while another deploys a backdoor called Troy through a compromised SecurityPDF application. To protect its command channel, Lazarus employs a post‑quantum key exchange mechanism, making network traffic harder to decrypt with conventional tools. Infosecurity Magazine reported that the campaign also utilizes a downloader dubbed MISTPEN and an undocumented PHP webshell for persistent communication here. Victims are primarily located in Europe and India, with the goal of harvesting sensitive intellectual property and credential material.
Organisations should prioritise installing the Microsoft patches for CVE-2026-55040 and CVE-2026-63520, the Cisco firmware update for CVE-2026-20349 and the Windows update for CVE-2026-68820 as soon as possible. Metabase users must upgrade to the latest version that addresses CVE-2026-72898 and review database logs for anomalous queries.
Network administrators are advised to block inbound UDP traffic to the firewall’s management interface and to enforce strict egress filtering to limit command‑and‑control callbacks. Security teams should hunt for indicators such as the ForestTiger and Troy binaries, the MISTPEN downloader and any unusual PHP shell scripts in web directories. Additionally, enabling logging of .NET type instantiation events in SharePoint can help detect exploitation attempts of the chained flaws.
Keeping asset inventories up to date and verifying patch levels across all SharePoint servers, Metabase instances, Cisco firewalls and Windows endpoints remains the most effective defence. Subscribing to threat‑intelligence feeds that tag Lazarus‑related IOCs will help catch any follow‑on activity. Finally, organisations should review incident‑response playbooks to ensure rapid isolation of affected systems and timely forensic collection when a compromise is suspected.