InfoSec.Watch - Issue #151

Check Point Research says the DPRK-linked Lazarus group used CVE-2026-68820, a previously unknown use-after-free flaw in the Windows Ancillary Function Driver for WinSock (AFD.sys), during the latest Operation Dream Job campaign. The campaign targets defense, aerospace, and aviation organizations with recruiter-themed lures and trojanized software. After gaining a foothold, the attackers used the flaw to reach SYSTEM privileges and deploy a new FudModule kernel rootkit designed to reduce EDR visibility. Microsoft patched the flaw on August 11, and CISA added it to the Known Exploited Vulnerabilities catalog.

The vulnerability matters because it is a post-compromise accelerator: a phishing success can quickly become kernel-level control. Patch the August Windows updates, but also hunt for the surrounding chain—unexpected PDF viewers or DLL sideloading, EDR tampering, and connections to compromised web infrastructure used as relay nodes.

Sources: Check Point Research · NVD / Microsoft reference

Cisco disclosed CVE-2026-20349, a high-severity flaw in the Remote Access SSL VPN service of Secure Firewall ASA and FTD. An unauthenticated remote attacker can send a crafted HTTP request that causes an affected device to reload, creating a denial-of-service condition. Cisco PSIRT says it became aware of active exploitation in August 2026, and there is no workaround.

Exposure depends on both software version and configuration. Potentially vulnerable configurations include SSL VPN, IKEv2 remote access VPN with client services, and Zero Trust Network Access on FTD. Cisco has published hot fixes and directs customers to its Software Checker to identify affected releases. For defenders, this is not merely a patch-ticket issue: an edge-device reload can interrupt remote access during an incident or create repeated operational disruption. Inventory externally reachable ASA/FTD devices, confirm configuration exposure, apply fixed software, and verify HA/failover behavior rather than assuming redundancy will absorb the attack.

Source: Cisco Security Advisory

Zoom published three related client bulletins after A Security demonstrated that malicious annotation messages could be used for a zero-click remote-code-execution path against another meeting participant. Zoom’s bulletins track the relevant flaws as CVE-2026-53413, CVE-2026-53414, and CVE-2026-53415. The highest-impact bugs are memory-corruption issues in the annotation function, and Zoom confirms that a meeting participant may be able to execute code on another participant over the network.

To close the disclosed client-side exposure across the affected branches, Zoom Workplace should be at 7.1.5 or 7.0.6 in the respective supported branch, and Zoom Rooms at 7.1.5; VDI clients have their own fixed-version requirements. A Security notes that Zoom also deployed server-side filtering for older clients, but end-to-end encrypted meetings limit what the server can inspect. Enterprises should enforce minimum client versions, review whether annotation is actually needed, and prevent unmanaged or stale clients from joining sensitive meetings.

Sources: Zoom ZSB-26015 · Zoom ZSB-26016 · Zoom ZSB-26017 · A Security research

Rapid7 disclosed CVE-2026-63520 as the second half of a two-bug chain that can produce unauthenticated remote code execution on vulnerable on-premises SharePoint servers. Patches are available for SharePoint Server 2016, 2019, and Subscription Edition. No active exploitation was established in the retrieved sources, but public technical analysis and proof-of-concept material make patch delay increasingly difficult to justify.

Source: Rapid7

SAP’s August Patch Day shipped 28 new security notes plus a GitHub advisory. The top item, CVE-2026-58231, is an improper-authorization flaw in SAP Commerce Cloud’s Data Hub Adapter rated CVSS 10.0; SAP also fixed multiple critical code-injection and memory-corruption issues. SAP customers should map the listed components to their landscape and prioritize the critical notes rather than treating the release as a routine monthly bundle.

Source: SAP Security Patch Day

Adobe’s APSB26-92 fixes critical, important, and moderate vulnerabilities in Adobe Commerce and Magento Open Source. CVE-2026-71362 is an unauthenticated, no-admin-required privilege-escalation issue rated CVSS 9.1, and the bulletin includes another unauthenticated critical authorization flaw. Adobe says it is not aware of exploitation in the wild. Move affected branches to the August 2026 security releases.

Source: Adobe APSB26-92

A new joint #StopRansomware advisory details Gunra, a ransomware-as-a-service operation that expanded during 2026 and uses double extortion against government, critical infrastructure, and other organizations. The advisory emphasizes exploited edge vulnerabilities, exposed VPN/RDP infrastructure, immutable backups, and segmentation. Use the released IOCs and ATT&CK mapping to test whether existing detections actually cover the described tradecraft.

Source: CISA AA26-222A

This week’s pattern is untrusted input crossing trusted software boundaries. Lazarus used a recruiter workflow to get code onto Windows before escalating through AFD.sys; Cisco’s ASA/FTD flaw turns one crafted request into a remote-access gateway reload; and Zoom’s annotation parser lets a meeting participant send data that another client automatically processes. The defensive implication is broader than “patch faster.” Security teams should identify where outsiders can make privileged, ubiquitous software parse complex input—VPN gateways, conferencing clients, document viewers, web apps—and make those paths visible in exposure management. The fastest-changing risk is often not a new product; it is a trusted product accepting attacker-controlled data in a place defenders stopped thinking of as an attack surface.

Action: Run a 72-hour exposure-and-version sweep for the three highest-priority surfaces in this issue: Windows endpoints, Cisco remote-access firewalls, and Zoom clients.

Who runs it: Vulnerability management coordinates; endpoint engineering owns Windows and Zoom; network security owns Cisco ASA/FTD; the SOC validates hunting coverage and exceptions.

Check these specifically: Confirm August 2026 Windows security-update compliance for systems exposed to user-delivered code; identify ASA/FTD devices with SSL VPN, IKEv2 remote-access client services, or FTD ZTNA and check them against Cisco’s CVE-2026-20349 guidance; enforce Zoom Workplace minimum versions 7.1.5 or 7.0.6 by branch and Zoom Rooms 7.1.5, and verify VDI minimums where deployed; review whether annotation is enabled for high-sensitivity meetings.

Evidence you're done: Exported endpoint compliance results; Cisco Software Checker or equivalent version/configuration evidence for every internet-facing device; Zoom admin minimum-version policy screenshots or reports; a list of exceptions with owner and remediation date; and SOC hunt results for EDR tampering or suspicious post-exploitation on unpatched Windows hosts.

Security teams cannot treat every monthly bulletin as an emergency, and they should not try. The useful distinction is whether an attacker can already reach the vulnerable parser, whether exploitation has been observed, and what control the flaw yields. That puts an exploited Windows privilege escalation and an actively attacked VPN edge above a long list of theoretical bugs—but it also keeps a zero-click meeting-client RCE near the top even before exploitation appears in telemetry.

A better patch queue is not “highest CVSS first.” It is reachable input × consequence × evidence of attacker interest. This week offers unusually clear examples of all three.