Cybersecurity August 12, 2026: Critical Zero-Days, Infrastructure Attacks, and Patch Alerts

A critical vulnerability (CVE-2026-58231) affecting SAP Commerce Cloud allows unauthenticated attackers to execute arbitrary code with a maximum CVSS score of 10.0. SAP has released patches to mitigate this severe security flaw.

The Lazarus Group exploited a recently patched Windows zero-day vulnerability to gain SYSTEM access and deploy a backdoor targeting defense and aerospace firms across France, Germany, Brazil, and India. This cyberattack highlights advanced persistent threat activity against critical sectors.

Adobe released patches addressing three critical vulnerabilities, including CVE-2026-48362, in ColdFusion, Commerce, and Campaign Classic products. These flaws had CVSS 10.0 severity ratings and could enable remote code execution and privilege escalation.

Security researcher Chaotic Eclipse published a proof-of-concept for a zero-day in Microsoft Defender for Windows that bypasses existing patches and grants SYSTEM level access. This discovery underscores ongoing risks in endpoint protection software.

In 2026, a massive healthcare data breach exposed personal information of 15 million patients, marking the largest such incident in the healthcare sector for that year. The breach intensifies concerns about protecting sensitive medical data.

Representative Gottheimer unveiled a federal cybersecurity plan aimed at strengthening protections for critical infrastructure following hacking incidents targeting New Jersey water systems. The announcement on March 1, 2024, signals heightened government prioritization of water sector cybersecurity.

The Water Cyber Shield Act has been proposed to implement cybersecurity standards across utility sectors following recent cyberattacks on utilities. The legislation aims to reduce vulnerabilities in critical infrastructure and improve resilience.

Cisco disclosed a software vulnerability capable of allowing attackers to crash firewalls, potentially affecting millions of devices worldwide. The flaw calls for urgent patches to prevent disruption and security breaches.

A discovery revealed 737 malicious Chrome VPN and proxy extensions primarily targeting Russian-speaking users by routing traffic through harmful proxies. This large-scale compromise poses significant privacy and security risks to affected browser users.

Threat actors are actively exploiting a critical directory-traversal vulnerability (CVE-2026-59310) in VMware vCenter with a CVSS score of 9.8 to gain persistent remote access. The exploitation affects enterprise virtualization management platforms worldwide.