--- title: "Security digest: August 11, 2026" url: https://erroneo.us/security/2026-08-11/ description: "August 11, 2026 vulnerability digest: 3 briefs (Adobe Commerce CVE-2026-71362: Exploited Account…); 3 CISA KEV additions (Cisco, Metabase, Microsoft); 1…" type: security-digest-day section: "Security Digest" date_published: 2026-08-11 date_modified: 2026-10-21 publisher: erroneo.us author: erroneo.us Security Desk license: All rights reserved. Quote with attribution and a link. --- # Security digest: August 11, 2026 3 editorial briefs, 3 known exploited (cisa kev) additions and 1 critical advisory. ## Take stock - Act now: Adobe Commerce CVE-2026-71362: Exploited Account Takeover . Merchants and agencies running Adobe Commerce 2.4.4-2.4.9, Adobe Commerce B2B 1.3.3-1.5.3 or Magento Open Source 2.4.6-2.4.9 at the 2026-jul level or earlier, including staging and campaign sites. - Patch this week: Cisco ASA/FTD CVE-2026-20349: Exploited VPN Crash Bug . Teams running Cisco Secure Firewall ASA or FTD with SSL VPN (webvpn), IKEv2 remote access with client services, or Zero Trust Network Access enabled, which in practice means internet-facing VPN headends. - Patch this week: Windows AFD.sys CVE-2026-68820: Exploited Zero-Day EoP . Admins of Windows 10, Windows 11 and Windows Server 2012 through 2025 machines that have not installed the August 11, 2026 or a later cumulative update, starting with workstations of staff who receive outside job offers or documents. - Do you run any of these? Metabase Metabase, Microsoft Windows Ancillary Function Driver for WinSock, Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD). They are being exploited in the wild (CISA KEV). Patch or mitigate if you do; CISA’s federal deadline is 2026-08-14. - Go: 1 critical advisory ( github.com/seaweedfs/seaweedfs ). Check with govulncheck ./... . - None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully. ## Editorial briefs - **Act now** [Adobe Commerce CVE-2026-71362: Exploited Account Takeover](https://erroneo.us/security/briefs/adobe-commerce-magento-cve-2026-71362-account-takeover/index.md): Any Magento or Adobe Commerce store without the August 2026 isolated patch is exposed to an exploited, login-free takeover of customer accounts; apply it today. - **Patch this week** [Cisco ASA/FTD CVE-2026-20349: Exploited VPN Crash Bug](https://erroneo.us/security/briefs/cisco-asa-ftd-vpn-dos-cve-2026-20349/index.md): If your ASA or FTD terminates remote access VPN, SSL VPN or ZTNA, install the fixed release this week; attackers are using this to knock firewalls offline, but Cisco describes no code execution or data theft. - **Patch this week** [Windows AFD.sys CVE-2026-68820: Exploited Zero-Day EoP](https://erroneo.us/security/briefs/windows-afd-sys-cve-2026-68820-zero-day-eop/index.md): A local bug, but a real zero-day: North Korea's Lazarus group used it to load a kernel rootkit, so any Windows host still missing the August 2026 or later cumulative update should be patched this week. ## Known exploited (CISA KEV) - [CVE-2026-72898](https://erroneo.us/security/cve/CVE-2026-72898/index.md) Metabase Metabase: Metabase SQL Injection Vulnerability (CISA due 2026-08-14) - [CVE-2026-68820](https://erroneo.us/security/cve/CVE-2026-68820/index.md) Microsoft Windows Ancillary Function Driver for WinSock : Microsoft Windows Ancillary Function Driver for WinSock Use-After-Free Vulnerability (CISA due 2026-08-25) - [CVE-2026-20349](https://erroneo.us/security/cve/CVE-2026-20349/index.md) Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) : Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) Heap Inspection Vulnerability (CISA due 2026-08-14) ## Critical advisories - [CVE-2026-73080](https://erroneo.us/security/cve/CVE-2026-73080/index.md) SeaweedFS: Unauthenticated SSRF with response read-back via VolumeServer.FetchAndWriteNeedle — Go github.com/seaweedfs/seaweedfs < 0.0.0-20260512171120-69da20bdaec9 → 0.0.0-20260512171120-69da20bdaec9 --- Source page: https://erroneo.us/security/2026-08-11/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt