Critical Vulnerabilities and Active Exploitation, Aug 2026

Monthly reference modules

These modules are filled automatically with verified dated facts within the period. Each one states its basis and counting criterion, so the figures reconcile across modules. They are the recurring month-by-month reading; the later analysis develops the cases without repeating this summary.

Indicator window: 346 dated facts in August 2026 · 16 from prior months (comparative frame, not monthly volume) · 23 without confirmed date (excluded from indicators). Facts from prior months are used only as a comparative frame in the analysis, never as volume for this period.

Executive monthly summary

August 2026 sent a strong signal across Latin America toward the exploitation of critical vulnerabilities, with 344 verified incidents, 83 critical CVEs mentioned, and 281 incidents classified in the vulnerabilities track. The month was dominated by software widely used in corporate and government environments, with notable alerts for Brazil, Argentina, Chile, Paraguay, and other countries in the region.

The defining pattern was not ransomware or extortion. The most sensitive exposure surfaced in collaboration servers, gateways, firewalls, Windows drivers, load-balancing appliances, and widely deployed management platforms. At the same time, regional CERTs, especially CTIR Gov.br and INCIBE-CERT, issued multiple advisories on products with active exploitation risk or urgent mitigation needs, reinforcing the month’s bias toward patching and immediate containment.

The clearest case of active exploitation was CVE-2026-68820 in Windows AFD.sys, treated as a zero-day exploited in the wild by Microsoft and several analysts. It was joined by CVE-2026-8037 in Progress LoadMaster, CVE-2026-34486 in Apache Tomcat, and CVE-2026-73570 in Zimbra Collaboration Suite, all classified as actively exploited in different technical and threat intelligence sources. The common pattern was a very short window between disclosure, KEV inclusion, and remediation requirements.

At the regional level, Brazil concentrated the highest density of official alerts, with CTIR Gov.br publishing advisories on FortiOS, Windows AFD, and Apache Tomcat, while Argentina appeared in the attribution of campaigns tied to CVE-2026-73570 against government agencies and universities. Chile added a different angle, more tied to the AI supply chain and preventive measures around LiteLLM. Paraguay, for its part, was linked to alerts on Ubiquiti and Joomla in contextual material, although without a confirmed date, so it is not included in the month’s indicators.

The operational readout is high risk. Not because of sheer volume alone, but because of the mix of real exploitation, cross-cutting products, and ever tighter mitigation timelines. August also showed added pressure on hybrid environments and public-sector systems, with campaigns affecting email, collaboration, authentication, load balancing, VPNs, firewalls, and development platforms, in other words, the logical perimeter that now supports much of the region’s operations.

Regional snapshot for the month

August saw an unusual concentration of alerts across the region about critical vulnerabilities that were either already being exploited or were ready for immediate exploitation, with Brazil as the documentary epicenter and Argentina, Chile, and Paraguay affected either directly or through preventive analysis of the campaigns. The month’s qualitative risk is high because most of the verified incidents pointed to internet-facing systems, collaboration services, security products, and administrative tools that often carry broad privileges.

The most important figure is not just that 344 verified incidents were recorded. It is that 281 of them fell into the vulnerability category, showing that the month’s main pressure came from the exploitation of known flaws, not from mass malware or extortion campaigns. For Latin American teams, that matters twice over. It confirms that attackers still find value in delayed patching, and it also makes inventory, external exposure, and response time top priorities.

Brazil concentrated CTIR Gov.br alerts on FortiOS, Windows AFD, and Apache Tomcat, three surfaces that often coexist in the public sector, financial services, and enterprise environments. The fact that the Brazilian agency issued repeated advisories about widely used software suggests a mature reading of risk, but also an ecosystem where vulnerability exploitation is significant enough to justify specific warnings. Argentina appeared less often in the alert count, but not in impact. The campaign attributed to actors linked to Russia against state institutions, universities, and public agencies places the country on the map of high-value targets.

Chile faced a different, no less serious focus. The material on the LiteLLM supply chain and the preventive response from ANCI and other entities shows how a vulnerability or compromise in the AI tooling layer can end up affecting hundreds of organizations and thousands of pipelines. Although that episode does not strictly belong to the core of critical CVEs, it reinforces the view of a month in which entry points expanded into automation and development infrastructure.

Period indicators

August’s statistical snapshot confirms a clear dominance of the vulnerability axis over the rest of the verified signals, with 344 base events, 83 critical CVEs, and a total drop to zero in ransomware or extortion cases as the primary focus. The regional reading should be handled carefully: the count reflects the material analyzed, not all activity observed in the region.

The base of 344 verified events should not be read as a simple sum of categories, because the editorial attribution axes are exclusive and a single event can affect more than one sector. The time window also matters: 346 events fell within August 2026, 16 corresponded to previous months, and 23 had no confirmed date, so they are not included in the indicators.

Relevant incidents

The month’s most actionable signal was not a single breach, but the convergence of several critical vulnerabilities under active exploitation across products widely used in the region. The most relevant cases are grouped by platform, because that makes the operational risk clearer for Latin American environments exposed to the internet, clusters, gateways, and remote administration services.

CVE-2026-68820 in Windows AFD.sys

Microsoft treated CVE-2026-68820 as a vulnerability exploited in the wild and the only explicitly acknowledged zero-day in its August 2026 Patch Tuesday. The flaw, a use-after-free in the Ancillary Function Driver for WinSock, allows privilege escalation from a limited account to SYSTEM, with CVSS 7.0 and a consistent reading across several technical write-ups and regional advisories.

For Latin America, the issue is not abstract. Windows remains the operating base for many public administrations, universities, service companies, and corporate desktop environments, and this vulnerability acts as an intermediate link in exploitation chains. That makes it especially valuable to attackers who already have an initial foothold through phishing, exposed services, or compromised credentials.

CTIR Gov.br published alert 72/2026 on August 25, describing the flaw and aligning it with international notices about active exploitation. That overlap between a local alert and an international classification reinforced the need to prioritize updates in Brazil. Moncloa.com, citing INCIBE-CERT, also reported that the vulnerability was being exploited in real campaigns, confirming that the exposure was not theoretical.

From an operational standpoint, CVE-2026-68820 fits a classic pattern, initial access through one path and local escalation through another. UpGuard explained that it is used as an intermediate component within compromise chains in desktop and server infrastructure, which means teams need to look not only at the Windows version, but also at privilege hygiene and internal segmentation.

CVE-2026-8037 in Progress LoadMaster

Progress LoadMaster was one of the most sensitive names of the month. CVE-2026-8037, an unauthenticated command injection with CVSS 9.8, was marked as actively exploited in CISA’s KEV catalog and was accompanied by multiple technical analyses that stress the risk when the appliance API is exposed to the internet.

The response window was short. Decryption Digest reported at least 792 attempts from 65 unique IPs before the flaw was added to KEV on August 7, 2026. That figure reflects attempt telemetry, not confirmed impact incidents, but it helps size the pressure before the regulatory alert. It is a useful signal because it shows the attacker was already operating before the defense loop reacted.

The case matters in Latin America because of the presence of load balancers and application delivery appliances in banks, telecoms, universities, and government agencies. The exposure model is dangerous: if the API was left open and the device was not updated with the corrected versions released in June, the risk of remote command execution with root privileges is immediate. The problem is not limited to the version, but also to the appliance’s access design.

DFT Informática and SecurityOnline.info placed the vulnerability in active real-world exploitation, while SecurityArsenal emphasized that the first control is to inventory appliances and restrict external access to the API. That approach matches the type of asset involved. This is not just another server, but a traffic control point that, if it fails, usually compromises several downstream services.

CVE-2026-34486 in Apache Tomcat

Apache Tomcat reappeared as a critical vector in August, this time because of CVE-2026-34486. The flaw affects the EncryptInterceptor component in Tomcat Tribes, with confidentiality impact due to the lack of encryption in the cluster channel. CISA added it to KEV on August 4 and set a remediation deadline of August 7 for US federal agencies.

The relevant regional detail comes from CTIR Gov.br. Alert 67/2026, published on August 5, linked the vulnerability to Tomcat and stressed its criticality for infrastructure used in Brazil. At the same time, Cybersecurity News underscored the urgency of applying Apache mitigations in clusters and environments with Apache Tribes enabled, a very common setup in institutional portals and business applications.

Barr Cyber added an important nuance, KEV appeared four months after corrected versions had already been available in April. That gap between patch release and active exploitation is one of the month’s constants. There was no shortage of technical fixes, only delay in applying them, and attackers took advantage of that delay.

In impact terms, the flaw does not break integrity or availability according to the cited analysis, but it does expose sensitive traffic between cluster nodes. In environments where Tomcat supports authentication flows, portals, or internal backends, reading that traffic in cleartext can open the door to later movement, session theft, or mapping the internal architecture.

CVE-2026-73570 in Zimbra Collaboration Suite

Zimbra was another major focus in August. CVE-2026-73570, an OS command injection classified as high severity by NVD and actively exploited in the wild, affected versions earlier than 10.1.20 when the zimbra-snmp package is installed and SNMP is enabled. The sources agree that there was confirmed exploitation and proof-of-concept testing.

The publication sequence shows growing urgency. CERT Polska confirmed active exploitation, CISA added the flaw to KEV and set a correction deadline, and SecurityWeek reported that actors were targeting Zimbra servers in active campaigns. CERT Santé in France also issued an advisory that precisely defined the vulnerable configurations. The picture is clear: only part of Zimbra deployments were exposed, but that subset was enough to make the vulnerability a priority.

For Latin America, Zimbra remains relevant in email and collaboration across public-sector organizations, universities, and mid-sized businesses. SCWorld attributed campaigns linked to Russian APT groups against targets in Brazil and Argentina, raising the profile of the case beyond a simple technical flaw. The technical pattern described by Dev.to shows that exploitation relies on a manipulated SMTP request that ends up executing commands with the privileges of the zimbra user.

The most delicate operational detail is that the vulnerability does not necessarily require prior credentials. If the optional package is present and SNMP notifications are enabled, the attacker can reach remote code execution through an entry point that appears unrelated to email. That mix of auxiliary surface and main effect is exactly the kind of issue that takes time to detect in production.

CVE-2026-59270 in Spring Security

Spring Security appeared with a critical vulnerability in its embedded UnboundID LDAP server. CVE-2026-59270 has CVSS 9.4, requires only remote access to the exposed LDAP port, and needs neither prior credentials nor user interaction. HeroDevs, HunCERT/NKI, Mallory, and Berigo all agreed on the exposure of the administrative DN and the possibility of authenticating with a known account.

The operational risk is high because the flaw affects CI/CD, testing, and deployment environments where the embedded LDAP is often left accessible by mistake. On August 21 and 22, INCIBE-CERT published its critical advisories, and Moncloa detailed the affected branches along with the patched versions. The response was quick and useful, but it also exposed an uncomfortable reality: a flaw in a widely used security component can spread across multiple applications and pipelines without the owner team noticing right away.

The technical material adds a second layer of interest. The Russian source 1275.ru said the flaw could bypass WebAuthn mechanisms when that embedded LDAP is trusted for authentication. That is not a regional campaign detail, but it is a design warning, if a test server ends up exposed in production, a vulnerability in an internal layer can become a break in strong authentication.

HeroDevs also noted that Spring’s August release batch delivered 91 CVEs in a single day, but CVE-2026-59270 was the only critical one. That helps prioritize, because it keeps the noise from the volume from hiding the flaw that actually demands immediate attention.

CVE-2026-19586 in TP-Link Omada

TP-Link Omada entered the radar through CVE-2026-19586, a pre-auth command injection in gateways configured as an OpenVPN server. Technical material from CTI Pilot and Blogspan describes a scenario in which data sent during connection setup reaches command execution before authentication is completed, affecting 18 models and carrying CVSS 9.3 severity.

The regional relevance is obvious. Remote access gateways are part of hybrid work and distributed administration in Latin America, and many organizations rely on network equipment that can be managed from the internet. When a flaw like this appears in an access device, the impact can be greater than on an application server because the entire perimeter becomes compromised.

CTI Pilot dated the advisory to August 20 and stressed that the vulnerability is truly pre-authentication. That distinction matters because it removes the false sense of security often provided by user or credential controls: the attacker does not need an account to reach the vulnerable point. In an environment with an exposed VPN, the problem shifts to the network edge, exactly where many organizations reduce monitoring.

CVE-2026-16812 in VMware VeloCloud Orchestrator

VMware VeloCloud Orchestrator appeared as another confirmed real-world exploitation case. SecurityOnline.info reported that CVE-2026-16812 affects privileged internal functions and is listed in KEV, with active exploitation. Although the regional material does not break out a specific country for this flaw, its presence helps explain why network infrastructure and virtualization segments remained under pressure throughout August.

The case adds to the July VMware comparison baseline, where the regional ecosystem had already shown sensitivity to flaws in vCenter and other products from the vendor. That continuity confirms a broader reading, administration and orchestration platforms remain preferred targets because they concentrate privileges and because a single breach affects multiple assets.