If you read nothing else
- Patch Metabase and N-able N-central now. Both were exploited in the wild.
- Microsoft's August Patch Tuesday fixed 42 Critical flaws and one zero-day attackers were already using.
- CMMC Phase 2 is suspended for a 60 day review, but Phase 1 self-assessments and DFARS 252.204-7012 still apply.
Six things from August. Each one says what happened, what it means for a small business or small defense supplier, and one thing to do. CISA added 31 vulnerabilities to its Known Exploited Vulnerabilities catalog that month, according to the CISA KEV feed, and several of them are below.
1. Microsoft's August Patch Tuesday included a zero-day in use
On August 11, Microsoft fixed 42 Critical vulnerabilities and three zero-days. One, CVE-2026-68820 (CVSS 7.0), is a memory corruption flaw in the Windows WinSock driver that lets an attacker with access to a PC raise their privileges. Check Point said North Korean actors known as Lazarus used it to deploy malware. Source: BleepingComputer, August 11; CVSS from NVD.
What this means for you: an attacker who gets onto one PC can use this flaw to take it over.
Do this: on every Windows PC, open Settings, then Windows Update, install, restart, and check again until it says you are up to date.
2. Attackers used a zero-day against Metabase Cloud
CVE-2026-72898 (CVSS 10.0 in NVD) is an unauthenticated SQL injection in Metabase's password reset endpoint that can give an attacker administrator access. Metabase said Metabase Cloud was attacked through an unknown zero-day in versions 1.58 and above. CISA added the flaw to its exploited list on August 11. Sources: Metabase security update, August 6; NVD; CISA KEV feed.
What this means for you: a BI tool holds logins to the databases it reads, and CISA's catalog notes an attacker can steal those stored credentials.
Do this: if you run Metabase, upgrade to the fixed release listed in Metabase's post. If its reset password endpoint was publicly accessible, revoke sessions and rotate the database credentials.
3. N-able's N-central had a bypass, then an incomplete fix
N-able N-central had an authentication bypass, CVE-2026-18556, that a threat actor exploited to get remote administrative access without authentication. The first fix was incomplete, and CVE-2026-18577 (CVSS 8.1 in NVD) allowed account takeover. N-able says Hotfix 2 (2026.3.1.10), released August 6, supersedes the first hotfix. CISA added the two flaws on August 3 and August 4. Sources: N-able; NVD; CISA KEV feed.
What this means for you: if your IT provider manages your systems through N-central, the admin access they hold is the access attackers went after.
Do this: ask your IT provider in writing whether Hotfix 2 is installed and whether they have checked their N-central environment for compromise. N-able says a clean scan is not a guarantee.
4. Two linked PaperCut flaws reached CISA's list on August 31
PaperCut NG and MF have two linked flaws. CVE-2026-81578 (CVSS 9.8 in NVD) lets an unauthenticated remote attacker trigger administrative actions before access checks finish. CVE-2026-82078 (CVSS 9.1) can make the server run Java bytecode already on its classpath, and CISA's catalog says it can be chained with the first. CISA added both on August 31 with a September 14 due date for federal agencies. Sources: NVD; NVD; CISA KEV feed; PaperCut security bulletin, August 27.
What this means for you: a print server that can be reached from the internet is the exposed one to check first.
Do this: find out whether your PaperCut web interface can be reached from outside your network. If it can, apply the vendor's fix or mitigation today.
5. Zimbra's SNMP setting opened a command injection flaw
CVE-2026-73570 (CVSS 8.9 in NVD) is an unauthenticated command injection in Zimbra Collaboration Suite, reachable with crafted SMTP requests when the optional zimbra-snmp package is installed and SNMP notifications are enabled. Zimbra lists 10.1.20 as the fixed release. CISA added it to its exploited list on August 21. Sources: NVD; Zimbra security advisories; CISA KEV feed.
What this means for you: the attacker needs no login, only a network path to your mail server's SMTP service.
Do this: ask whoever runs your mail server whether it is on 10.1.20 or later, and whether SNMP notifications are switched on.
6. CMMC Phase 2 is suspended, and Phase 1 still applies
On July 13, the Department of War suspended CMMC Phase 2, which was scheduled for November 10, 2026, and launched a 60 day review. The department said all Phase 1 self-assessment requirements remain firmly in place. DFARS 252.204-7012 still applies to contractors whose agreements include it. Source: WilmerHale client alert, July 20.
What this means for you: your Level 1 and Level 2 self-assessments, SPRS posting and annual affirmation still apply while the review runs.
Do this: confirm your SPRS score and annual affirmation are current, and that the score matches your current System Security Plan.
Not sure where you stand? Cyber Grants Alliance offers in-kind CMMC Level 1 and CMMC Level 2 gap assessment grants, at no cost to you. See every program on Grant Programs.