Daily briefing · August 23, 2026
Calm Day Masks Persistent Threats: Critical Authentication Bypass and Privilege Escalation Flaws Headline August 23
Automated Vexday summary · sources: NVD, CISA KEV, EPSS
Verdict of the day — calm
August 23 registers as a calm day with no vulnerabilities in active exploitation and no confirmed weaponized exploits, yet eight critical-severity CVEs demand attention — several with public proof-of-concept code already available. The day's highlights span improper authentication in network hardware, privilege escalation in Kubernetes operators, stack-based buffer overflows, and multiple sanitization bypass issues in widely-used libraries. Defenders should treat the absence of confirmed exploitation not as a green light, but as a shrinking window to patch before threat actors act.
Today’s brief
- No active exploitation (KEV) recorded on August 23, but 8 critical CVEs were published — several with public PoC
- Authentication bypass flaws in ipTIME network switches (CVSS 10.0 and 9.3) and buffer overflows in UTT HiPER routers carry remote exploitation risk
- StackGres operator privilege escalation (CVSS 9.9) allows low-privilege tenants to gain full admin access — high-impact for Kubernetes environments
- Brazilian healthcare sector targeted by ransomware group kazu; thegentlemen hit UOLconsult — ransomware pressure on BR remains elevated
Critical highlights
1
A CVSS 10.0 improper authentication flaw in the EFM ipTIME T16000M Session Validation Handler is fully remotely exploitable, with a public exploit already available — any unauthenticated attacker can bypass session controls on this enterprise-grade switch, making immediate isolation or firmware update the only safe options.
2
A privilege escalation vulnerability in the StackGres Kubernetes operator allows a low-privilege database tenant to elevate to administrator — environments running multi-tenant StackGres deployments should treat this as an urgent patch, as database tenants commonly represent semi-trusted or externally-facing accounts.
3
A stack-based buffer overflow in the UTT HiPER 1250GW HTTP Request Handler is remotely exploitable via a crafted Profile argument, with a public exploit now circulating — this class of flaw typically enables arbitrary code execution or device takeover on embedded network appliances.
4
Mirroring CVE-2026-78167, the EFM ipTIME T24000M carries the same improper authentication weakness in its session validation logic with a public exploit available and no vendor response on record — exposure of management interfaces to untrusted networks represents a direct compromise risk.
5
A prototype pollution vulnerability in exceljs-hardened's deepMerge helper allows attackers to corrupt Object.prototype by injecting malicious keys through crafted cell note JSON — applications processing untrusted Excel files are at risk of logic subversion or remote code execution depending on downstream usage.
6
justhtml versions up to 1.11.0 fail to escape angle brackets in text nodes during Markdown conversion, meaning attacker-controlled input that appears safe in HTML output can smuggle active content through the to_markdown() path — applications relying on this conversion for safe content rendering should upgrade to 1.12.0 immediately.
7
Multiple HTML sanitization bypass issues in justhtml before 1.16.0 allow script or style content to survive sanitization under advanced usage patterns, including reuse of policy objects — organizations using customized sanitization policies are most exposed and should audit their sanitizer configurations alongside upgrading.
8
justhtml before 1.15.0 contains compounding sanitization failures across URL helpers, HTML serialization, and Markdown passthrough — attackers can chain these to inject JavaScript via encoded URLs or backslash bypasses, and the breadth of affected code paths makes configuration-level mitigations unreliable without patching.
9
A remotely exploitable buffer overflow in the UTT HiPER 1200GW via the ssid argument has a published exploit, placing this older device model at risk of code execution — if replacement is not feasible, restricting HTTP management access to trusted network segments is a critical compensating control.
10
A path traversal flaw in exceljs-hardened's Workbook.addImage() allows attackers to supply arbitrary file paths and embed any file accessible to the Node.js process into a generated workbook — this effectively becomes a server-side file read vulnerability in any application that processes user-supplied image paths.
Ransomware today
The ransomware group kazu recently claimed two Brazilian victims in the healthcare sector: Brazil Mobilemed, a Cloud PACS platform, and Meducar, a telemedicine and patient management system — both sensitive targets given the nature of medical imaging and patient data they handle. The group thegentlemen added UOLconsult, a professional services firm, to its list. Over the past 30 days, Section9 and thegentlemen have been the most active groups targeting Brazil, each with six confirmed victims, followed by Global Secret Group with four.
Brazil Mobilemed: Cloud PACS Platform BRkazu · Healthcare
Meducar: Telemedicine and Patient Management System BRkazu · Healthcare
UOLconsult BRthegentlemen · Professional Services
Section9 6thegentlemen 6Global Secret Group 4direwolf 2L Group 2kazu 2
Active groups & APTs
Several threat actor groups are currently being tracked as active or recently updated, including dragonforce, funksec, kairos, karakurt, kazu, and the Iranian-linked group blackshadow. While no new confirmed victims are attributed to these actors in the current reporting window, their continued activity signals ongoing reconnaissance and targeting operations that defenders should account for, particularly given the overlap with known Brazilian victims.
Brazil focus
Brazil continues to face significant ransomware pressure across multiple sectors in the past 30 days. Beyond the fresh healthcare hits by kazu, the country has seen attacks on government (Prefeitura Municipal de Arcos by emperador), technology firms (TOTVS by direwolf, tecnoabi.com by m3rx), legal services (VR Advogados by Barracuda), and Vermont XCenter by dragonforce — a breadth of targeting that indicates Brazilian organizations remain a high-priority region for ransomware operators regardless of industry vertical.
Meducar: Telemedicine and Patient Management Systemkazu · Healthcare
Brazil Mobilemed: Cloud PACS Platformkazu · Healthcare
UOLconsultthegentlemen · Professional Services
Prefeitura Municipal de Arcosemperador · Government & Defense
Vermont XCenterdragonforce
VR AdvogadosBarracuda · Professional Services
TOTVSdirewolf · Technology
tecnoabi.comm3rx · Technology
Today’s recommendation: Prioritize patching the ipTIME authentication bypass flaws (CVE-2026-78167 and CVE-2026-78168) and the StackGres privilege escalation (CVE-2026-78155) immediately, as these carry the highest CVSS scores and are either already publicly exploited or trivially reproducible; simultaneously audit all justhtml and exceljs-hardened deployments to ensure version thresholds are met, particularly where user-supplied content is processed.
The breadth of today's critical CVEs across network hardware, cloud-native operators, and developer libraries is a reminder that knowing which of these components exist in your environment — and whether they face the internet or handle untrusted input — is the first step to meaningful risk reduction.Before an attacker finds it, find it first: run a free initial exposure assessment and see whether your infrastructure is vulnerable to flaws like these.Meet the Autonomous AI Pentest Agent →Previous briefings
November 5, 2026 — BTCPay Server macaroon leak leads a day of critical flaws, with a Juneau cluster and heavy ransomware pressure in BrazilNovember 4, 2026 — Sogou Input Method flaw seen exploited before CISA, as critical router and AI-platform bugs pile upNovember 3, 2026 — Ivanti Connect Secure flaw under active exploitation as a wave of CVSS 10.0 router and Qihoo 360 bugs landsNovember 2, 2026 — WordPress RCE spotted by VulnCheck ahead of CISA leads a day of critical flaws in plugins, routers and enterprise accessNovember 1, 2026 — Quiet KEV Day, but a Wave of CVSS 10.0 Flaws Hits WAVLINK, Linksys and AI SandboxesOctober 31, 2026 — WordPress Plugins Under Fire: Four Flaws Seen Exploited Before CISA ConfirmationOctober 30, 2026 — Five CVEs seen exploited before CISA, led by a critical Dahua RCE and a Gravity Forms flawOctober 29, 2026 — Calm day on the KEV front, but critical flaws in WS_FTP, Langflow and WordPress plugins demand attentionOctober 28, 2026 — Early VulnCheck Warnings on a WooCommerce Plugin and Cisco ASA Lead a Day of Critical FlawsOctober 27, 2026 — Adobe Campaign Classic Hit by a Wave of Critical Flaws as VulnCheck Flags Early ExploitationOctober 26, 2026 — Calm day on the KEV front, but a wave of 10.0 CVSS flaws demands attentionOctober 25, 2026 — Quiet KEV Day, but Authentication Bypasses and Unauthenticated Flaws Lead the DisclosuresOctober 24, 2026 — Calm day on the exploitation front, but critical deserialization and injection flaws pile up in WordPress plugins and PostizOctober 23, 2026 — Calm day on the exploitation front, but critical flaws in Wasmtime, Postiz and LMS platforms demand patchingview full archive →