The Daily CVE Update

Three CVSS 10.0 vulnerabilities landed in Adobe Campaign Classic within 24 hours, all enabling unauthenticated remote code execution. Attackers are actively exploiting an authentication bypass in the WordPress miniOrange SAML plugin that grants full administrator access without credentials. CISA has confirmed active exploitation of a Gitea code injection flaw that allows attackers with repository write access to execute arbitrary commands. This episode examines why these vulnerabilities matter to UK small businesses even when the affected software isn’t directly deployed in-house. Corrine explains how supply chain relationships with marketing agencies, MSPs, and web developers create exposure, outlines the GDPR accountability implications, and provides specific remediation steps including supplier verification questions, WordPress plugin audit procedures, and Gitea access controls.

This episode examines five critical vulnerabilities published within 24 hours, all scoring CVSS 9.4 or above. Four CVEs affect justhtml, a Python HTML sanitisation library, exposing bypass techniques including encoded malicious URLs, mixed-case tag names, and downstream Markdown conversion flaws. The fifth, CVE-2026-78207, concerns exceljs-hardened, a Node.js spreadsheet library vulnerable to prototype pollution through malicious cell notes. Corrine explains the practical attack scenarios, including unauthenticated file upload exploitation, and provides clear remediation steps. The episode emphasises supply chain visibility, noting that while these vulnerabilities are not currently on CISA’s Known Exploited Vulnerabilities catalogue, they represent genuine risk for small businesses with affected dependencies. Guidance covers patch priorities, GDPR reporting obligations for sanitisation failures, and practical steps for establishing software inventory and NVD notification processes without significant cost.

On 20 August 2026, CISA confirmed active exploitation of two TrueConf Server vulnerabilities allowing unauthenticated remote code execution. The same day, Microsoft disclosed four separate CVSS 10.0 vulnerabilities affecting Exchange Online, Entra ID, Azure Arc, and Azure Managed Instance for Apache Cassandra. Meanwhile, six million WordPress sites face exposure through a critical unauthenticated file upload flaw in Elementor Pro. For UK small businesses, these disclosures highlight a consistent pattern: the attack surface extends beyond directly owned infrastructure to suppliers, cloud services, and website platforms. This episode examines each vulnerability in detail, explains the supply chain implications, and provides five actionable steps to assess exposure before the end of the week. Whether your risk sits with an MSP running TrueConf, a WordPress site built years ago and quietly forgotten, or a Microsoft 365 tenant with no audit logging enabled, the common thread is visibility and ownership. Without knowing what’s in your environment, who is responsible for patching, and whether anyone is reviewing the logs, you cannot defend it. This episode makes the business case for addressing these gaps and offers practical guidance grounded in the Cyber Essentials standard and UK GDPR obligations.

This episode examines three concurrent exploitation campaigns targeting UK small business infrastructure in August 2026. First, CVE-2026-18577 in N-able N-central RMM software, which grants unauthenticated administrative access to MSP management consoles and, by extension, every client system they control. Second, Operation CameraSwarm, a coordinated campaign that compromised over 14,530 Dahua CCTV devices using five-year-old unpatched vulnerabilities and default credentials. Third, CVE-2026-33824, a critical Windows IKE vulnerability patched in April 2026 but added to CISA’s Known Exploited Vulnerabilities catalogue in August following confirmed active exploitation. Corrine analyses the common thread: attackers are systematically targeting outsourced infrastructure that businesses stop monitoring after deployment. The episode provides specific remediation steps, including how to request patch compliance documentation from managed service providers, how to audit CCTV firmware versions, and how to verify Windows patch status against the CISA KEV catalogue. Practical guidance is given on converting threat intelligence into procurement advantages and compliance evidence for Cyber Essentials certified businesses.

Three critical vulnerabilities confirmed as actively exploited demand immediate attention from UK small businesses. CVE-2026-55040 allows unauthenticated attackers to bypass SharePoint authentication entirely, no credentials required. CVE-2026-65400 lets attackers on your local network gain full control of unpatched Macs through Screen Sharing without valid credentials. CVE-2026-24301, now patched, demonstrated how a single crafted link could silently exfiltrate data from Microsoft Copilot Personal. Corrine walks through the practical threat model for each vulnerability, why CISA’s Known Exploited Vulnerabilities catalogue additions matter, and the specific actions UK small businesses must take today: patch SharePoint or restrict access immediately, update all Macs to macOS Tahoe 26.6.2, verify Copilot versions and audit connected services. This episode emphasises the gap between Cyber Essentials compliance timelines and the reality of active exploitation, the false security of local network restrictions, and the emerging attack surface created by AI tools with broad data access.

This episode examines two active cybersecurity threats affecting UK small businesses: CVE-2026-15748, a critical unauthenticated remote code execution vulnerability in the Forminator Forms WordPress plugin with over 600,000 installations, and Evooo1Bot, a Linux botnet targeting unpatched routers and edge devices using decade-old vulnerabilities. Corrine explains how both threats exploit the absence of basic patching practices, why automated scanning makes business size irrelevant as a defence, and provides practical steps for checking WordPress plugin versions and router firmware. The episode connects these immediate threats to broader patterns covered throughout the series, including Cyber Essentials requirements, UK GDPR obligations when breached through known vulnerabilities, and the commercial value of demonstrable security hygiene. With clear instructions for non-technical business owners and guidance on engaging IT providers, the briefing translates intelligence feed data into actionable tasks that cost nothing but demand attention today.

Three critical security vulnerabilities with publicly available exploit code were disclosed on 16 August 2026, requiring immediate action from UK small businesses. This episode covers CVE-2026-19959 and CVE-2026-19961 affecting Edimax EW-7478APC routers (both scoring 9.9 on the CVSS scale), CVE-2026-16098 in the ProSolution WP Client WordPress plugin enabling unauthenticated file upload, CVE-2026-18432 in Frontend Admin by DynamiApps allowing privilege escalation to administrator level, and CVE-2026-59310, a directory traversal flaw in VMware vCenter Server. Corrine explains what each vulnerability means in practical terms, who is affected, and provides specific actions for business owners: checking router models, auditing WordPress plugins, and questioning managed service providers about vCenter patching status. The episode emphasises the distinction between theoretical vulnerabilities and those with active exploits, the importance of documented remediation actions for UK GDPR Article 32 compliance, and the supply chain risks inherent in third-party infrastructure management.

Two critical vulnerabilities demand immediate attention from UK small businesses. WordPress plugins Fluent Forms Pro and Ninja Tables Pro were distributed with backdoored updates that bypass authentication, establish hidden API endpoints, and persist even after plugin removal (CVE-2026-73532 and CVE-2026-73533, both rated CVSS 9.8). Separately, Microsoft SharePoint faces active exploitation after proof-of-concept code emerged for an authentication bypass vulnerability (CVE-2026-55040), which when combined with CVE-2026-63520 enables unauthenticated remote code execution. Both threats were preventable through basic operational hygiene: verifying plugin sources and applying available patches. UK businesses running WordPress must check for unexpected PHP files in mu-plugins and uploads directories, audit administrator accounts, and verify clean backups. Those with on-premises SharePoint installations must confirm patch status immediately, particularly if working towards Cyber Essentials certification. The episode examines the compressed exploitation timeline, UK GDPR implications, and specific remediation steps for each vulnerability.

In today’s episode of The Daily CVE Update, Corrine explores critical vulnerabilities affecting UK small businesses. With cybercriminals casting wider nets, businesses must remain vigilant. We delve into Spikster’s unprotected API routes, scoring 9.8 on the CVSS, and the consequences of such vulnerabilities. Attention then shifts to IBM’s App Connect Enterprise and WebMethods Integration, both grappling with severe directory traversal risks. WordPress also faces challenges with the CVE-2026-63030 flaw. The episode highlights the importance of seeing vulnerabilities as opportunities for reinforcing security and building trust. Corrine urges listeners to discuss these issues with their boards, align with the National Cyber Security Centre’s guidance, and take actionable steps to secure their systems and educate their teams.

In this episode of The Daily CVE Update, Corrine Jefferson discusses critical vulnerabilities in IBM WebSphere, which pose a severe risk to small UK businesses. With vulnerabilities like CVE-2026-14512 allowing remote attackers to bypass authentication and CVE-2026-14446 enabling privilege escalation, the potential threat to IT infrastructure is significant. Corrine highlights the practical steps businesses must take to mitigate these risks, including prompt patch updates and reassessing IT security measures. The episode also explores other notable threats such as JetBrains TeamCity and Baseboard Management Controllers. Corrine emphasizes the competitive advantage proactive security measures can offer, urging executives to prioritise cybersecurity to ensure customer trust and regulatory compliance. Listeners are encouraged to make regular security updates a routine and foster a security-first culture within their organisations.