Today’s digest is about how little runway “disclosed” buys you now: a firewall flaw with a same-day federal deadline, a geospatial platform under attack within hours of a researcher’s post, an e-commerce bug exploited before most admins had read the advisory, and a shipping vendor’s Metabase breach still naming new victims a week later. Here’s what changed since yesterday’s digest.
Vulnerability watch: A Cisco ASA/FTD firewall flaw hits its CISA remediation deadline today, and there’s no workaround
CVE-2026-20349 (CVSS 8.6), disclosed by Cisco on August 11, lets an unauthenticated attacker crash a Secure Firewall ASA or FTD appliance with a single crafted HTTP request against the Remote Access SSL VPN service — no credentials, no user interaction, low attack complexity. The root cause is inadequate error checking while the device processes VPN HTTP requests, and it affects any ASA or FTD box running remote-access services: SSL VPN, IKEv2 remote access with client services, or Zero Trust Network Access on FTD. Cisco’s PSIRT confirmed active exploitation this month, CISA added the flaw to its Known Exploited Vulnerabilities catalog, and the remediation deadline for federal civilian agencies is today, August 14. Cisco shipped hot fixes covering ASA 9.16 through 9.24 and FTD 7.0 through 10.0, and states plainly that no workaround fully addresses the issue. BleepingComputer · The Hacker News · SecurityWeek
If today’s deadline just reminded you an ASA or FTD box is still unpatched, treat it as urgent regardless of whether you’re a federal agency — a firewall that can be crashed remotely with one HTTP request, with confirmed in-the-wild exploitation, is a denial-of-service risk for every VPN user behind it. Apply the hot fix for your version line now, and since there’s no workaround, don’t wait for a maintenance window to open.
Vulnerability watch: An unpatched GeoServer SQL injection zero-day is under active attack within hours of public disclosure
A researcher publishing as @q1uf3ng disclosed an unauthenticated SQL injection flaw in GeoServer’s jsonArrayContains function on August 12 at 10:46 UTC, and exploitation attempts began within hours — hundreds of probe requests from a small pool of IP addresses, most currently triggering errors rather than completing a full compromise. GeoServer is the open-source geospatial data platform widely used behind mapping and GIS services; when its backing database runs with elevated permissions (for example, an sa account on Microsoft SQL Server), the SQL injection escalates directly to remote code execution. As of publication, there’s no official patch — this is a genuine zero-day, not a slow-to-deploy fix. The Hacker News · CSO Online · Cybersecurity News
Inventory any internet-exposed GeoServer instances today and pull them off public access if you can — there’s no patch to fall back on yet. If you can’t take an instance offline, check whether its database connection runs with admin-level permissions and scope that down, and grep access logs for jsonArrayContains requests you didn’t generate; the probing wave is loud enough to leave a clear trail.
Vulnerability watch: Adobe Commerce’s account-takeover bug was targeted before most admins had read the advisory
Adobe’s August 11 bulletin APSB26-92 fixed seven vulnerabilities in Adobe Commerce and Magento Open Source, five of them critical — the standout is CVE-2026-71362 (CVSS 9.1), an authorization flaw where the platform fails to correctly bind a customer’s identity to their session, letting an attacker switch a live session to a different customer’s account. No existing account, admin privileges, or user interaction is required. Security firm Sansec confirmed active exploitation attempts within hours of the advisory going public — before many store operators had even applied the fix. Affected lines are Adobe Commerce 2.4.4 through 2.4.9 and Magento Open Source 2.4.6 through 2.4.9 on builds prior to the August 2026 update. SecurityWeek · Sansec
If you run Adobe Commerce or Magento Open Source, the August update isn’t optional maintenance at this point — attackers were already testing it against live stores the same day it shipped. Once patched, review recent account activity for session anomalies (an order or address change immediately following a session that doesn’t match the customer’s usual login pattern is the tell) since exploitation here doesn’t require a password to steal an account.
Also noted: Trezor becomes the latest named victim in this month’s Metabase breach wave
Hardware wallet maker Trezor disclosed that a breach at ShipMonk, its shipping and fulfillment vendor, exposed contact details for roughly 13,700 customers who ordered between May 10 and August 8 — names, emails, and for most of them, phone numbers and shipping addresses. ShipMonk says the intrusion traces back to the same critical Metabase SQL injection zero-day covered in this digest on August 10, which also hit Framework and Tally. Trezor’s wallets, firmware, and seed data were never touched — this is a shipping-vendor breach, not a product compromise — but the company is warning customers about targeted phishing using the leaked shipping details. BleepingComputer · The Block
This is the fallout curve you should expect from any unpatched-vendor breach: new named victims keep surfacing for weeks as attackers work through what they exfiltrated. If any of your fulfillment, support, or analytics vendors ran Metabase, don’t wait for them to name you — ask directly whether they were affected and treat any shared customer contact data as exposed until you hear otherwise.
Final thought
Every vulnerability item today shares the same shape: the gap between disclosure and exploitation has collapsed to hours, not days. That means patch cadence built around a weekly or biweekly review cycle is no longer fast enough for critical, unauthenticated flaws in internet-facing systems — GeoServer and Adobe Commerce were both hit before most teams finished reading the advisory. Prioritize a same-day triage path for anything unauthenticated and remotely exploitable, and pair it with the Trezor lesson: when a vendor you depend on discloses a breach, check your own exposure immediately rather than waiting to be named. If you want help building faster patch-to-detection workflows, see our how-to guides or book a discovery call.