{"schema_version":1,"title":"Newly exploited vulnerabilities: week of 17 to 23 August 2026 (week 34)","summary":"In the week of 17 to 23 August 2026, 9 vulnerabilities were newly recorded as exploited in the wild, 9 of them critical. The technology hit most was TrueConf Server (2), followed by Apple macOS (1) and Broadcom vCenter Server (1).","url":"https://junglewise.ai/threats/exploited/2026-08-17","json_url":"https://junglewise.ai/threats/exploited/2026-08-17.json","publisher":"Junglewise Threat Intelligence","license":"CC-BY-4.0","license_url":"https://creativecommons.org/licenses/by/4.0/","attribution":"Junglewise Threat Intelligence, https://junglewise.ai/threats/exploited/2026-08-17","sources":"NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories","method":"A vulnerability is exploited in the wild when the CISA Known Exploited Vulnerabilities catalogue lists it or a vendor advisory says so; exploited_since is CISA's date added where it came from the catalogue, else the day Junglewise learned of it.","kind":"exploited_week","total":9,"period":{"end":"2026-08-23","start":"2026-08-17"},"critical":9,"generated_at":"2026-10-02T19:23:09.012711+00:00","technologies":[{"hub":true,"name":"TrueConf Server","slug":"trueconf-server","vulnerabilities":2,"url":"https://junglewise.ai/threats/technologies/trueconf-server"},{"hub":true,"name":"Apple macOS","slug":"macos-tahoe","vulnerabilities":1,"url":"https://junglewise.ai/threats/technologies/macos-tahoe"},{"hub":true,"name":"Broadcom vCenter Server","slug":"vcenter-server","vulnerabilities":1,"url":"https://junglewise.ai/threats/technologies/vcenter-server"},{"hub":false,"name":"Broadcom Vmware Vcenter","slug":"vmware-vcenter","vulnerabilities":1},{"hub":false,"name":"Microsoft Internet Key Exchange (Ike) Service Extensions","slug":"internet-key-exchange-ike-service-extensions","vulnerabilities":1},{"hub":false,"name":"Microsoft Internet Key Exchange Service Extensions","slug":"internet-key-exchange-service-extensions","vulnerabilities":1},{"hub":true,"name":"Microsoft SharePoint","slug":"sharepoint","vulnerabilities":1,"url":"https://junglewise.ai/threats/technologies/sharepoint"},{"hub":true,"name":"Microsoft SharePoint Enterprise Server 2016","slug":"sharepoint-enterprise-server-2016","vulnerabilities":1,"url":"https://junglewise.ai/threats/technologies/sharepoint-enterprise-server-2016"},{"hub":true,"name":"Microsoft SharePoint Server 2019","slug":"sharepoint-server-2019","vulnerabilities":1,"url":"https://junglewise.ai/threats/technologies/sharepoint-server-2019"},{"hub":true,"name":"Microsoft SharePoint Server Subscription Edition","slug":"sharepoint-server-subscription-edition","vulnerabilities":1,"url":"https://junglewise.ai/threats/technologies/sharepoint-server-subscription-edition"},{"hub":true,"name":"Microsoft Windows 10","slug":"windows-10","vulnerabilities":1,"url":"https://junglewise.ai/threats/technologies/windows-10"},{"hub":true,"name":"Microsoft Windows 11","slug":"windows-11","vulnerabilities":1,"url":"https://junglewise.ai/threats/technologies/windows-11"},{"hub":true,"name":"Mlflow","slug":"mlflow-mlflow","vulnerabilities":1,"url":"https://junglewise.ai/threats/technologies/mlflow-mlflow"},{"hub":true,"name":"mlflow (PyPI)","slug":"mlflow","vulnerabilities":1,"url":"https://junglewise.ai/threats/technologies/mlflow"},{"hub":true,"name":"ray (PyPI)","slug":"ray","vulnerabilities":1,"url":"https://junglewise.ai/threats/technologies/ray"}],"vulnerabilities":[{"cve":"CVE-2026-73570","cvss":9.8,"epss":0.1174,"slug":"cve-2026-73570-zimbra-collaboration-suite-os-command-injection-in-smtp","title":"Zimbra Collaboration Suite OS command injection in SMTP","severity":"critical","exploited":true,"published_at":"2026-08-21T00:00:00+00:00","technologies":[{"hub":true,"name":"Zimbra-Collaboration-Suite","slug":"collaboration","vendor":{"name":"Zimbra","slug":"zimbra"}},{"hub":true,"name":"Synacor Zimbra Collaboration Suite (ZCS)","slug":"zimbra-collaboration-suite-zcs","vendor":{"name":"Synacor","slug":"synacor"}}],"exploited_since":"2026-08-21T00:00:00+00:00","url":"https://junglewise.ai/threats/cve-2026-73570-zimbra-collaboration-suite-os-command-injection-in-smtp"},{"cve":"CVE-2026-72530","cvss":9,"epss":0.0169,"slug":"cve-2026-72530-trueconf-server-code-injection-vulnerability","title":"A remote unauthorized attacker with network access via port 4307/TCP to the TrueConf server versions 5.3.X to 5.3.9, 5.4.X to 5.4.9, 5.5.X t","severity":"critical","exploited":true,"published_at":"2026-08-19T17:21:01.13+00:00","technologies":[{"hub":true,"name":"TrueConf Server","slug":"trueconf-server","vendor":{"name":"Trueconf","slug":"trueconf"}}],"exploited_since":"2026-08-20T00:00:00+00:00","url":"https://junglewise.ai/threats/cve-2026-72530-trueconf-server-code-injection-vulnerability"},{"cve":"CVE-2026-72529","cvss":9.8,"epss":0.0146,"slug":"cve-2026-72529-trueconf-server-missing-authentication-for-critical-function","title":"A remote unauthorized attacker with network access via port 4307/TCP to the TrueConf server versions 5.3.X to 5.3.9, 5.4.X to 5.4.9, 5.5.X t","severity":"critical","exploited":true,"published_at":"2026-08-19T17:21:00.99+00:00","technologies":[{"hub":true,"name":"TrueConf Server","slug":"trueconf-server","vendor":{"name":"Trueconf","slug":"trueconf"}}],"exploited_since":"2026-08-20T00:00:00+00:00","url":"https://junglewise.ai/threats/cve-2026-72529-trueconf-server-missing-authentication-for-critical-function"},{"cve":"CVE-2026-64849","cvss":9.3,"epss":0.0984,"slug":"cve-2026-64849-mlflow-server-side-request-forgery","title":"MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. Prior to 3.15.0, the unauth","severity":"critical","exploited":true,"published_at":"2026-08-17T22:17:23.58+00:00","technologies":[{"hub":true,"name":"mlflow (PyPI)","slug":"mlflow","vendor":{"name":"PyPI","slug":"pypi"}},{"hub":true,"name":"Mlflow","slug":"mlflow-mlflow","vendor":{"name":"MLflow","slug":"mlflow"}}],"exploited_since":"2026-08-19T00:00:00+00:00","url":"https://junglewise.ai/threats/cve-2026-64849-mlflow-server-side-request-forgery"},{"cve":"CVE-2026-65400","cvss":9.8,"epss":0.0122,"slug":"cve-2026-65400-apple-macos-screen-sharing-authentication-bypass","title":"An authentication issue was addressed with improved state management. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.7.9, mac","severity":"critical","exploited":true,"published_at":"2026-08-06T22:18:14.533+00:00","technologies":[{"hub":true,"name":"Apple macOS","slug":"macos-tahoe","vendor":{"name":"Apple","slug":"apple"}}],"exploited_since":"2026-08-18T00:00:00+00:00","url":"https://junglewise.ai/threats/cve-2026-65400-apple-macos-screen-sharing-authentication-bypass"},{"cve":"CVE-2026-59310","cvss":9.8,"epss":0.0257,"slug":"cve-2026-59310-vmware-vcenter-directory-traversal-in-syslog-server","title":"VMware vCenter directory traversal in Syslog server","severity":"critical","exploited":true,"published_at":"2026-07-30T13:16:53.993+00:00","technologies":[{"hub":true,"name":"VMware Cloud Foundation","slug":"cloud-foundation","vendor":{"name":"VMware","slug":"vmware"}},{"hub":true,"name":"Broadcom vCenter Server","slug":"vcenter-server","vendor":{"name":"Broadcom","slug":"broadcom"}},{"hub":false,"name":"Broadcom Vmware Vcenter","slug":"vmware-vcenter","vendor":{"name":"Broadcom","slug":"broadcom"}},{"hub":true,"name":"VMware vSphere Foundation","slug":"vsphere-foundation","vendor":{"name":"VMware","slug":"vmware"}}],"exploited_since":"2026-08-18T00:00:00+00:00","url":"https://junglewise.ai/threats/cve-2026-59310-vmware-vcenter-directory-traversal-in-syslog-server"},{"cve":"CVE-2026-55040","cvss":9.1,"epss":0.1754,"slug":"cve-2026-55040-microsoft-sharepoint-weak-authentication-security-feature-bypass","title":"Microsoft SharePoint weak authentication security feature bypass","severity":"critical","exploited":true,"published_at":"2026-07-14T18:18:15.413+00:00","technologies":[{"hub":true,"name":"Microsoft SharePoint","slug":"sharepoint","vendor":{"name":"Microsoft","slug":"microsoft"}},{"hub":true,"name":"Microsoft SharePoint Enterprise Server 2016","slug":"sharepoint-enterprise-server-2016","vendor":{"name":"Microsoft","slug":"microsoft"}},{"hub":true,"name":"Microsoft SharePoint Server 2019","slug":"sharepoint-server-2019","vendor":{"name":"Microsoft","slug":"microsoft"}},{"hub":true,"name":"Microsoft SharePoint Server Subscription Edition","slug":"sharepoint-server-subscription-edition","vendor":{"name":"Microsoft","slug":"microsoft"}}],"exploited_since":"2026-08-18T00:00:00+00:00","url":"https://junglewise.ai/threats/cve-2026-55040-microsoft-sharepoint-weak-authentication-security-feature-bypass"},{"cve":"CVE-2026-33824","cvss":9.8,"epss":0.0162,"slug":"cve-2026-33824-microsoft-windows-double-free-in-ike-extension","title":"Microsoft Windows double free in IKE Extension","severity":"critical","exploited":true,"published_at":"2026-04-14T18:17:34.767+00:00","technologies":[{"hub":false,"name":"Microsoft Internet Key Exchange (Ike) Service Extensions","slug":"internet-key-exchange-ike-service-extensions","vendor":{"name":"Microsoft","slug":"microsoft"}},{"hub":false,"name":"Microsoft Internet Key Exchange Service Extensions","slug":"internet-key-exchange-service-extensions","vendor":{"name":"Microsoft","slug":"microsoft"}},{"hub":true,"name":"Microsoft Windows 10","slug":"windows-10","vendor":{"name":"Microsoft","slug":"microsoft"}},{"hub":true,"name":"Microsoft Windows 11","slug":"windows-11","vendor":{"name":"Microsoft","slug":"microsoft"}}],"exploited_since":"2026-08-18T00:00:00+00:00","url":"https://junglewise.ai/threats/cve-2026-33824-microsoft-windows-double-free-in-ike-extension"},{"cve":"CVE-2025-62593","cvss":8.8,"epss":0.6246,"slug":"cve-2025-62593-ray-project-ray-code-injection-vulnerability","title":"Ray is an AI compute engine. Prior to version 2.52.0, developers working with Ray as a development tool can be exploited via a critical RCE","severity":"critical","exploited":true,"published_at":"2025-11-26T23:15:47.927+00:00","technologies":[{"hub":true,"name":"ray (PyPI)","slug":"ray","vendor":{"name":"PyPI","slug":"pypi"}},{"hub":true,"name":"Ray-Project Ray","slug":"ray-project-ray","vendor":{"name":"Ray-Project","slug":"ray-project"}}],"exploited_since":"2026-08-17T00:00:00+00:00","url":"https://junglewise.ai/threats/cve-2025-62593-ray-project-ray-code-injection-vulnerability"}],"previous":{"key":"2026-08-10","top":"Cisco Adaptive Security Appliance Software","total":3,"period":{"end":"2026-08-16","start":"2026-08-10"},"critical":3,"url":"https://junglewise.ai/threats/exploited/2026-08-10"},"next":{"key":"2026-08-24","top":"Linux Kernel","total":11,"period":{"end":"2026-08-30","start":"2026-08-24"},"critical":11,"url":"https://junglewise.ai/threats/exploited/2026-08-24"}}