# Newly exploited vulnerabilities: week of 17 to 23 August 2026 (week 34)

Source: https://junglewise.ai/threats/exploited/2026-08-17  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2 October 2026, 19:23 UTC. Final: it does not change.  
Data: https://junglewise.ai/threats/exploited/2026-08-17.json  
License: CC BY 4.0 with a link back

In the week of 17 to 23 August 2026, 9 vulnerabilities were newly recorded as exploited in the wild, 9 of them critical. The technology hit most was TrueConf Server (2), followed by Apple macOS (1) and Broadcom vCenter Server (1).

## Newly exploited this week

- [CVE-2026-73570: Zimbra Collaboration Suite OS command injection in SMTP](https://junglewise.ai/threats/cve-2026-73570-zimbra-collaboration-suite-os-command-injection-in-smtp) (critical, exploited in the wild, CVSS 9.8, exploited since 21 Aug 2026, published 21 Aug 2026)
- [CVE-2026-72530: A remote unauthorized attacker with network access via port 4307/TCP to the TrueConf server versions 5.3.X to 5.3.9, 5.4.X…](https://junglewise.ai/threats/cve-2026-72530-trueconf-server-code-injection-vulnerability) (critical, exploited in the wild, CVSS 9, exploited since 20 Aug 2026, published 19 Aug 2026)
- [CVE-2026-72529: A remote unauthorized attacker with network access via port 4307/TCP to the TrueConf server versions 5.3.X to 5.3.9, 5.4.X…](https://junglewise.ai/threats/cve-2026-72529-trueconf-server-missing-authentication-for-critical-function) (critical, exploited in the wild, CVSS 9.8, exploited since 20 Aug 2026, published 19 Aug 2026)
- [CVE-2026-64849: MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. Prior to…](https://junglewise.ai/threats/cve-2026-64849-mlflow-server-side-request-forgery) (critical, exploited in the wild, CVSS 9.3, exploited since 19 Aug 2026, published 17 Aug 2026)
- [CVE-2026-65400: An authentication issue was addressed with improved state management. This issue is fixed in macOS Golden Gate 27, macOS…](https://junglewise.ai/threats/cve-2026-65400-apple-macos-screen-sharing-authentication-bypass) (critical, exploited in the wild, CVSS 9.8, exploited since 18 Aug 2026, published 6 Aug 2026)
- [CVE-2026-59310: VMware vCenter directory traversal in Syslog server](https://junglewise.ai/threats/cve-2026-59310-vmware-vcenter-directory-traversal-in-syslog-server) (critical, exploited in the wild, CVSS 9.8, exploited since 18 Aug 2026, published 30 Jul 2026)
- [CVE-2026-55040: Microsoft SharePoint weak authentication security feature bypass](https://junglewise.ai/threats/cve-2026-55040-microsoft-sharepoint-weak-authentication-security-feature-bypass) (critical, exploited in the wild, CVSS 9.1, exploited since 18 Aug 2026, published 14 Jul 2026)
- [CVE-2026-33824: Microsoft Windows double free in IKE Extension](https://junglewise.ai/threats/cve-2026-33824-microsoft-windows-double-free-in-ike-extension) (critical, exploited in the wild, CVSS 9.8, exploited since 18 Aug 2026, published 14 Apr 2026)
- [CVE-2025-62593: Ray is an AI compute engine. Prior to version 2.52.0, developers working with Ray as a development tool can be exploited…](https://junglewise.ai/threats/cve-2025-62593-ray-project-ray-code-injection-vulnerability) (critical, exploited in the wild, CVSS 8.8, exploited since 17 Aug 2026, published 26 Nov 2025)

## Technologies hit most

1. [TrueConf Server](https://junglewise.ai/threats/technologies/trueconf-server): 2 vulnerabilities
2. [Apple macOS](https://junglewise.ai/threats/technologies/macos-tahoe): 1 vulnerability
3. [Broadcom vCenter Server](https://junglewise.ai/threats/technologies/vcenter-server): 1 vulnerability
4. Broadcom Vmware Vcenter: 1 vulnerability
5. Microsoft Internet Key Exchange (Ike) Service Extensions: 1 vulnerability
6. Microsoft Internet Key Exchange Service Extensions: 1 vulnerability
7. [Microsoft SharePoint](https://junglewise.ai/threats/technologies/sharepoint): 1 vulnerability
8. [Microsoft SharePoint Enterprise Server 2016](https://junglewise.ai/threats/technologies/sharepoint-enterprise-server-2016): 1 vulnerability
9. [Microsoft SharePoint Server 2019](https://junglewise.ai/threats/technologies/sharepoint-server-2019): 1 vulnerability
10. [Microsoft SharePoint Server Subscription Edition](https://junglewise.ai/threats/technologies/sharepoint-server-subscription-edition): 1 vulnerability
11. [Microsoft Windows 10](https://junglewise.ai/threats/technologies/windows-10): 1 vulnerability
12. [Microsoft Windows 11](https://junglewise.ai/threats/technologies/windows-11): 1 vulnerability
13. [Mlflow](https://junglewise.ai/threats/technologies/mlflow-mlflow): 1 vulnerability
14. [mlflow (PyPI)](https://junglewise.ai/threats/technologies/mlflow): 1 vulnerability
15. [ray (PyPI)](https://junglewise.ai/threats/technologies/ray): 1 vulnerability

## Sources

NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Newly exploited vulnerabilities: week of 17 to 23 August 2026 (week 34)", https://junglewise.ai/threats/exploited/2026-08-17, 2 October 2026.