AI Weekly Malaysia

Attackers are actively exploiting CVE-2026-59310 (CVSS 9.8), a directory-traversal flaw in Broadcom VMware vCenter, with 361 victim IPs across 47 countries as of August 2026. Patches were released by Broadcom in late July 2026, and exploitation began within days of disclosure, using reverse_ssh via cron jobs for persistent remote access. QUIRSO attributes the campaign to a suspected APT actor.

Why: If your team runs VMware vCenter and has not applied Broadcom's late-July 2026 patch, patch now — the exploit chain is trivial enough that 361 hosts were compromised within days of disclosure. The reverse_ssh persistence technique bypasses inbound firewall rules, so compromised hosts may not show obvious inbound connection alerts.

Adobe patched three CVSS 10.0 vulnerabilities across ColdFusion and Campaign Classic, including OS command injection (CVE-2026-48362) and eval injection (CVE-2026-48273) in ColdFusion, plus incorrect authorization flaws in Campaign Classic (CVE-2026-71398, CVE-2026-27302). ColdFusion fixes are in versions 2025.0.12 and 2023.0.23; Campaign Classic fixes require ACC v7 7.4.4 build 9400 for on-premise deployments only. Adobe rated these Priority 1 and recommends patching within 72 hours.

Why: If you maintain or inherit ColdFusion or on-premise Campaign Classic instances—common in legacy Malaysian enterprise, GLC, and some government digital service stacks—these are remotely exploitable arbitrary code execution bugs with no current wild exploitation, meaning patching now is cheap insurance before attackers reverse-engineer the fixes. Adobe-hosted Campaign instances are already patched, so only on-premise and hybrid deployments need action.