VulnHub

Siemens LOGO! Soft Comfort has been found to have serious vulnerabilities related to project-file encryption and password management. Local attackers can exploit these weaknesses to extract the master key, which would allow them to decrypt project data or eliminate project passwords entirely. Specifically, the software uses a hardcoded AES master key and stores passwords as unsalted SHA-256 hashes, making them susceptible to dictionary and brute-force attacks. Siemens has released an updated version, LOGO! Soft Comfort V9, to address these issues and strongly advises users to upgrade to this version or later. This situation poses a significant risk to sensitive project configurations, particularly in sectors like commercial facilities and transportation systems worldwide.

Recent vulnerabilities have been discovered in the ANDRITZ HIPASE-250 and 250 SCALA systems, affecting versions up to 7.20. These flaws allow attackers to read sensitive data, access workstations, and potentially exploit hard-coded credentials. The vulnerabilities include inadequate password storage, missing authentication for critical functions, and the exposure of sensitive endpoints. Users are urged to update to the latest versions, V8.00.00 or V8.15.00, which address these issues. This situation poses significant risks, particularly for sectors like energy where these systems are deployed globally.

Siemens Solid Edge has been found to have several vulnerabilities related to file parsing, specifically involving DFT, PAR, and PSM files. These vulnerabilities could allow attackers to crash the application or execute arbitrary code, posing a significant risk to users. Affected versions include Solid Edge SE2025 versions prior to 225.0.15 and SE2026 versions before 226.0.7. Siemens has urged users to update to the latest versions to mitigate these risks. This matter is particularly important for organizations in critical manufacturing sectors, as it affects the integrity and security of their operations worldwide.

Siemens has identified two serious vulnerabilities in its Simcenter Femap application, both related to how the software handles BMP file formats. If users open a specially crafted malicious BMP file, it could lead to application crashes or allow attackers to execute arbitrary code. This affects all versions of Simcenter Femap prior to 2606.0001. Siemens has urged users to update to this latest version to mitigate the risks. The vulnerabilities, assigned CVE-2026-59700 and CVE-2026-59701, have a high severity rating of 7.8 on the CVSS scale, making it critical for users to act promptly. The company encourages implementing strong network protections and following its operational guidelines for industrial security.

A serious security vulnerability has been discovered in the Haiwell IoT Cloud HMI Gateway, specifically in version 3.40.1.12. This flaw allows attackers to inject and execute arbitrary operating system commands with root privileges, posing a significant risk to critical infrastructure sectors like energy and water management. The vulnerability stems from improper input handling in the Net Check feature, which fails to sanitize user inputs effectively. Although no active exploitation has been reported yet, organizations using this product should take immediate action to mitigate potential risks. Haiwell has released a patch (version Scada-v3.50.1.19) to address this issue, which users are urged to implement as soon as possible.

Hitachi Energy has reported vulnerabilities affecting its APM Edge product, specifically versions 6.10 and earlier. These vulnerabilities, identified as CVE-2026-43284 and CVE-2026-43500, could allow local unprivileged users to escalate their privileges to root. The flaws stem from issues in the Linux kernel's handling of network packets, which could lead to unauthorized access to critical system binaries. This poses significant risks to the confidentiality, integrity, and availability of the affected systems, particularly in the energy sector where APM Edge is deployed globally. Users are advised to disable certain kernel modules to mitigate these risks while further remediation steps are being evaluated.

A serious vulnerability in VMware's vCenter software has been identified, tracked as CVE-2026-59310. This directory traversal flaw allows remote attackers to execute arbitrary code on affected systems, posing a significant risk to users. Organizations that rely on vCenter for managing virtualized environments should prioritize addressing this issue. The potential for exploitation means that attackers could gain control over systems, leading to data breaches or other malicious activities. It's crucial for companies to apply any available patches or updates to safeguard their infrastructure.

A serious vulnerability in SharePoint, identified as CVE-2026-55040, is currently being exploited by attackers following the release of a public proof-of-concept on August 12. This flaw, which has a CVSS score of 9.1, allows unauthenticated users to impersonate SharePoint administrators, posing a significant risk to organizations using this platform. The vulnerability was patched in July, but the rapid exploitation indicates that many systems may still be vulnerable. Companies using SharePoint need to prioritize applying the latest security updates to protect their environments from unauthorized access. The situation underscores the importance of timely patch management in preventing exploitation.

Cisco has reported a high-severity vulnerability, designated as CVE-2026-20349, that attackers are using to cause temporary disruptions in the operation of Cisco firewalls. This flaw has been recognized by the Cybersecurity and Infrastructure Security Agency (CISA) and is included in their catalog of known exploited vulnerabilities. US civilian federal agencies are required to address this issue by August 14, 2026. While Cisco's Product Security Incident Response Team (PSIRT) became aware of the active exploitation in August, specific details regarding the attacks have not been disclosed. The urgency for remediation highlights the potential risks to organizations relying on Cisco’s firewall products.

Researchers have identified a critical vulnerability (CVE-2026-71362) in Adobe's Commerce and Magento e-commerce platforms that could allow hackers to take control of customer accounts. This flaw impacts businesses using these platforms, raising serious concerns for online retailers and their customers. Attackers could exploit this vulnerability to gain unauthorized access to sensitive user information, potentially leading to identity theft and financial fraud. As attempts to exploit this flaw have already been detected, it's crucial for affected users to take immediate action to secure their accounts. The situation underscores the ongoing risks faced by e-commerce platforms and the need for timely software updates.

Siemens has alerted users to vulnerabilities affecting its RUGGEDCOM APE1808 device due to issues in Fortinet's FortiOS software. Two specific vulnerabilities, identified as CVE-2026-23573 and CVE-2026-59839, can allow attackers to execute unauthorized commands or access restricted files if they have the necessary privileges. These vulnerabilities could potentially impact critical sectors such as manufacturing, energy, and transportation. Siemens advises affected users to contact their customer support for more details on mitigation measures and to follow Fortinet's advisory for workarounds. This situation underscores the need for robust network security measures to safeguard critical infrastructure.

Adobe has released important security updates to address multiple critical vulnerabilities affecting its ColdFusion, Commerce, and Campaign Classic products. Among these, the most serious is a command injection flaw in ColdFusion, identified as CVE-2026-48362, which has a maximum severity score of 10.0 on the CVSS scale. If exploited, this vulnerability could allow attackers to execute arbitrary code on affected systems, leading to potential privilege escalation. This is particularly concerning for organizations that rely on these Adobe products, as successful exploitation could compromise sensitive data and system integrity. Users are strongly advised to apply the latest patches to mitigate these risks.

In August 2026, Microsoft released patches addressing over 400 vulnerabilities, including a serious zero-day exploit identified as CVE-2026-68820. This particular flaw is a use-after-free vulnerability affecting the Windows Ancillary Function Driver for WinSock (AFD.sys), which could allow a low-privileged local attacker to gain elevated privileges to the SYSTEM level. This means that attackers with local access could potentially execute malicious applications to take control of affected systems. The urgency of this update is underscored by the fact that the vulnerability is already being exploited in the wild. Users and organizations relying on Windows systems should prioritize applying these updates to mitigate potential risks.

Recent research from QUIRSO reveals that attackers are exploiting a severe vulnerability in Broadcom's VMware vCenter, identified as CVE-2026-59310, which has a CVSS score of 9.8. This directory-traversal flaw allows malicious users with network access to execute arbitrary code on the server, creating a significant risk for organizations using this software. The vulnerability is particularly concerning because it enables persistent remote access, potentially compromising sensitive systems. VMware has issued patches to address this flaw, but organizations must act quickly to implement them to protect against active exploitation. This incident serves as a reminder of the importance of timely updates in cybersecurity management.