TL;DR
Microsoft patched 398–421 CVEs including a Windows kernel zero-day (afd.sys) actively exploited for privilege escalation. Zoom annotation tool enables zero-click code execution between meeting participants. Russian APT Sandworm is conducting social engineering attacks against IT professionals using fake job offers and trojanized WireGuard VPN. Immediate patching and network segmentation required.
Executive Summary
- Microsoft's August 2026 Patch Tuesday addressed 398–421 security flaws, including a use-after-free in the afd.sys Windows kernel-mode driver already being exploited in the wild to escalate privileges to SYSTEM level.
- Zoom disclosed zero-click code execution vulnerabilities in its annotation feature that allow any meeting participant to hijack another attendee's client without user interaction.
- Russian state-sponsored threat group Sandworm (via UAC-0145) is conducting targeted social engineering campaigns against Ukrainian IT workers using fake job interview offers and delivering trojanized WireGuard VPN clients capable of remote command execution.
- Microsoft SharePoint Server is affected by an unauthenticated RCE vulnerability (CVE-2026-55040, CVSS 9.1) discovered through AI-assisted exploit research.
- Cisco Secure Firewall ASA and Threat Defense (FTD) products are experiencing active exploitation of a high-severity denial-of-service vulnerability affecting VPN functionality.
Top Threats Today
1. Windows Kernel Zero-Day Under Active Exploitation
Severity: HIGH Affected: Technology
A use-after-free vulnerability in the afd.sys Windows kernel-mode driver that handles network socket operations has been actively exploited to gain SYSTEM-level privileges [1][2]. The flaw requires an attacker to have code already executing on the target machine, but allows local privilege escalation [1]. Microsoft released patches on August 12, 2026, as part of its 398–421 CVE monthly update [1][2][3].
Sources:[1] The Hacker News[2] Krebs on Security[3] SecurityWeek
Recommended Action
- Apply August 2026 Microsoft security updates immediately, prioritizing Windows kernel patches.
- Monitor endpoint detection and response (EDR) systems for suspicious privilege escalation attempts.
- Restrict code execution and local administrator rights to least-privilege accounts.
2. Zoom Annotation Zero-Click Remote Code Execution
Severity: HIGH Affected: Technology
Zoom's annotation feature, which allows participants to draw and type on shared screens, contains zero-click code execution flaws that enable bidirectional client hijacking [1][2]. Any participant sharing their screen could be compromised by viewers, and viewers could be compromised by the presenter, with no user interaction required [1]. Zoom has released patches addressing these vulnerabilities [2].
Sources:[1] The Hacker News[2] SecurityWeek
Recommended Action
- Update Zoom to the latest patched version immediately.
- Educate users to disable annotation features when not actively needed.
- Consider restricting who can use annotation tools within Zoom security settings.
- Monitor for unusual client crashes or unexpected processes during Zoom calls.
3. Sandworm APT Targets IT Professionals via Fake Job Offers & Trojanized VPN
Severity: HIGH Affected: Technology
Ukraine's CERT-UA has disclosed a targeted social engineering campaign attributed to Russian nation-state threat actors (Sandworm, tracked as UAC-0145) that masquerades as recruiters to trick IT workers into installing malware [1]. The campaign has been active since at least May 2026 ⚠[2] and distributes trojanized WireGuard VPN clients capable of executing remote commands on compromised systems [2]. The targets are system administrators and IT professionals in Ukraine [2].
Sources:[1] The Hacker News[2] BleepingComputer
Recommended Action
- Implement security awareness training focusing on job interview phishing and unsolicited recruiter contact.
- Establish a vetting process for any software downloads, especially VPN clients, through official channels only.
- Monitor for unauthorized VPN connections or suspicious process spawning from VPN software.
- Require multi-factor authentication for all remote access and administrative accounts.
4. Microsoft SharePoint Unauthenticated RCE via AI-Discovered Exploit Chain
Severity: HIGH Affected: Technology
Security researchers have disclosed CVE-2026-55040 (CVSS 9.1) affecting Microsoft SharePoint Server Subscription Edition, which allows unauthenticated attackers to gain administrator access and achieve remote code execution [1]. The vulnerability was discovered through automated AI agent assistance during exploit research [1]. SharePoint instances exposed to the internet are at immediate risk.
Sources:[1] The Hacker News
Recommended Action
- Apply Microsoft security updates for SharePoint Server immediately upon availability.
- Restrict SharePoint server access to internal networks or require strong multi-factor authentication.
- Audit SharePoint permissions and disable unnecessary administrator accounts.
- Monitor SharePoint audit logs for unauthorized authentication or privilege escalation events.
5. Cisco Secure Firewall Denial-of-Service Under Active Attack
Severity: HIGH Affected: Technology
Cisco is warning that a high-severity denial-of-service vulnerability in Secure Firewall ASA and Threat Defense (FTD) software is being actively exploited in attacks to remotely crash affected devices [1]. The flaw affects VPN functionality [1].
Sources:[1] BleepingComputer
Recommended Action
- Check Cisco security advisories for affected ASA and FTD software versions and patch status.
- Monitor firewall logs for unusual VPN authentication attempts or crash events.
- Consider temporarily restricting VPN access to a secondary appliance if available during patch testing.
- Implement rate limiting on VPN connection attempts where feasible.
Today’s Action Checklist
- ☐ URGENT: Review and prioritize Windows afd.sys kernel updates in your patch management queue.
- ☐ URGENT: Deploy Zoom application updates and communicate annotation feature restrictions to users.
- ☐ URGENT: Brief IT staff and system administrators on Sandworm's ongoing fake recruiter campaign; verify all recent software installations.
- ☐ HIGH: Audit and restrict internet-facing SharePoint Server instances; apply patches when released.
- ☐ HIGH: Check Cisco Secure Firewall versions in your environment and develop patching strategy for ASA/FTD devices.
- ☐ MEDIUM: Review Azure/Microsoft 365 security settings and ensure MFA is enforced on all administrative accounts.