Pulse August 2026

August 26, 2026

By the numbers

This is the second edition of InfraTrust Pulse, our monthly rundown of the security advisories that matter for the hardware running everything: network devices, servers, workstations, and the components and firmware inside them. Last month closed on July 17, so this one picks up on July 18 and runs through August 24, 2026.

In that window, vendors we track published 118 new security advisories across 12 vendors, covering 1,051 distinct CVEs. Eighteen of those advisories are scored as critical according to CVSS. Forty are remotely exploitable with no authentication, the key combination we recommend defenders focus on most. We are now also tracking advisories revised in the window. 74 advisories were updated, bringing the total number of advisories added or updated inside the window to 191. This means 39% of this month’s advisories were updates rather than new publications. We’ll cover the most urgent in this report. You can dive into the others on the InfraTrust website.

Also, not surprisingly, AI infrastructure keeps emerging with new risk at every layer. The DPUs, SmartNICs, and management controllers underneath a GPU cluster have the same firmware problem we have been living with for a decade. This month they took hits at every layer of that stack, from critical flaws in the inference-serving software down through the networking silicon to errata in the TPM reference code underneath it.

The CISA KEV activity is also interesting, and falls into four different categories represented in the most recent window: 3 CISA KEV entries were added for new advisories, 1 CISA KEV entry for an advisory issued prior to the window, 5 older CISA KEV entries included in new advisories, and 2 older CISA KEV entries in revised advisories.

Expert Analysis

This month’s attacks focused on the management plane. Cisco Secure Firewall Management Center represents two of the KEV additions. Arista’s exploited 10.0 is in the VeloCloud Orchestrator. HPE Aruba’s 9.8 is in the SD-WAN Orchestrator. Check Point’s KEV entry on July 22 is SmartConsole. None of those is the firewall, the router, or the switch. Each is the system that configures them. A successful attack can compromise more than one device by accessing the fleet through a path that looks exactly like normal administration. If your threat model treats the management console as trusted infrastructure sitting safely inside the perimeter, this month should change your mind.

Patching is necessary, but not sufficient. CVE-2025-68686 is the cleanest example I have seen in a while. Fortinet shipped a patch for an attacker persistence technique; the patch’s string comparison had a bug, and an extra slash was all it took to bypass it. If you were compromised before, you are still compromised even if your patch report says you are fine. In July, we made this point through SonicWall, where the fix did not undo the credentials, sessions, and TOTP seeds the attackers had already taken: different vendor, different mechanism, same conclusion. Remediation includes patching, hunting for IoCs, and rotating credentials. If you only do the first one, you have updated a version number on a compromised device.

CVSS keeps pointing you the wrong way. Amongst the KEV additions from vendors we tracked in this window, two are critical, six are high, and three are medium. Attackers are actively using both mediums. Meanwhile, eighteen advisories this month are CVSS-critical. Forty are remotely exploitable with no authentication, and those are not the same forty you would get by sorting on the score. CVSS measures the flaw. It doesn’t know whether the affected box is on the internet, whether you own it, or whether it is already in somebody’s toolkit.

What to patch first

Cisco Secure Firewall Platforms (CVE-2026-20316, CVE-2026-20349, CVE-2026-20079)

Cisco’s firewall line took three separate hits this month, and two of them are actively being exploited in the wild:

CVE-2026-20316, Secure Firewall Management Center (FMC) static credential. CISA added this to KEV on July 29 with an August 1 federal deadline. An unauthenticated remote attacker can log into the FMC web interface using hardcoded low-privilege credentials. CVSS rates it 5.3 (Medium) because, on its own, it only grants read access to some data. Cisco’s advisory (cisco-sa-fmc-static-cred-BET3Cjh), first published July 29 and revised to version 1.5 on August 11, warns us that this vulnerability can be combined with other FMC vulnerabilities to escalate privileges.
CVE-2026-20079, Secure FMC authentication bypass, CVSS 10.0. This is another recent FMC vulnerability you should be concerned about. An improper system process created at boot lets an unauthenticated attacker send crafted HTTP requests to execute script files and take root on the underlying operating system. Every FMC release is affected. It was published back on March 4, so it is not new. Still, Cisco pushed revision 2.4 on August 5 with updated hotfix guidance and clarified procedures for detecting whether you were already compromised. Cisco says it is not aware of exploitation in the wild; however, it carries a perfect 10.0 CVSS.
CVE-2026-20349, ASA and FTD Remote Access SSL VPN denial of service, CVSS 8.6, High. Published August 11 and added to KEV the same day with a patch deadline of August 14. An unauthenticated attacker sends a crafted HTTP request, and the device reloads. You are exposed if you run IKEv2 Remote Access VPN with client services, SSL VPN with webvpn enabled, or Zero Trust Network Access on FTD. No workarounds exist, but fixes are available. See our full write-up of this vulnerability here: CVE-2026-20349: Someone Is Crashing Cisco Firewalls. We Need to Talk About Why.

If you run Cisco firewalls, patch the ASA/FTD VPN flaw and the FMC static credential now, then apply the FMC authentication bypass hotfix and run Cisco’s compromise-detection queries against your FMC logs. Don’t skip that last step because the advisory is five months old; you may miss an attacker who has already gained persistent access.

Arista VeloCloud Orchestrator On-Prem (ARISTA0144, CVE-2026-16812, CVSS 10.0)

A perfect 10.0 OS command injection (CWE-78) in the on-premises VeloCloud Orchestrator, published July 27 and added to KEV the same day with a July 30 deadline. Arista says that functionality “intended for internal use only” was “inadvertently exposed remotely,” and Arista “is aware of active exploitation of this issue in customer networks.”

The orchestrator is the control plane for your entire SD-WAN fabric. An attacker with command execution there isn’t limited to one branch office router; they can push configuration to all of them. Arista published source IPs to hunt for in your access logs: 8.19.75.217, 206.72.242.124, and 206.72.242.162. If you cannot patch immediately, restrict the web interface to trusted administrative networks (generally a good idea anyway) and watch for unexpected outbound VCO traffic.

Fortinet FortiOS SSL-VPN symlink persistence patch bypass (FG-IR-25-934, CVE-2025-68686)

CISA added this to the KEV on July 27 with an August 10 patch deadline. It is worth your attention if you have FortiOS devices on your network, even though CVSS gives it only a 5.9 (Medium) severity rating.

Attackers who compromised FortiGate devices through older bugs planted a symbolic link in the SSL-VPN language directory to keep read access to the device filesystem even after patching. Fortinet shipped a patch for that persistence trick. The patch checked the request path against the string “/lang/custom”. So researchers at ITRES Labs requested “/lang//custom” instead. The extra slash skips the string check entirely, and the web server resolves the path just fine.

Exploitation requires that the device was already reached at the filesystem level through CVE-2022-42475, CVE-2023-27997, or CVE-2024-21762. If you patched those years ago and moved on, that is exactly the scenario that must trigger further attention. Upgrade to the latest FortiOS, then check your language directories for symlinks that shouldn’t be there, because the upgrade doesn’t remove what an attacker already left behind.

Dell Networking OS10 and the roll-up problem

Dell shipped two OS10 security updates in this window. DSA-2026-299 published on July 21 at CVSS 9.8 with 435 CVEs, and DSA-2026-322 published on August 19 at CVSS 10.0 with 67 more. DSA-2026-299 addresses CVE-2026-31431, the Linux kernel page-cache privilege escalation the press called “Copy Fail” and now circulates as the “Dirty Frag” exploit. We flagged that same CVE riding inside DSA-2026-240 last month. It reappeared again on August 20 inside DSA-2026-372 for Dell Metro Node. That is three Dell products in two months inheriting one KEV-listed kernel flaw.

Two more Dell roll-ups carry KEV-listed CVEs: DSA-2026-352 (ThinOS 10, August 20, CVSS 9.8, 83 CVEs) via CVE-2026-11645 in Chromium V8, and DSA-2026-327 (PowerVault ME5, July 28, CVSS 8.8) via CVE-2024-4761, also Chromium V8. A storage array inheriting a browser engine bug is a good reminder to understand better what’s actually inside your appliance firmware.

The other internet-facing criticals

Cisco published four “Security Hardening Release” advisories in the window, and two of them score a perfect 10.0: Secure Workload and Crosswork, both August 19. IOS XE (9.8) and Catalyst SD-WAN (9.9) followed on August 5. These are bundled upstream component fixes rather than single named flaws, so read them for what they contain rather than reacting to the score.

Fortinet’s FG-IR-26-158 (August 12, CVSS 9.8) is broken access control in the RADIUS-type admin group, and all seven Fortinet advisories in this window are remotely exploitable without authentication. HPE Aruba Networking shipped HPESBNW05100 for SD-WAN Orchestrator 9.6.x (August 4, CVSS 9.8) and HPESBNW05081 for AOS-CX (July 21, CVSS 8.8). That is a third orchestrator on this list.

Reachable Locally, But Still Important

AI infrastructure

NVIDIA had a busy month above the silicon layer. Triton Inference Server drew a CVSS 9.8 bulletin on August 18 covering five CVEs, plus a second Triton bulletin at 7.1 on August 4. Dynamo took a 9.8 with fifteen CVEs on August 4. DCGM Exporter came in at 8.2 on July 28, and Cumulus Linux and NVOS at 7.8 on August 18. If you are running an inference fleet, these are the serving and telemetry components sitting directly in front of your accelerators.

Below that, BlueField and ConnectX are back, and they reached customers in three separate ways: NVIDIA advisory 5815 (July 28, CVSS 9.0), Dell DSA-2026-323 (July 21, 9.0), and Lenovo LEN-213840 (August 11, 8.7). Lenovo also re-shipped NVIDIA’s Jetson and IGX fixes in LEN-213624 (CVSS 9.4). NVIDIA’s bulletin tells you the flaw exists. The firmware you can actually install comes from whoever built the server, and those arrive on their own schedule: Dell on July 21, NVIDIA on July 28, Lenovo on August 11. Watch only NVIDIA, and you learn about a bug weeks before you have anything to install. Watch only your OEM, and you don’t learn about it until they do. And if you run BlueField or ConnectX in more than one vendor’s chassis, you need all three advisories, because patching the Dell fleet does nothing for the Lenovo one.

The August 11 firmware wave, and what it says about trust anchors

Thirty-eight firmware advisories were published on August 11. That is a third of the month’s total in twenty-four hours. Almost all of these are driven by OEMs re-shipping the same upstream component fixes: Intel PROSet/Wireless WiFi (HPSBHF04138 at CVSS 8.4, LEN-211075 at 8.4, HPSBHF04139 at 8.3, LEN-217411 at 8.3), Intel chipset firmware (LEN-213831 at 8.2, HPSBHF04137 at 7.9), Intel NPU driver, Lenovo’s Multi-Vendor BIOS roundup (8.5, 17 CVEs), and Dell’s Client Platform BIOS update for the 2026.3 IPU (8.5, 16 CVEs).

AMD published AMD-SB-7064, a vulnerability in the Trusted Platform Module (TPM) Reference Code, covering CVE-2026-6726 and CVE-2026-6727. Lenovo shipped it downstream in two flavors, LEN-223504 for firmware TPMs and LEN-223505 for discrete TPMs. This bug appears in the reference code everyone builds from, so a bug there lands in every TPM built from that code, in silicon and firmware alike.

Revised, Not New

Seventy-four advisories were revised during this window without being newly published.

Six vendors account for all of them: Lenovo 38, Dell 23, HP 9, Cisco 2, HPE 1, F5 1. By original publish date, 49 are from 2026, 17 from 2025, seven from 2024, and one from 2022. We won’t go into deep detail on all of them here but highlight the ones we think are most urgent. If the vendors for the others are relevant to your organization, you can find more info on the always-free InfraTrust website.

Three revisions in this batch deserve your attention more than most of the new advisories do:

cisco-sa-onprem-fmc-authbypass-5JPp45V2 (CVE-2026-20079, CVSS 10.0), revised August 5 with updated hotfix guidance and clarified compromise-detection procedures. No new CVE, no new publish date, and it is arguably the most important document Cisco put out for FMC operators this month.
F5-K000161837, the out-of-band notification we gave its own section to in July at CVSS 9.2, quietly revised on August 13.
Lenovo’s Multi-Vendor BIOS roundups, essentially all of them. February 2025, June 2025, August 2025, October 2025, December 2025, and January through July 2026 were all revised in this window. These are living documents because the list of affected models keeps growing as Lenovo works through its product line.

If your vulnerability process keys on publish date, it saw none of this. A revised advisory can mean a new affected model, a new fixed version, a corrected severity, or, as with the Cisco FMC bypass, new instructions for finding out whether you were already compromised. Tracking the last modified date is equally as important as tracking the published date.

New Research

Plenty of the best work this month produced no advisory and no CVE in our window, which is exactly why this section exists.

BMCs are exposed, and two teams proved it independently.

Lava scanned for internet-exposed IPMI and found 36,872 services listening on UDP 623, growing by roughly 60 a day, with Supermicro accounting for more than half of the exposed BMCs.

HD Moore and runZero presented at Black Hat 2026 as “Lights Out: BMCs Are Still Broken, and Now We Have the Receipts,” and at DEF CON 34. Their external scan found more than 86,000 internet-exposed BMCs, 54% with at least one critical vulnerability. An internal scan of 126,761 BMCs found roughly 29% with a critical vulnerability.

System Management Mode, twenty years in

Antonis Louka and Jo Van Bulck of DistriNet, KU Leuven published “SoK: 20 Years of Power, Privilege, and Peril in x86 System Management Mode” at WOOT 2026, the first systematic review of offensive SMM research: 69 attack studies and 57 advisories organized into three eras, Christopher Domas then demonstrated at DEF CON 34, in a talk titled “Weaponizing Uselessness,” that one of SMM’s foundational assumptions can be broken with a single instruction. The proof of concept (github.com/xoreaxeaxeax/smiiiiiiiiiiiiiiii) runs on AMD Zen 3, a Ryzen 7 5800H.

Backdoors and the router supply chain

VulnCheck’s ENDLESSDOORS research disclosed twenty router models from Shenzhen Zhibotong Electronics, sold under the Zbtlink, ZBT, and Wiflyer brands on Amazon, Alibaba, and Shopify, that ship with an implant built on rctl, a 2015 GitHub command-and-control project. Tracked as CVE-2026-66747, with roughly 100,000 units deployed, mostly in business networks.

Also worth tracking even though its advisory falls outside our window: Qilin ransomware affiliates exploiting Palo Alto CVE-2026-0257 (CVSS 7.8), an authentication bypass in PAN-OS when authentication-override cookies are enabled with certain certificate configurations. Arctic Wolf Labs published an article on July 20, 2026, detailing intrusions from June 2026.

FAQ

A monthly rundown of the security advisories that matter for the hardware running everything. Network gear, servers, chips, firmware, and BMCs. New edition every month.

Cisco Secure Firewall. Two KEV entries in two weeks, plus a 10.0 authentication bypass with no workaround for the VPN flaw. Then the Arista VeloCloud Orchestrator if you run one.

Because CISA says attackers are using it. The Cisco FMC static credential is Medium on its own. Chained with the 10.0 authentication bypass on the same box, it is not.

Because the change can be a new affected model, a new fixed version, or new instructions for detecting compromise, Cisco’s August 5 FMC revision was exactly that. No new CVE, and you still need to act.

Yes. Two teams: 36,872 and 86,000+ exposed controllers, with two-thirds leaking password hashes before login. The flaw is from 2013. The fix is a firewall rule.

That is VulnCheck’s call, and I agree. A backdoor the vendor shipped in its own init script across twenty models is a trust problem, not a patch problem.