Why Should I Care? — 2026-08-13 | 🔴 0 HIGH · 🟡 3 MEDIUM · 🔵 21 RADAR · ⚪ 233 FILTERED

📋 Briefing — 2026-08-13

24 vendor intel items scanned  |  🔴 0 HIGH  |  🟡 3 MEDIUM  |  🔵 21 RADAR  |  ⚪ 233 FILTERED

✅ No critical items today.

Everything else can wait.

🟡 Medium — review when time permits:

1. Heap overflow in kernel driver due to missing size validation — Yes, if you run FortiClient Windows: unauthenticated RCE via malicious DNS responses.
2. FGFM Authentication Weakening via CLI Configuration — Yes, if you run FortiManager or FortiManager Cloud with a specific CLI option set: unauthenticated attackers can impersonate any managed FortiGate device.
3. Broken access control in the RADIUS type admin group — Yes, if you run FortiWeb with Remote Radius Type Admin Authentication configured: unauthenticated access to GUI/CLI allows full control.

🔵 15 items on the radar — see below ↓

Why Should I Care? 🔴 HIGH — Handle Now

No HIGH priority items in the last 24h.

Why Should I Care? 🟡 MEDIUM (3)

Heap overflow in kernel driver due to missing size validation

Fortinet PSIRT | CVSS 7.3

❓ Why Should I Care?
Yes, if you run FortiClient Windows: unauthenticated RCE via malicious DNS responses. Patch now.

🎯 Affected versions: FortiClient Windows versions prior to the patched version

🎭 In plain English:
If you use FortiClient on a Windows machine, an attacker can send specially crafted DNS responses that exploit a flaw in the software, allowing them to run any code they want on your computer without needing your password. This means they could take full control of your system and do anything from stealing files to installing malware.

🔧 Prerequisites:

• Attacker must be able to intercept or alter DNS traffic
• FortiClient Windows version is vulnerable

⏱ Urgency: High urgency due to the potential for unauthenticated remote code execution, which could lead to full system compromise.

💡 Context: The kernel driver in FortiClient does not properly validate the size of input data when processing DNS responses, leading to a heap overflow.

FGFM Authentication Weakening via CLI Configuration

Fortinet PSIRT | CVSS 7.3

❓ Why Should I Care?
Yes, if you run FortiManager or FortiManager Cloud with a specific CLI option set: unauthenticated attackers can impersonate any managed FortiGate device. Patch immediately.

🎯 Affected versions: FortiManager and FortiManager Cloud with the specific CLI option set

🎭 In plain English:
An attacker can pretend to be any of your managed FortiGate devices by sending special requests, if they have a valid certificate. This means they could potentially take control of your network configurations without needing to know any passwords.

🔧 Prerequisites:

• Specific CLI option set
• Valid certificate

⏱ Urgency: High urgency due to the potential for unauthenticated impersonation and unauthorized access to managed devices.

Broken access control in the RADIUS type admin group

Fortinet PSIRT | CVSS 8.8

❓ Why Should I Care?
Yes, if you run FortiWeb with Remote Radius Type Admin Authentication configured: unauthenticated access to GUI/CLI allows full control. Patch immediately.

🎯 Affected versions: FortiWeb versions with Remote Radius Type Admin Authentication enabled
Not affected: All FortiWeb versions without Remote Radius Type Admin Authentication configured

🎭 In plain English:
An attacker can log into your firewall's admin interface using any username and password, gaining full control over the device. They could change settings, monitor traffic, or even shut down security features.

🔧 Prerequisites:

• Remote Radius Type Admin Authentication must be enabled

⏱ Urgency: High urgency due to potential for unauthenticated access allowing complete takeover of the device.

Why Should I Care? 🔵 On the Radar (21)

• Lazarus hackers exploited Windows zero-day to target defense firms (BleepingComputer) — North Korean hackers used a new Windows bug to break into defense firms. They tricked employees into downloading malware that gives full control over the system. If you're in defense, aerospace, or aviation and use Windows, this affects you directly.
• Cisco ASA and FTD Flaw Exploited in the Wild Can Trigger Remote DoS (The Hacker News) — A critical flaw in Cisco's firewall software (ASA and FTD) allows attackers to trigger a denial-of-service (DoS), potentially disrupting your network operations. If you're running affected versions of ASA or FTD, immediate action is needed to patch the vulnerability.
• Hackers exploit critical Adobe Commerce flaw to hijack customer accounts (BleepingComputer) — A serious flaw in Adobe Commerce and Magento allows hackers to take over customer accounts. If your business uses these platforms, immediate action is needed to apply the latest security update.
• "City-Forum" data-theft attacks target Salesforce, ServiceNow portals (BleepingComputer) — A group called City-Forum is stealing data from companies using Salesforce Experience Cloud and ServiceNow portals by exploiting overly permissive sharing rules. They target guest accounts that have access to more data than they should, potentially exposing sensitive records.
• Lazarus Exploits Windows Zero-Day to Gain SYSTEM Access and Deploy Backdoor (The Hacker News) — The Lazarus Group exploited a recently patched flaw in Windows to deploy a backdoor targeting defense and aerospace companies. If you're in these sectors, this means your systems could have been compromised without your knowledge.
• 737 Chrome VPN Extensions Caught Routing Traffic Through Proxies. Check If You Have One (The Hacker News) — A large number of fake Chrome VPN extensions are routing users' traffic through unauthorized proxies. This can compromise privacy and potentially allow attackers to intercept sensitive information.
• Hackers leverage new Microsoft SharePoint exploit in attacks (BleepingComputer) — Hackers are exploiting a new critical vulnerability in Microsoft SharePoint that lets them impersonate users and access sensitive data. If you run SharePoint, ensure your systems are patched to avoid unauthorized access.
• Malicious LiteLLM Releases Tied to Trivy Hack May Have Exposed 2,100+ Organizations (The Hacker News) — Two malicious versions of LiteLLM were briefly available on PyPI in March. If your systems installed these versions, they could have stolen various credentials from your infrastructure. This affects any organization that used or depended on LiteLLM during the exposure window.
• Attackers Exploit VMware vCenter Vulnerability to Gain Persistent Remote Access (The Hacker News) — Hackers are exploiting a critical flaw in VMware vCenter that lets them take over servers. If your infrastructure uses this product, you need to patch it immediately to avoid unauthorized access.
• Adobe Patches Three CVSS 10.0 ColdFusion and Campaign Classic Flaws (The Hacker News) — Adobe has patched critical security flaws in ColdFusion and Campaign Classic that could allow attackers to execute arbitrary code and escalate privileges. This means your systems could be compromised if you don't update immediately.
• New Microsoft Defender 'ShieldBreak' zero-day grants SYSTEM privileges (BleepingComputer) — A new zero-day exploit named 'ShieldBreak' has been released that can bypass Microsoft Defender's security measures on fully patched Windows systems, granting attackers SYSTEM-level access. This means any system using Microsoft Defender is at risk of being compromised by this vulnerability.
• ShieldBreak Zero-Day PoC Claims Microsoft Defender Patch Bypass With SYSTEM Access (The Hacker News) — A new security flaw called ShieldBreak allows attackers to bypass a recent patch in Microsoft Defender, potentially giving them full control over your system. If you're running Windows 11 or Server 2025 with Defender, this could be a significant risk.
• SAP Commerce Cloud Flaw Could Let Unauthenticated Attackers Execute Arbitrary Code (The Hacker News) — A critical security flaw in SAP Commerce Cloud could allow anyone to run malicious code on your system without needing any login credentials. This means they could potentially take control of your application and access sensitive data.
• Android malware combo takes out loans and relays victims' credit cards (BleepingComputer) — A new malware combo called WindRelay and SpyNote is stealing credit card information from Android phones by tricking victims into installing malicious apps. This can lead to unauthorized transactions and loan applications in the victim's name.
• Plug and Pwn attack uses fake USB devices for Windows SYSTEM access (BleepingComputer) — Security researchers have found a way to exploit the Windows Plug and Play feature using fake USB devices or remote connections to gain SYSTEM privileges. This means attackers can install malicious software that runs with high-level permissions, potentially compromising your entire network.

⚪ 233 low-priority items filtered.

🦅 Aggregated and triaged by Donna AI  |  Sources: 9 vendor feeds  |  CISA KEV