August 2026 Security Alert: Critical Flaws Under Active Exploit

Critical Infrastructure Under Attack

This week brings sobering reminders that cyber threats continue to evolve in both sophistication and audacity. CISA has added multiple critical vulnerabilities to its Known Exploited Vulnerabilities catalog, with Progress LoadMaster CVE-2026-8037 now confirmed as actively exploited in the wild. Meanwhile, the developer community faces a surge in supply chain attacks, and critical infrastructure operators are grappling with novel attack vectors that bypass traditional security controls.

Let's break down what's happening, why it matters to your organization, and what you need to do about it.

Progress LoadMaster: Patch Immediately

The most urgent item on today's radar is the command injection vulnerability in Progress Kemp LoadMaster (CVE-2026-8037). CISA's addition of this flaw to the KEV catalog on August 7th signals that threat actors are actively exploiting it in real-world attacks.

LoadMaster devices serve as application delivery controllers and load balancers—critical components in many enterprise networks. The vulnerability allows unauthenticated remote attackers to execute arbitrary commands on affected systems. This is the nightmare scenario: no credentials required, remote exploitation possible, and full system compromise achievable.

If your organization uses Progress LoadMaster devices, this is a drop-everything-and-patch situation. The exploit is already in attackers' hands, and these devices often sit at network boundaries with elevated privileges and visibility into internal traffic.

Immediate Actions:

• Inventory all LoadMaster devices in your environment
• Apply vendor patches immediately—check Progress's security advisories for your specific version
• If patching requires downtime you can't immediately schedule, implement compensating controls: restrict management interface access, enable additional logging, and monitor for suspicious command execution
• Review logs for indicators of compromise dating back at least two weeks

Malicious VS Code Extensions: The Developer Supply Chain Under Siege

Developers have become prime targets for sophisticated supply chain attacks. Security researchers have identified a malicious Visual Studio Code extension called "Solidity Pro" that steals cryptocurrency wallets, API keys, and credentials from infected development machines.

This attack is particularly insidious because it targets the tools developers trust most. VS Code extensions run with significant privileges and access to your filesystem, environment variables, and often your source code repositories. The "Solidity Pro" extension masqueraded as a legitimate development tool for blockchain developers, likely attracting victims through search engine optimization and social media promotion.

What Makes This Attack Effective:

• Trust exploitation: Developers expect VS Code marketplace extensions to be vetted and safe
• High-value targets: Developer machines contain API keys, cloud credentials, database passwords, and source code
• Lateral movement potential: Compromised credentials often provide access to production systems, CI/CD pipelines, and customer data

Protecting Your Development Team:

Establish clear policies around extension installation:

• Require approval for new extensions, especially those requesting broad permissions
• Review extension publishers—look for verified creators and check download counts and reviews
• Use separate development environments with limited production access
• Implement secrets management solutions that don't store credentials in plain text on developer machines
• Regularly audit installed extensions across your development team

Novel Attack Vectors: Private APN Exploitation

Perhaps the most technically sophisticated story this week comes from Poland, where attackers successfully sabotaged a second energy facility using a novel technique involving private Access Point Names (APNs). CERT.PL reports this appears to be the first documented instance of a private APN being weaponized as an attack vector.

Private APNs are typically used by organizations to create secure cellular data connections for IoT devices, industrial control systems, and remote monitoring equipment. The fact that attackers found a way to pivot through this infrastructure to reach critical systems demonstrates the expanding attack surface in operational technology environments.

This incident underscores a critical reality: as organizations digitize industrial systems and connect operational technology to corporate networks, traditional IT security models prove insufficient. Energy sector organizations and other critical infrastructure operators must assume that determined adversaries will find creative paths through air gaps and supposedly isolated networks.

The Broader CISA KEV Picture

Beyond LoadMaster, CISA has added five other vulnerabilities to the KEV catalog in recent days:

• CVE-2026-63077: JetBrains TeamCity deserialization vulnerability
• CVE-2026-18556 and CVE-2026-18577: N-able N-central authentication bypass flaws
• CVE-2026-34486: Apache Tomcat data encryption issue
• CVE-2026-9198: IBM Langflow code injection vulnerability

The common thread? These are all being actively exploited. When CISA adds a vulnerability to the KEV catalog, it's not a theoretical risk—it's a confirmed threat that attackers are using right now.

Federal agencies must patch KEV vulnerabilities within strict timelines (typically 21 days), but private sector organizations should treat this catalog as a priority patch list regardless of regulatory requirements.

Building Resilient Defenses

These incidents collectively illustrate why defense-in-depth remains essential:

1. Patch management: Establish processes to identify and remediate critical vulnerabilities within days, not weeks
2. Supply chain security: Vet third-party code, extensions, and dependencies before deployment
3. Network segmentation: Assume breach and limit lateral movement opportunities
4. Monitoring and detection: Log analysis and anomaly detection catch exploitation attempts that prevention misses
5. Incident response planning: When (not if) something breaks through, rapid response limits damage

The threat landscape in August 2026 demands vigilance, but not paranoia. Organizations that maintain good security hygiene—timely patching, careful vendor selection, network segmentation, and continuous monitoring—can effectively manage these risks.

Need help assessing your organization's vulnerability to these threats or strengthening your security posture? Vici Tech Solutions provides penetration testing and security assessments that identify weaknesses before attackers do.