CVEasy Weekly

This Week in Exposure

Week 34 · August 11 to August 17, 2026

August 11 was Patch Day at two vendors at once, and by Thursday both fixes were losing the race they were built to win. SAP shipped a max-severity Commerce Cloud note, and somebody diffed it into a working unauthenticated exploit inside seventy-two hours, with honeypots logging live scans from a single Charlotte address. Microsoft's afd.sys fix landed five weeks into a Lazarus campaign that had already been running as SYSTEM on defense laptops across Europe and India.

A fix you have not shipped to every running instance is a fix the attacker has already read. The patch landing is not the moment the exposure ends, it is often the moment your clock starts. Here is what mattered this week, ranked by real exposure against your inventory rather than by the base score.

Top Exposures This Week

1. An SAP Commerce Cloud patch that got read back into an exploit

CVE-2026-58231 · SAP Commerce Cloud, datahubadapter extension (2211 builds through 2211.54)

SAP Note 3771065 describes insufficient authorization and input validation on functions the Data Hub Adapter reaches through the default OAuth client that ships in essentialdata-datahubadapter.impex. An unauthenticated POST on port 443 to an endpoint under /datahubadapter/import reaches adapter functions that treat the request body as trusted, and a crafted body chains into code execution as the Commerce process. No public proof of concept exists. Someone diffed the patched extension against the previous cumulative, walked the added authorization check, and rebuilt the request the fix now blocks.

Risk read: Confirmed in the wild. Defused honeypots logged the first successful hits on August 14, seventy-two hours after the patch, from 216.249.99.43 inside AS11402, a Charlotte colocation block, reported by CyberSecurity News and Security Affairs. That exploitation signal lands any internet-facing tenant still on 2211.54 or earlier at ACT, the top TRIS band, at CVSS 10.0. Exposure is what splits the fleet: a tenant whose /datahubadapter/import path sits behind a load balancer allowlist naming only the internal Data Hub node drops several bands, while a tenant that answers on the open internet does not. The blast radius runs past the storefront, because the Commerce process holds credentials to the catalogue, order tables, customer records, payment tokenisation callbacks, and, in most retail deployments, a connected S/4HANA back end.

Read how the patch became the exploit →

2. A Windows kernel race Lazarus rode to SYSTEM for five weeks

CVE-2026-68820 · Windows afd.sys (Windows 10 through Server 2025) · CISA KEV, federal deadline August 25

afd.sys is the Ancillary Function Driver for WinSock, and it ships on every supported Windows build. The bug is a use-after-free race: two threads inside one low-privileged process race a socket across its state machine, one dereferencing a per-socket kernel object and one freeing it, while a spray reclaims the freed pool chunk with attacker bytes. The dereference lands on an attacker function pointer, the ladder swaps the process token for the System token, and every later thread runs as SYSTEM. The payload is FudModule v3.1, a data-only kernel rootkit that zeroes ETW logging state, disables minifilters, and blinds the endpoint sensor while leaving its console showing a green tick.

Risk read: Confirmed in the wild, reported by Check Point Research, which watched the chain for five weeks before the August 11 fix. CISA added it to KEV the same day with a federal remediation deadline of August 25. The base score is 7.0, a medium, and that is the trap: it assumes the attacker already has local code execution, a condition any workstation that opens external PDFs meets through phishing rounds you never see. TRIS lifts it to ACT until the cumulative is on the box, because sustained abuse against a named sector outranks a base score every time. The blast radius is whatever a SYSTEM shell on that host reaches: cached domain tokens, code signing keys on a build box, and prime contract documents on an engineering laptop. A confirmed FudModule presence is a rotation and reissuance job, not a fifteen minute cumulative.

Read the afd.sys race walkthrough →

Threat Actor Spotlight

Check Point Research ties the afd.sys campaign to Lazarus Group, the North Korea linked actor that years of public reporting places behind Operation Dream Job, the recruiter-lure operation that hands a target a PDF listing a senior role above their current title. This run aimed at defense, aerospace, aviation, drone, robotics, and military technology employees in Europe and India, and the FudModule build Lazarus has been iterating on since 2022 exists to keep the intrusion invisible from the endpoint agent's point of view. Note what it says about your instrumentation: FudModule writes kernel data structures rather than loading a driver, so Driver Signature Enforcement and HVCI never fire, and the sensor reports healthy because it is receiving no events from downstairs. Hardening takeaway: read a green EDR console as the absence of reported events, not the absence of activity. Route external PDFs through a sandbox before delivery, warn the humans in defense-adjacent roles about the recruiter lure, and hunt above the kernel structures the rootkit edits, dense Winsock IOCTL bursts and gaps in ETW output on the same host, rather than trusting the agent's own health signal.

Signed CVEasy threat-intel IOC bundle current as of 2026-08-17. The desktop app verifies the ED25519 signature before import.

Both boxes teach the same lesson from opposite ends. SAP's patch was the sensitive artifact, because the changed code is exactly what an attacker reads to rebuild the exploit. Microsoft's patch arrived after the damage, because Lazarus had a five-week head start and a rootkit built to keep it quiet. In both cases the base score graded the bug in the abstract and said nothing about the internet-facing tenant or the engineering laptop that actually carries the risk. Scoring each finding against your own inventory is the work, and it is the gap TRIS closes inside our CTEM platform, the gap I want this letter to close for you every Monday.

Patch well,
Chris Boker
Founder, CVEasy AI