I was hoping this week’s roundup would be quiet. It is not. Fortinet, Palo Alto, VMware and JetBrains have not published any new advisories in the last 24 hours, but that is cold comfort, because three stories from the past two weeks are still very much alive. The one that worries me most is VMware vCenter: a vulnerability rated 9.8 is being exploited at scale, and if you run vCenter in a lab or in production, read this one to the end.
1. VMware vCenter under mass attack (CVE-2026-59310, CVSS 9.8)
This is the one you need to know about. A directory traversal flaw in the vCenter Syslog server allows arbitrary code execution as root with no authentication at all. Network access to the interface is enough: the attacker drops an entry into /etc/cron.d and that’s it.
Trackers tie the campaign to a suspected China-nexus APT group: 361 victim organizations across 47 countries (including Germany, the US, Turkey, Iran and France), a reverse_ssh backdoor plus JSP webshells. Exploitation has been going on since August 3, and on August 18 the flaw landed on the CISA KEV list. There are no workarounds. Patching is the only defense.
Patch: VMSA-2026-0006.1 — vCenter 8.0 U3k / U2f, VCF/vSphere Foundation 9.1.0.0300, 9.0.2.0100. Sources: Broadcom advisory, The Hacker News.
2. JetBrains TeamCity (CVE-2026-63077) — unauthenticated RCE
The second hot topic. Through the agent polling protocol it is possible to trigger unsafe deserialization (XStream) and execute code without logging in. The flaw has been on the KEV list since August 5, and JetBrains has confirmed attacks against unpatched servers.
The fix: TeamCity 2025.11.7 or 2026.1.3; for older installs (2017.1+) JetBrains ships a security patch plugin. After updating, go through your logs looking for com.thoughtworks.xstream.converters.ConversionException — if you see it, someone tried to exploit the server before you patched. Sources: JetBrains blog, update, Rapid7.
3. Fortinet — the August patch day
Fortinet shipped a batch of fixes in August. The most significant ones: CVE-2026-26035 in FortiWeb (rated 8.8) and CVE-2026-70465 / CVE-2026-70468 in FortiManager and FortiManager Cloud (7.3, FGFM authentication bypass).
On top of that comes the context of the FortiBleed campaign — stolen credentials for roughly 86,000 FortiGate devices. CISA recommends resetting admin and VPN passwords and enforcing MFA on everything facing the internet. If you have a FortiGate at the network edge, take this seriously.
4. Palo Alto — the August 12 bulletin (11 vulnerabilities)
Palo Alto published its bulletin with eleven vulnerabilities on August 12. In the GlobalProtect app: CVE-2026-0299 (local privilege escalation, versions 5.9), CVE-2026-0298 (RCE in Windows PLAP, 5.2) and CVE-2026-0297 (buffer overflow, 5.2). In PAN-OS: CVE-2026-0288 (User-ID TSA buffer overflow, 7.2). One caveat: some fixes for mobile and Linux builds only land between August 24 and 31. The full list lives at security.paloaltonetworks.com.
What to do today
The order seems clear to me:
- vCenter: apply VMSA-2026-0006 immediately. If you cannot patch right now, cut network access to vCenter (management VLAN only) and check
/etc/cron.d, accounts and CROND logs. - TeamCity on-prem: update to 2025.11.7/2026.1.3 or install the plugin, then review XStream logs.
- Fortinet: patch FortiWeb and FortiManager, reset admin/VPN passwords and enforce MFA on internet-facing FortiGates.
- Palo Alto: update the GlobalProtect app on user laptops and PAN-OS itself.
