Five entries added to CISA’s exploited-vulnerability catalog make this a week to check Windows, VMware, TrueConf and Zimbra deployments against the right vendor guidance.
Coverage is August 16–22, 2026, including four lead-in days before the sample calendar starts August 20. CISA’s catalog supports exploitation status; addition dates are not disclosure dates. These are Layer8 editorial priorities, adjusted for exposure and business impact.
| CVE / product | Impact and applicability | Remediation reviewed October 3 | KEV added |
|---|---|---|---|
| CVE-2026-33824 · Microsoft IKE | Unauthenticated remote code execution on affected Windows systems with IKEv2 enabled. | Install Microsoft’s update for the Windows release and architecture. | Aug. 18 |
| CVE-2026-59310 · VMware vCenter | Code execution with network access to affected vCenter. | For 8.0, U3k or U2f; match branch and deployment. | Aug. 18 |
| CVE-2026-72529 · TrueConf Server | Unauthenticated remote code execution on affected Server releases. | Vendor-listed Windows/Linux builds in 5.3.9/5.4.9/5.5.5; match branch. | Aug. 20 |
| CVE-2026-72530 · TrueConf Server | Host code execution; requires existing execution inside the isolated environment. | Use the same fix families, matching branch and platform. | Aug. 20 |
| CVE-2026-73570 · Zimbra Collaboration | Code execution with the optional SNMP package installed and notifications enabled. | For 10.1, install 10.1.20, released July 20. | Aug. 21 |
Within agreed Managed IT scope, Layer8 would reconcile inventory, assign patch owners and coordinate approved updates. Verify the installed build and test the relevant service before closing each change. Investigate suspected compromise separately: successful patching does not establish that earlier compromise is absent.
Revised source: TrueConf remediation was reviewed October 3, 2026. Its undated vendor page does not establish which exact builds were available on August 22; the table gives fix families and requires platform matching.