The Lyceum: Cyber Intelligence Daily — Aug 13, 2026

The freshest attacks share one uncomfortable theme: attackers are not inventing new trust relationships so much as borrowing the ones organizations already created. SharePoint identity tokens, Magento customer sessions, public Salesforce portals, and “privacy” extensions all became ways to enter through doors users and administrators had been taught to trust.

• CVE-2026-20349 — Cisco Secure Firewall ASA and Secure Firewall Threat Defense: patched and actively exploited; no NVD score yet. A crafted request can force affected firewalls to reload, temporarily interrupting VPN and firewall operations; CISA’s federal remediation deadline remains active through August 14.
• CVE-2026-68820 — Microsoft Windows Ancillary Function Driver for WinSock: patched and actively exploited; no NVD score yet. An attacker with an existing foothold can escalate to SYSTEM privileges, as observed in the Lazarus Group’s defense-sector campaign.
• CVE-2026-72898 — Metabase: patched and actively exploited; no NVD score yet. The SQL-injection flaw can give an unauthenticated attacker access to connected databases and stored credentials; CISA’s federal deadline remains active through August 14.

Rapid7 published technical analysis and proof-of-concept code for CVE-2026-55040, a Microsoft SharePoint vulnerability that allows an unauthenticated attacker to forge JSON Web Tokens—the signed credentials SharePoint uses to establish identity. Reporting published August 12 says attackers began using the technique shortly after the code appeared, with eight of 12 recorded attempts occurring across August 12 and 13. [DEVELOPING]

That changes the problem from “patch a serious bug” to “assume exposed authentication boundaries are being tested.” A successful attacker can impersonate SharePoint users, including administrators, without stealing their passwords first.

Organizations that move quickly can close the direct path and examine pre-patch activity for forged-token use. Failure looks like a patched server with an already-established intruder behind it; the signal will be downstream reports of data theft, persistence, or administrator activity that cannot be tied to a legitimate login.

Adobe’s August 11 bulletin fixed CVE-2026-71362, an authorization flaw affecting Adobe Commerce, Adobe Commerce B2B, and Magento Open Source. Adobe said it knew of no exploitation when the bulletin was published, but BleepingComputer subsequently reported that Sansec had observed exploitation attempts against customers. [DEVELOPING] (Adobe Commerce Stores Are Already Seeing Account-Hijacking Attempts)

The flaw can let an unauthenticated attacker interfere with customer identity inside a session, potentially exposing account information or enabling fraudulent changes and orders. For merchants, the winning move is not merely installing Adobe’s update; it is pairing the patch with a review of address changes, unfamiliar sessions, account edits, and suspicious purchases.

If attempted exploitation becomes confirmed account compromise, patch-only closure will have failed. The observable signal will be Adobe or affected merchants reporting hijacked accounts created before the update was installed. (Adobe Commerce Stores Are Already Seeing Account-Hijacking Attempts)

US-based SaaS security company Reco disclosed an ongoing campaign it calls City-Forum, which automates data collection from Salesforce Experience Cloud and ServiceNow portals configured to reveal records to anonymous visitors. Reco says this is not a vulnerability in Salesforce or ServiceNow: customer-controlled guest permissions created the opening.

Reco associated activity against telecommunications companies, banks, software vendors, security companies, and public-sector portals with a shared network fingerprint. One Salesforce target recorded more than 560,000 requests connected to guest-user enumeration—the systematic discovery of records available without logging in.

Organizations that audit guest sharing rules, file access, search interfaces, and public APIs can shut the filing cabinet before someone finishes emptying it. Non-adoption will look like victim disclosures and regulatory notices; that would turn a configuration problem into a recognizable class of SaaS breach.

The Hacker News reports that researchers identified 737 Chrome extensions routing browser traffic through SOCKS5 proxies controlled by the operation behind them. The extensions accumulated 75,486 installations, while 274 impersonated 66 VPN and privacy brands, including Proton VPN, NordVPN, Surfshark, ExpressVPN, and Cloudflare’s 1.1.1.1.

A proxy sits directly in a user’s traffic path. That makes this more consequential than a collection of misleading icons: affected extensions could redirect browsing sessions through infrastructure users neither selected nor understood.

Google removals can reduce immediate exposure, but the campaign succeeds if publishers can simply return with new names and extension IDs. The deciding signal will be whether the same proxy infrastructure or developer identities reappear inside productivity, password-management, or security-themed extensions.

No fresh foreign-language item without English coverage cleared the operational threshold for this edition. Xakep’s new Russian-language entries covered VPS setup, a business book, and JavaScript license-check analysis—not new threat actors, exploitation, malware, or incident intelligence worth padding a 24-hour briefing with.

A forged SharePoint badge, a Magento customer mask, and a “privacy” extension feeding the browser through someone else’s basement: trust had a visually complicated Thursday.

Meanwhile, the public SaaS portal continues insisting the filing cabinet was technically outside.

Check the guest account.

Forward this to whoever still thinks browser extensions are the harmless kind of add-on.