Morning Brief — 2026-08-12

4 material breach disclosures, 3 federal patching priority, 1 exploit probability movers, 10 emerging critical cves, 7 supply chain, 27 ransomware activity, 2232 ioc volume, 17 active malware families, 8 multi-source iocs, 1 cross-reference, 4 intel feeds, 9 hand-authored sigma, and 17 detection gaps. Sections with no signal are still rendered with an explicit “none in this window” note so absence is visible alongside presence.

Material Breach Disclosures

Alto Ingredients, Inc. (ALTO)

• Filed: 2026-08-07 · CIK 0000778164 · Accession 0001213900-26-086750
• Filing: https://www.sec.gov/Archives/edgar/data/778164/000121390026086750/ea030067001ex10-1.htm

any governmental authority or affected individuals regarding any such incident. There has been no such Breach, and the Company has not been notified of and has no knowledge of any event or condition that would reasonably be expected to result in, any such Breach, except in each case as would not reasonably be expected, individually or in the aggregate, to result in a Material Adverse Effect.

(…

Vivos Therapeutics, Inc. (VVOS)

• Filed: 2026-08-03 · CIK 0001716166 · Accession 0001493152-26-035867
• Filing: https://www.sec.gov/Archives/edgar/data/1716166/000149315226035867/ex10-2.htm

other applicable SEC cybersecurity disclosure rules. Provider shall maintain cyber liability and privacy liability insurance in amounts reasonably sufficient to cover its obligations under this Section 7.8, and shall provide Client with certificates of such insurance upon request.

Intellectual Property

8.1 Client Property. All financial statements, filings, board materials, internal con…

AMGEN INC (AMGN)

• Filed: 2026-07-31 · CIK 0000318154 · Accession 0000318154-26-000119
• Filing: https://www.sec.gov/Archives/edgar/data/318154/000031815426000119/amgn-20260729.htm

The Company has since learned that some of its data, including proprietary data, patient protected health information, and other information, has been exfiltrated from these cloud environments. To date, the Company has not identified any impact to its products, manufacturing operations, or financial reporting systems, or to the Company’s ability to meet patient needs. The investigation remains ong…

River Financial Corp (RVRF)

• Filed: 2026-07-30 · CIK 0001641601 · Accession 0001193125-26-325324
• Filing: https://www.sec.gov/Archives/edgar/data/1641601/000119312526325324/ck0001641601-20260619.htm

Since the date of the original filing, River’s investigation has progressed. River has determined that an unauthorized threat actor accessed portions of its network and removed certain data from its environment. River is working to determine the nature and scope of the information involved, including whether any personally identifiable information was affected. As part of its response, River took…

Federal Patching Priority

CVE-2026-72898 — Metabase Metabase

Metabase SQL Injection Vulnerability

• Added: 2026-08-11 · Federal due: 2026-08-14 · EPSS 49.5th pct (score 0.007) · CVSS 10.0 (CRITICAL) · CWE-89
• ransomware use: Unknown

Metabase contains a SQL Injection vulnerability that allows an unauthenticated remote attacker to inject arbitrary SQL into the Metabase application database, which can give them administrator access to the instance. From there, the attacker could change the application configuration, steal stored credentials for the connected databases, read any data accessible through those connections, and export data.

Metabase allows a remote, unauthenticated attacker to inject arbitrary SQL via the ‘/reset_password’ database endpoint and gain administrator access to the connected Metabase instance.

CVE-2026-20349 — Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD)

Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) Heap Inspection Vulnerability

• Added: 2026-08-11 · Federal due: 2026-08-14 · CVSS 8.6 (HIGH) · CWE-244
• ransomware use: Unknown

Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) contain a heap inspection vulnerability that could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting in a denial of service (DoS) condition.

A vulnerability in the Remote Access SSL VPN service for Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting in a denial of service (DoS) condition.  This vulnerability is due to insufficient error checking when processing…

CVE-2026-68820 — Microsoft Windows Ancillary Function Driver for WinSock

Microsoft Windows Ancillary Function Driver for WinSock Use-After-Free Vulnerability

• Added: 2026-08-11 · Federal due: 2026-08-25 · CVSS 7.0 (HIGH) · CWE-416
• ransomware use: Unknown

Microsoft Windows Ancillary Function Driver for WinSock contains a use-after-free vulnerability that allows an authorized attacker to elevate privileges locally.

Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.

Exploit Probability Movers

Emerging Critical CVEs

• CVE-2026-45618 · CRITICAL (10.0) · 2026-08-11 — LiquidJS is a Shopify/GitHub Pages compatible template engine. Prior to version 10.26.0, it is possible to execute arbitrary code with crafted templates. Version 10.26.0 patches the issue.
• CVE-2026-71398 · CRITICAL (10.0) · 2026-08-11 — Adobe Campaign Classic (ACC) is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execu…
• CVE-2026-27302 · CRITICAL (10.0) · 2026-08-11 — Adobe Campaign Classic (ACC) is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execu…
• CVE-2026-48362 · CRITICAL (10.0) · 2026-08-11 — ColdFusion is affected by an Improper Neutralization of Special Elements used in an OS Command (‘OS Command Injection’) vulnerability that could result in arbitrary code execution in the context of the current user. An a…
• CVE-2026-17061 · CRITICAL (10.0) · 2026-08-11 — A Deserialization of Untrusted Data vulnerability affecting SIMULIA Execution Engine from Release 2023 through Release 2026 could lead to an unauthenticated remote code execution.
• CVE-2026-48056 · CRITICAL (10.0) · 2026-08-11 — Streambert is a cross-platform Electron Desktop App to stream and download video content. Versions prior to 2.5.0 improperly validate executable paths supplied to the  run-download  IPC handler, allowing a compromised r…
• CVE-2026-58115 · CRITICAL (10.0) · 2026-08-11 — A vulnerability has been identified in SIMATIC IoT2050 Advanced (6ES7647-0BA00-1YA2) (All versions < V4.3.4.1 running Industrial OS with Node-RED installed). Affected devices do not enforce authentication on the Node-RED…
• CVE-2026-58231 · CRITICAL (10.0) · 2026-08-11 — SAP Commerce Cloud allows an unauthenticated attacker to abuse a default authentication client and submit specially crafted input to certain functions lacking sufficient validation. Successful exploitation could enable a…
• CVE-2026-72526 · CRITICAL (9.9) · 2026-08-12 — A flaw was found in the multicloud-integrations component. The Application propagation controller processes the ocm-managed-cluster annotation from an Application Custom Resource (CR) without proper validation. A tenan…
• CVE-2026-48765 · CRITICAL (9.9) · 2026-08-11 — TypeBot is a chatbot builder tool. Versions prior to 3.17.0 allow a low-privilege read collaborator to extract a workspace OAuth credentialsId from a readable bot configuration and then overwrite that credential throug…

Supply Chain

GHSA-vg44-h755-9hw7 · CVE-2026-62871 (nuget)

• HIGH · CVSS 7.8 · 2026-08-11
• Affected: Microsoft.WindowsDesktop.App.Runtime.win-arm64, Microsoft.WindowsDesktop.App.Runtime.win-x64, Microsoft.WindowsDesktop.App.Runtime.win-x86
• https://github.com/advisories/GHSA-vg44-h755-9hw7

Microsoft Security Advisory CVE-2026-62871 – .NET Elevation of Privilege Vulnerability

GHSA-fx4q-gjrx-2jw6 · CVE-2026-62897 (nuget)

• HIGH · CVSS 7.0 · 2026-08-11
• Affected: Microsoft.WindowsDesktop.App.Runtime.win-arm64, Microsoft.WindowsDesktop.App.Runtime.win-x64, Microsoft.WindowsDesktop.App.Runtime.win-x86
• https://github.com/advisories/GHSA-fx4q-gjrx-2jw6

Microsoft Security Advisory CVE-2026-62897 – .NET Remote Code Execution Vulnerability

GHSA-gg8c-3338-xw2f · CVE-2026-70354 (nuget)

• HIGH · CVSS 7.8 · 2026-08-11
• Affected: Microsoft.WindowsDesktop.App.Runtime.win-arm64, Microsoft.WindowsDesktop.App.Runtime.win-x64, Microsoft.WindowsDesktop.App.Runtime.win-x86
• https://github.com/advisories/GHSA-gg8c-3338-xw2f

Microsoft Security Advisory CVE-2026-70354 – .NET Core Remote Code Execution Vulnerability

GHSA-jqhp-238x-qhgf · CVE-2026-62886 (nuget)

• HIGH · CVSS 7.8 · 2026-08-11
• Affected: Microsoft.WindowsDesktop.App.Runtime.win-arm64, Microsoft.WindowsDesktop.App.Runtime.win-x64, Microsoft.WindowsDesktop.App.Runtime.win-x86
• https://github.com/advisories/GHSA-jqhp-238x-qhgf

Microsoft Security Advisory CVE-2026-62886 – .NET Elevation of Privilege Vulnerability

GHSA-m93f-wj8c-rp8p · CVE-2026-62901 (nuget)

• HIGH · CVSS 7.5 · 2026-08-11
• Affected: Microsoft.NETCore.App.Runtime.win-arm64, Microsoft.NETCore.App.Runtime.win-x64, Microsoft.NETCore.App.Runtime.win-x86
• https://github.com/advisories/GHSA-m93f-wj8c-rp8p

Microsoft Security Advisory CVE-2026-62901 – .NET Denial of Service Vulnerability

GHSA-c494-m2fq-59mx · CVE-2026-62898 (nuget)

• HIGH · CVSS 7.5 · 2026-08-11
• Affected: Microsoft.NETCore.App.Runtime.win-arm64, Microsoft.NETCore.App.Runtime.win-x64, Microsoft.NETCore.App.Runtime.win-x86
• https://github.com/advisories/GHSA-c494-m2fq-59mx

Microsoft Security Advisory CVE-2026-62898 – .NET Information Disclosure Vulnerability

GHSA-87fv-vqqr-m4jr · CVE-2026-73080 (go)

• CRITICAL · CVSS 9.3 · 2026-08-11
• Affected: github.com/seaweedfs/seaweedfs
• https://github.com/advisories/GHSA-87fv-vqqr-m4jr

SeaweedFS: Unauthenticated SSRF with response read-back via VolumeServer.FetchAndWriteNeedle

Ransomware Activity

27 new victim postings across 12 groups.

IOC Volume

2232 new IOCs in this window. By source:

Recent OSINT Events

No curated MISP events in this window (bulk-IOC contributions tallied in IOC Volume).

Active Malware Families

17 malware families active this week (2 corroborated across ≥2 sources), exercising 16 ATT&CK techniques. Family is the unit, not the indicator: the raw IOCs are drill-down evidence below, not the signal.

Families marked ”→” are delivery/social-engineering clusters (ClickFix, GuLoader). Their technique mappings are the delivery chain — downstream behavior is payload-dependent, so they don’t open a hard coverage gap on their own.

Multi-Source IOCs

8 IOCs flagged by 2+ independent sources this window — the highest-confidence signal the cross-feed corpus produces.

MISP × KEV Correlation

No MISP events in this window referenced a CVE.

Cross-Reference

Alto Ingredients, Inc. (filed 2026-08-07)

Token match on alto against KEV vendor/product strings. This is a heuristic — verify before treating as attribution.

• CVE-2026-0257 — Palo Alto Networks PAN-OS (added 2026-05-29)

Intel Feeds

4 IOC feeds updated this run (10,550 indicators total) — each available as CSV, MISP JSON, and STIX 2.1. Subscribe at https://thrunt.me/intel/manifest.json.

Hand-Authored Sigma

7 production-ready TTP rules (+2 scaffolds in the authoring queue) live at https://thrunt.me/sigma/manifest.json. Subscribe via https://thrunt.me/sigma/rules.lock.json (content-hash churn) or pull all with https://thrunt.me/sigma/rules.tar.gz.

Detection Gaps

17 of 156 techniques with corpus signal have zero detection coverage — no SigmaHQ community rule, no thrunt rule. This is the hand-authoring queue; the live view is at https://thrunt.me/corpus/attck/.

…and 7 more below the cut — full list on the rollup.

Pipeline Health

All feeds healthy.

Sources: SEC EDGAR (public domain), CISA Known Exploited Vulnerabilities (public domain), FIRST.org EPSS (per ToS), NIST NVD (public domain), GitHub Security Advisories (per ToS), abuse.ch URLhaus (CC0, attribution), ransomware.live (per ToS), MITRE ATT&CK (CC BY 4.0).

Published by Applied Cybernetics Group via thrunt.me. Heuristic cross-references are labelled as such; verify before action.