The Week Attackers Went After the Tools That Manage Everything Else

The first week of August followed an unusually clear pattern. Not one of the major vulnerabilities targeted endpoints or users. All of them targeted the tools that manage infrastructure — a build server, a remote management platform, a firewall console, a network gateway.

The attacker logic is easy enough to follow. Why hunt workstations one at a time when you can compromise the system that manages all of them at once.

Here are the five things worth attention this week.

1. JetBrains TeamCity — remote code execution without credentials

CVE-2026-63077 · CVSS 9.8 · actively exploited · patch available

TeamCity is JetBrains' build and continuous integration server, and in many organisations it holds the entire development pipeline together. The flaw is an unsafe deserialisation issue in the agent polling protocol. An attacker who can reach the server over HTTP or HTTPS can execute operating system commands without any credentials, running with the privileges of the TeamCity server process.

The timeline is instructive. JetBrains published a fix on 27 July and had no knowledge of exploitation at that point. Within days, reports of real attacks on unpatched servers started coming in. On 5 August, CISA added the vulnerability to its Known Exploited Vulnerabilities catalog and set a remediation deadline of 8 August for US federal agencies.

Why this is worse than it looks: a build server inherently has access to source code, signing keys, production credentials, and the entire deployment chain. Compromising TeamCity is not a single-server incident — it is a potential breach of everything shipped through it.

What to do: Upgrade to 2025.11.7 or 2026.1.3. If the server was internet-facing and you could not patch immediately, assume compromise: rotate the credentials, signing keys, and tokens TeamCity had access to, and review build history for tampering.

2. N-able N-central — one platform, dozens of customers

CVE-2026-18577 · actively exploited since 1 August · patch available

N-central is a remote monitoring and management platform used by managed service providers and internal IT teams. The flaw lets an unauthenticated attacker bypass login and obtain administrative control of the server.

What follows is the real problem. Attackers use the built-in Take Control remote access feature to reach customers' managed endpoints, and deploy Cloudflare Tunnel for persistent access. One compromised server therefore means a potential breach into every client that provider manages.

An uncomfortable detail: this is not a new vulnerability but a new way of exploiting a previously patched flaw (CVE-2026-18556). The original fix did not close every path.

CISA added the vulnerability to the KEV catalog on 3 August.

What to do: Upgrade to 2026.3.1.10 — the second hotfix, released on 6 August. The first fix (2026.3.1.7) proved insufficient, so the version number alone is not enough: verify you have the second one. Both on-premises and cloud-hosted deployments are affected. Review administrator accounts, Take Control usage logs, and look for a cloudflared process on managed endpoints.

If your IT is delivered by an external provider, it is entirely reasonable to ask whether they run N-central and what state it is in. Their security is part of your risk.

3. Cisco Secure Firewall Management Center — a password baked into the product

CVE-2026-20316 · actively exploited · patch available

Secure Firewall Management Center is the central console for managing Cisco firewalls. The vulnerability is a hard-coded password — credentials written into the product itself that cannot be changed through normal configuration.

This class of flaw is unpleasant for two reasons. First, it is trivially exploitable once the credentials are public. Second, the target is not a single firewall but the console that governs all of them — the place from which rules can be changed across the entire network.

CISA added it to the catalog on 29 July.

What to do: Apply Cisco's fix. Check whether the console is reachable from anywhere other than your management network, and restrict it if so. Review audit logs for firewall rule changes.

4. Fortinet FortiOS and Arista VeloCloud — two holes on the perimeter

CVE-2025-68686 (Fortinet) and CVE-2026-16812 (Arista) · actively exploited · patches available

On 27 July, CISA added two perimeter device vulnerabilities to the KEV catalog on the same day.

Fortinet FortiOS exposes sensitive information to an unauthorised actor. This is typically the first step in a longer chain, since the data obtained feeds the next stage of an attack.

Arista VeloCloud Orchestrator in on-premises deployments contains an OS command injection flaw. VeloCloud Orchestrator governs SD-WAN environments, so the same pattern repeats — the target is the tool that manages the network.

What to do: Check your versions of both products if you run them, and apply the fixes. For perimeter devices, it is also worth verifying whether their management interfaces have ever been exposed to the internet.

5. From the wider security world — 16 years for ransomware

Not everything this week was about patching.

On 5 August, a federal court in Alexandria, Virginia sentenced Maksim Silnikau to 16 years in prison. Silnikau was behind Ransom Cartel, the ransomware-as-a-service operation he launched in 2021 — a model where the operator supplies the malware and infrastructure to other attackers in exchange for a share of the ransom.

Why this matters even to organisations not directly dealing with ransomware: a sixteen-year sentence is among the harshest ever handed down in the US for this category of crime. It fits a pattern of law enforcement focusing on platform operators rather than individual attackers.

The practical effect on corporate defence, however, is roughly zero. The ransomware-as-a-service model is widespread enough that removing one player shifts attackers elsewhere rather than reducing attack volume.

Priority summary

What to take away from this week

All five technical vulnerabilities share one thing: the target was not an endpoint or a user, but a tool that manages something else. A build server, a remote management platform, a firewall console, an SD-WAN orchestrator, a perimeter gateway.

That points to a concrete task you can complete this week: make a list of the systems that manage other systems in your environment, and verify they are patched and not needlessly reachable from the internet. There are usually fewer of them than people expect, and they protect more than most other controls.

The second lesson concerns patches that do not patch. N-able was fixing a flaw whose previous fix proved insufficient. Applying an update is not the end of the process — you need to verify the patched version actually resolves the issue.

Struggling to keep up?

We publish this roundup weekly. Reading it is only the first step, though. The harder part is knowing which vulnerabilities actually affect you, in what order to address them, and who in the organisation owns that.

That is where we help: security assessment and vulnerability management · external security manager · technology selection and deployment

Book a free consultation → · Dealing with an incident right now? →

We will tell you plainly what is worth addressing first. Free, answer within 24 hours.