(TLP CLEAR) Weekly Vulnerabilities to Prioritize – August 20, 2026

The below vulnerabilities have been identified by WaterISAC analysts as important for water and wastewater utilities to prioritize in their vulnerability management efforts. WaterISAC shares critical vulnerabilities that affect widely used products and may be under active exploitation. WaterISAC draws additional awareness in alerts and advisories when vulnerabilities are confirmed to be impacting, or have a high likelihood of impacting, water and wastewater utilities. Members are encouraged to regularly review these vulnerabilities, many of which are often included in CISA’s Known Exploited Vulnerabilities (KEV) Catalog.

Microsoft Internet Key Exchange (IKE) Service Extensions Double Free Vulnerability

CVSS v3.1: 9.8
CVEs: CVE-2026-33824
Description: Double free in Windows IKE Extension allows an unauthorized attacker to execute code over a network. CISA added this vulnerabilities to its Known Exploited Vulnerability Catalog.
Source: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33824

Broadcom VMware vCenter Path Traversal Vulnerability

CVSS v3.1: 9.8
CVEs: CVE-2026-59310
Description: VMware vCenter contains a directory traversal vulnerability in the Syslog server. A malicious actor with network access to vCenter may exploit this issue to execute arbitrary code. CISA added this vulnerabilities to its Known Exploited Vulnerability Catalog.
Source: https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/38017

Apple macOS Improper Authentication Vulnerability

CVSS v3.1: 9.8
CVEs: CVE-2026-65400
Description: An authentication issue was addressed with improved state management. This issue is fixed in macOS Sequoia 15.7.9, macOS Sonoma 14.8.9, macOS Tahoe 26.6.1. An attacker on the network may be able to authenticate to Screen Sharing without valid credentials. CISA added this vulnerabilities to its Known Exploited Vulnerability Catalog.
Source: https://seclists.org/fulldisclosure/2026/Aug/36

Microsoft SharePoint Weak Authentication Vulnerability

CVSS v3.1: 9.1
CVEs: CVE-2026-55040
Description: Weak authentication in Microsoft Office SharePoint allows an unauthorized attacker to bypass a security feature over a network. CISA added this vulnerabilities to its Known Exploited Vulnerability Catalog.
Source: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55040

Windchill PDMlink Remote Code Execution (RCE) vulnerability

CVSS v3.1: 9.3
CVEs: CVE-2026-12569
Description: A critical remote code execution (RCE) vulnerability has been reported in PTC Windchill PDMlink and PTC FlexPLM. The vulnerability may be exploited through the deserialization of untrusted data.  * This advisory also applies to all CPS versions * The identified vulnerability also impacts Windchill and FlexPLM releases prior to 11.0 M030.
Source: https://www.ptc.com/en/support/article/CS473270

MLflow Tracking Server Vulnerability

CVSS v3.1: 9.3
CVEs: CVE-2026-64849
Description: MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. Prior to 3.15.0, the unauthenticated POST /api/2.0/mlflow/webhooks/{id}/test endpoint calls _validate_webhook_url() in mlflow/utils/validation.py only for the original URL while mlflow/webhooks/delivery.py follows redirects and re-resolves the hostname without pinning the validated address, allowing attackers to reach internal or cloud metadata services and receive response_status and response_body. This issue is fixed in version 3.15.0. CISA added this vulnerabilities to its Known Exploited Vulnerability Catalog.
Source: https://github.com/mlflow/mlflow/security/advisories/GHSA-7gwp-5pfp-969j

Ray RCE Vulnerability

CVSS v4.0: 9.4
CVEs: CVE-2025-62593
Description: Ray is an AI compute engine. Prior to version 2.52.0, developers working with Ray as a development tool can be exploited via a critical RCE vulnerability exploitable via Firefox and Safari. This vulnerability is due to an insufficient guard against browser-based attacks, as the current defense uses the User-Agent header starting with the string “Mozilla” as a defense mechanism. This defense is insufficient as the fetch specification allows the User-Agent header to be modified. Combined with a DNS rebinding attack against the browser, and this vulnerability is exploitable against a developer running Ray who inadvertently visits a malicious website, or is served a malicious advertisement (malvertising). This issue has been patched in version 2.52.0.
Source: https://github.com/ray-project/ray/security/advisories/GHSA-q279-jhrf-cc6v