MSP Weekly

This week's news, matched to the services you sell. Select your offerings below to see where you sell the fix.

Issue: Week of 10 August 2026 · Last updated: 12 August 2026 00:47 UTC · Subscribe (RSS)

This week's standard client maintenance window

The KEV / critical set every client should patch on their normal cadence — package it as one scheduled window across the portfolio. This week's must-patch list → · why this sells →

My service offerings

Check the services you provide. We'll flag and float this week's items your services fix. Saved on this device only; no account needed.

User Phishing simulation Training

Identity End-user elevation MFA SSO Help Desk validation

Applications WAF Vulnerability Management

Email Gateway IEP (M365 email protection) Email archiving

Data DLP M365 backup Entra ID backup Google Backup

Network Firewall SASE/SSE AI security

Managed XDR Managed XDR

GRC Risk Management Compliance Third-party

Show only items my offerings cover

Where your offerings are the answer this week

VulnerabilityKEV: CVE-2026-72898 — Metabase Metabase (Metabase SQL Injection Vulnerability)
Check client inventories for self-hosted Metabase instances and patch CVE-2026-72898 to 0.51.5+ immediately; cloud Metabase tenants are unaffected.
CVE-2026-20230 · CVE-2026-20349 · CVE-2026-68820 · CVE-2026-72898NIST 800-53 · AC-4 · SA-11 · SA-8NIST 800-53 · AC-4 · SA-11 · SA-8Prevent: End-user elevation · Vulnerability Management · Firewall · SASE/SSE · WAF Detect: Managed XDR Respond: Managed XDR
VulnerabilityKEV: CVE-2025-68686 — Fortinet FortiOS (Fortinet FortiOS Exposure of Sensitive Information to an Unauthorized Actor Vulnerability)
Inventory every client FortiOS/FortiGate instance, map versions against Fortinet’s fixed builds, and schedule upgrades under the KEV window. Flag any appliance already known compromised or left on unsupported builds.
CVE-2025-68686 · CVE-2026-16812 · CVE-2026-18577NIST 800-53 · AC-25 · AC-3 · AC-4NIST 800-53 · AC-25 · AC-3 · AC-4Prevent: Firewall · SASE/SSE · End-user elevation · Vulnerability Management · WAF Detect: SASE/SSE · Managed XDR · Vulnerability Management · WAF Respond: Managed XDR
VulnerabilityNew critical CVE: CVE-2026-50522 — Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code over a
Inventory every client running on-prem SharePoint Server (any edition); prioritize patching CVE-2026-56164 and the other actively exploited CVEs across all tenants before addressing lower-severity SharePoint CVEs in this batch.
CVE-2025-40602 · CVE-2026-15409 · CVE-2026-15410 · CVE-2026-32201NIST 800-53 · AC-14 · AC-24 · AC-25NIST 800-53 · AC-14 · AC-24 · AC-25Prevent: MFA · Vulnerability Management · End-user elevation · Firewall · SASE/SSE Detect: Managed XDR · SASE/SSE · Gateway · IEP (M365 email protection) Respond: Managed XDR
VulnerabilityKEV: CVE-2026-0770 — Langflow Langflow (Langflow Inclusion of Functionality from Untrusted Control Sphere Vulnerability)
Scan all client environments for Langflow deployments — it's often spun up ad hoc for AI prototyping and easy to miss in asset inventories — and patch or take exposed instances offline first.
CVE-2021-27137 · CVE-2026-0770 · CVE-2026-60137 · CVE-2026-63030NIST 800-53 · AC-6 · SA-11 · SA-15NIST 800-53 · AC-6 · SA-11 · SA-15Prevent: End-user elevation · Vulnerability Management · Firewall · SASE/SSE · WAF Detect: Managed XDR · Vulnerability Management · SASE/SSE Respond: Managed XDR
VulnerabilityErlang security advisory (AV26-750)
Scan client stacks for Erlang/OTP and coordinate updates to the fixed versions cited in AV26-750 and the linked erlang/otp advisories.
CVE-2026-18972CSF 2.0 · ID.RA-01 · PR.PS-02ISO 27001 · A.8.29 · A.8.8Prevent: MFA · SSO · SASE/SSE · Vulnerability Management · Firewall Detect: Managed XDR · SASE/SSE Respond: Managed XDR
VulnerabilityBulletin de sécurité Red Hat (AV26-803)
Check which clients run Red Hat Advanced Cluster Management for Kubernetes 2 and schedule the AV26-803 updates promptly.
CVE-2026-10090CSF 2.0 · ID.RA-01 · PR.PS-02ISO 27001 · A.8.29 · A.8.8Prevent: End-user elevation · MFA · Vulnerability Management · Help Desk validation · SSO Detect: Managed XDR Respond: Managed XDR
VulnerabilityPatch bundle: July 2026 Security Updates — 1164 CVEs, 3 exploited
Inventory which clients run on-prem SharePoint Server versus SharePoint Online — only the former needs emergency action for CVE-2026-58644. Push the other three exploited CVEs (2026-56155, 2026-56164, 2026-48561) across the fleet this week; the rest of the 1164 can wait for standard rollout.
CVE-2026-41106 · CVE-2026-42990 · CVE-2026-45499 · CVE-2026-48561NIST 800-53 · AC-14 · AC-24 · AC-3NIST 800-53 · AC-14 · AC-24 · AC-3Prevent: Vulnerability Management · Firewall · SASE/SSE · MFA · Gateway Detect: SASE/SSE · Managed XDR · Gateway · IEP (M365 email protection) · WAF Respond: Managed XDR · IEP (M365 email protection)
VulnerabilityOpenAI Launches Two-Tier Security Access Program Alongside GPT 5.6 Cyber
Track client adoption of Daybreak Red; advise only mature clients with explicit red-team needs, and watch for policy or compliance implications around reduced guardrails.
CVE-2026-15903Prevent: Vulnerability Management · Firewall · SASE/SSE · End-user elevation · WAF Detect: Managed XDR · SASE/SSE Respond: Managed XDR
VulnerabilityGunra Ransomware Exploits Fortinet and Schneider Electric Flaws to Breach Networks
Audit all managed Fortinet firewalls, VPNs, and Schneider Electric devices for the listed vulnerabilities and ensure MFA is enforced on management interfaces. Gunra is using these exact flaws plus Conti-derived ransomware against critical-infrastructure clients.
CVE-2024-5559 · CVE-2025-24472CSF 2.0 · DE.CM-01 · DE.CM-09 · ID.RA-01ISO 27001 · A.5.30 · A.8.12 · A.8.13Prevent: Vulnerability Management · MFA · Firewall · SASE/SSE · WAF Detect: Vulnerability Management · Managed XDR · SASE/SSE Respond: Managed XDR
VulnerabilityKEV: CVE-2026-20316 — Cisco Secure Firewall Management Center (FMC) (Cisco Secure Firewall Management Center Use of Hard-coded Password Vulnerability)
Inventory every client with Cisco Secure Firewall Management Center; prioritize CVE-2026-20316—hard-coded credentials, unauthenticated remote access, actively exploited, now KEV. Patch or mitigate per Cisco, then check for unexpected logins on affected FMC instances.
CVE-2026-20316NIST 800-53 · IA-5NIST 800-53 · IA-5Prevent: SASE/SSE · MFA · Firewall · End-user elevation · Vulnerability Management Detect: Managed XDR Respond: Managed XDR
VulnerabilityKEV: CVE-2026-46817 — Oracle E-Business Suite (Oracle E-Business Suite Improper Privilege Management Vulnerability)
Inventory all client instances of Oracle E-Business Suite, flag any with Oracle Payments exposed to the network, and push the patch as emergency change — this is unauthenticated network exploitation, not a low-priority ticket.
CVE-2023-4346 · CVE-2026-25089 · CVE-2026-35263 · CVE-2026-35292NIST 800-53 · AC-14 · AC-2 · AC-3NIST 800-53 · AC-14 · AC-2 · AC-3Prevent: Firewall · SASE/SSE · Vulnerability Management · WAF · End-user elevation Detect: Managed XDR · SASE/SSE · Vulnerability Management Respond: Managed XDR Recover: Entra ID backup · M365 backup

For your client sectors

This week’s stories across all client sectors — pick your sectors in the header above to focus on the industries you serve.

Leak-site claim: Orova lists Ganzhou Xinye Craft Co., Ltd.Ganzhou Xinye Craft Co., Ltd.
Leak-site claim: Panzer lists Xpress TechXpress Tech
Leak-site claim: qilin lists G.M.A.G.M.A. GRANDI MARCHE AUTOMOBILI - S.R.L
Leak-site claim: payload lists B&B HydraulikB&B Hydraulik
Leak-site claim: payload lists Stücheli ArchitektenStücheli Architekten
Leak-site claim: payload lists Baya TechnologiesBaya Technologies
Leak-site claim: krybit lists www.apsanet.com.arwww.apsanet.com.ar
Leak-site claim: qilin lists Service Evaluation ConceptsService Evaluation Concepts
Leak-site claim: qilin lists tommer constructiontommer construction
Leak-site claim: direwolf lists LeafwellLeafwell
Leak-site claim: aurora lists FREYWILLEFREYWILLE

More for MSPs: Coverage demonstrator Client advisory Portfolio exposure Your toolchain The playbook

How we write these. Every item names the control that fixes it and the service you offer to deliver it. We never flag a threat without its fix; revenue is a bonus, not the pitch.