Week of August 17, 2026: Siemens PLC Threat Advisory and a Wave of CISO Moves

Security leaders faced a joint federal warning about AI-assisted attacks on Siemens S7 PLCs and eight new CISA Known Exploited Vulnerabilities Catalog additions spanning Zimbra, TrueConf, Microsoft, VMware, Apple, Ray, and MLflow software. CISA also published logging guidance for federal agencies, and Marriott International, Allied Universal, Glow, and Vensure Employer Solutions announced new chief information security officers.

CISA Flags Actively Exploited Ray AI Framework Flaw

On August 17, 2026, CISA added CVE-2025-62593, a code injection vulnerability in the Ray-Project Ray framework, to its Known Exploited Vulnerabilities Catalog after confirming active exploitation. The addition triggers remediation deadlines under Binding Operational Directive 26-04, which requires federal civilian agencies to prioritize rapid patching of vulnerabilities that grant attackers full control of exposed assets. CISA said this vulnerability type remains a frequent attack vector for malicious cyber actors and encouraged all organizations, not just federal agencies, to adopt the same risk-based remediation priorities. (CISA)

CISA Adds Four Actively Exploited Flaws Including Microsoft and VMware Bugs

On August 18, 2026, CISA added four vulnerabilities to its KEV Catalog based on evidence of active exploitation: a Microsoft IKE Service Extensions double free flaw (CVE-2026-33824), a Microsoft SharePoint weak authentication bug (CVE-2026-55040), a Broadcom VMware vCenter path traversal issue (CVE-2026-59310), and an Apple macOS improper authentication vulnerability (CVE-2026-65400). Federal civilian agencies must remediate these under Binding Operational Directive 26-04, which prioritizes vulnerabilities enabling full system takeover on internet-exposed assets. CISA urged all organizations to apply the same risk-based prioritization. (CISA)

NSA, CISA, FBI Warn of Active AI-Assisted Attacks on Siemens S7 PLCs

On August 19, 2026, CISA, the NSA, FBI, DOE, and EPA issued joint advisory AA26-231A warning that threat actors were conducting reconnaissance and developing exploits against Siemens S7 Series PLCs using AI-generated scripts disguised as legitimate monitoring tools. The agencies said attackers used Internet scanning services to locate exposed, outdated controllers across Critical Manufacturing, Energy, Water and Wastewater, Chemical, Food and Agriculture, and Commercial Facilities sectors. The advisory called the activity "not a theoretical risk" and urged owners to patch, isolate PLCs from the Internet, strengthen access controls, and hunt for compromise indicators. (CISA)

CISA Catalogs Actively Exploited MLflow SSRF Vulnerability

On August 19, 2026, CISA added CVE-2026-64849, a server-side request forgery vulnerability in MLflow Server, to its Known Exploited Vulnerabilities Catalog following evidence of active exploitation. The addition places the flaw under Binding Operational Directive 26-04's remediation requirements for federal civilian agencies, which must prioritize vulnerabilities on internet-exposed assets that grant attackers full control after exploitation. The move highlighted continued attention on machine-learning infrastructure tooling alongside traditional enterprise software vulnerabilities added to the catalog during the week. (CISA)

CISA Adds Two Exploited TrueConf Server Vulnerabilities

On August 20, 2026, CISA added two TrueConf Server vulnerabilities to its KEV Catalog: a missing authentication for critical function flaw (CVE-2026-72529) and a code injection vulnerability (CVE-2026-72530), both confirmed as actively exploited. Federal civilian agencies are required under Binding Operational Directive 26-04 to remediate these vulnerabilities on a prioritized basis, particularly where they affect internet-exposed assets granting attackers control. CISA reiterated that these vulnerability types remain a frequent attack vector for malicious cyber actors targeting collaboration and video-conferencing infrastructure. (CISA)

CISA Publishes Logging Reference Architecture for Federal Agencies

On August 20, 2026, CISA released its Logging Reference Architecture, an outcome-driven guide developed with OMB and the CISO Council to help federal civilian agencies establish logging, visibility, and operational standards required by OMB Memorandum M-26-14. Agencies must submit an Agency Logging Plan informed by the guidance to OMB and CISA by November 18, 2026. CISA said the guidance moves agencies away from fragmented logging practices toward a mature enterprise capability, and it encouraged critical infrastructure operators and state and local governments to use the architecture to benchmark their own monitoring programs. (CISA)

CISA Adds Actively Exploited Zimbra Command Injection Flaw

On August 21, 2026, CISA added CVE-2026-73570, an OS command injection vulnerability in Zimbra Collaboration Suite, to its Known Exploited Vulnerabilities Catalog after confirming active exploitation. The addition requires federal civilian agencies to remediate the flaw under Binding Operational Directive 26-04, which prioritizes vulnerabilities granting attackers total control of internet-exposed assets. The entry closed out a week in which CISA added eight vulnerabilities spanning collaboration, video-conferencing, virtualization, and operating-system platforms to the Known Exploited Vulnerabilities Catalog. (CISA)

Marriott, Allied Universal, Glow Name New CISOs

SecurityWeek's People on the Move column for the week of August 17, 2026 reported several new CISO appointments. Daniel Dubowski became SVP and CISO at Marriott International after holding the same title at Hertz and serving as CISO at Equifax. Jordan Avnaim became global CISO at Allied Universal after leading security at Hyundai AutoEver America and Entrust. Patti Degnan, formerly of Notion and an operating partner at Andreessen Horowitz, took the CISO post at Glow. Vensure Employer Solutions named Michael Lockhart, previously CISO at EagleView, as its new chief information security officer. (SecurityWeek)