ScrutinEyes · 2026-08-19

Patched Isn't Safe: The Week in AI-Security, Aug 12–19, 2026

This week's four KEV flaws all shipped with patches already — the story is the gap between “fixed” and “safe,” plus the agentic-AI version of the same problem.

Originally published on ScrutinEyes — the InitialEyes family's independent, verified-only AI & security publication. Subscribe there for email delivery.

If there's one habit worth breaking this week, it's treating “there's a patch” as the finish line. Three of the four stories below are about the distance between a patch existing and a patch being applied — the exposure window where attackers actually live. The fourth is about a newer version of the same problem: automation that acts on your data faster than any human can approve it.

CISA flags four critical flaws — all already patched, all under active attack

On August 18, CISA added four vulnerabilities to its Known Exploited Vulnerabilities catalog, all rated critical: CVE-2026-65400 in Apple macOS (CVSS 9.8), CVE-2026-55040 in Microsoft SharePoint (9.1), CVE-2026-59310 in Broadcom's VMware vCenter (9.8), and CVE-2026-33824 in Microsoft's Internet Key Exchange (IKE) service (9.8). Every one had a vendor patch available — and every one is being exploited anyway. Federal agencies were given until August 21 to remediate. The lesson for a small shop with no security team is the uncomfortable one: the CVE being “fixed” upstream does nothing for you until you apply it. SharePoint and vCenter in particular are the kind of internet-adjacent infrastructure that small firms stand up once and forget. If you run any of these, it's a this-week job. (The Hacker News · CISA)

Microsoft's August Patch Tuesday: ~400 fixes, one bug already being used

August's Patch Tuesday (Aug 11) closed on the order of 400 flaws — counts vary by source, with SecurityWeek tallying 421 — including three zero-days. Two were publicly disclosed; one, CVE-2026-68820, was already under active exploitation: a use-after-free in the Windows Ancillary Function Driver for WinSock that lets an already-authenticated attacker escalate privileges locally. That “already-authenticated” detail matters. It's not the bug an attacker uses to get in — it's the one they use to turn a toehold into full control. Privilege-escalation zero-days are the quiet half of most real intrusions. Prioritize CVE-2026-68820 in your patch run. (BleepingComputer · SecurityWeek)

RingCentral: 1.6 million people, and not a single exploited bug

The RingCentral breach disclosed this week is a useful counterweight to the patch stories: no zero-day, no clever exploit. According to reporting, attackers ran a social-engineering campaign in July, the ShinyHunters extortion crew claimed it, and when RingCentral declined to pay, roughly 280GB of data was published. Have I Been Pwned logged around 1.6 million affected individuals, with names, addresses, emails, and phone numbers exposed. The reminder writes itself: the majority of breaches that actually reach your customers don't come through the CVE list at all. They come through a person being convinced to do something. No patch cadence defends against that — only training, verification habits, and least-privilege do. (SecurityWeek)

The agentic-AI problem in one sentence: it exfiltrates before you can say no

The story worth sitting with is Atlassian's Rovo AI assistant. Two research teams — PromptArmor and Varonis — independently showed Rovo could be steered by prompt injection into shipping private Jira and Confluence data to an attacker's server. In PromptArmor's version, a user uploads a poisoned document and asks Rovo to tidy up some tickets; the assistant reads the hidden instructions, pulls the data, and appends it to an attacker URL — with no separate human approval on the exfiltration step. Varonis's “RovoBlast” needed only a single click from an authenticated user. Neither has a CVE, and there's no evidence of real-world abuse yet; Varonis's variant was fixed server-side in July and the disclosures landed in early August, so this is the fresh cautionary tale rather than breaking news. But it's the cleanest illustration going of the structural risk in every AI agent being bolted onto business tools right now: the moment an agent can both read your data and reach the internet, “summarize this” and “send this to a stranger” are one poisoned document apart. If you're switching on AI assistants across your stack, the question to ask each vendor is blunt — can it act on data without a human approving the action that leaves your walls? (The Hacker News)

What to watch

• Patch latency on the four KEV flaws. Expect follow-on exploitation of the macOS and vCenter bugs as scanners catch up; unpatched vCenter especially is a ransomware on-ramp.
• More agent-exfiltration disclosures. Rovo won't be the last. The pattern — indirect prompt injection plus an agent with network reach — applies to every “AI assistant” wired into Jira, Slack, email, or a CRM.
• Extortion-first breaches. ShinyHunters-style “we took it, pay us or we leak it” continues to outrun technical exploits as the disclosure driver.

ScrutinEyes reports only what it can verify against primary sources. This week we deliberately left out the flurry of “new AI model” claims — the only sources we could find for this week's releases were aggregators (one of which mislabeled who makes Grok), which don't clear that bar.