The week of August 3–9, 2026 gave defenders a compact but urgent patching queue. Browser fleets received important fixes, CISA expanded its Known Exploited Vulnerabilities catalog, N-able disclosed more detail about attacks on N-central environments, and JetBrains updated guidance for a critical TeamCity flaw. This security week in review separates immediate remediation from the items that require investigation after the patch is installed.
The short version
- Patch N-central on-premises to 2026.3.1.10 immediately. Hotfix 2 supersedes Hotfix 1. Then investigate both the N-central server and managed endpoints for post-exploitation activity.
- Update Chrome desktop to 151.0.7922.108/.109 on Windows and macOS or 151.0.7922.108 on Linux. Restart the browser and verify the running version.
- Check the August 4 CISA KEV additions. The new entries affect IBM Langflow, N-able N-central, and Apache Tomcat and are backed by evidence of exploitation.
- Patch internet-reachable TeamCity On-Premises. CVE-2026-63077 can allow unauthenticated remote code execution; fixed releases are 2025.11.7 and 2026.1.3.
- Update Firefox for Android to 153.0.3. Mozilla rates the fixed information-disclosure issue as high impact.
N-central: patching is only the first half of the response
N-able’s August 6 update is the highest-priority incident-response item of the week. The vendor says Hotfix 2, build 2026.3.1.10, is required for on-premises environments even when Hotfix 1 has already been installed. Hosted N-central environments were mitigated by N-able and require no customer patching action.
The disclosure also explains why version compliance alone is insufficient. N-able says an attacker obtained remote administrative access, used the Take Control feature to reach systems in a managed environment, and registered Cloudflare Tunnel services on endpoints for persistence. The company identified a limited number of affected customers and published network indicators, while warning that a clean automated check is not proof that an environment was unaffected.
Defenders should therefore run two workstreams in parallel: install 2026.3.1.10, then scope possible compromise across the server, administrative accounts, Take Control activity, managed Windows endpoints, newly registered services, and outbound connections. Preserve logs before rotating credentials or removing persistence.
CISA adds three exploited vulnerabilities
On August 4, CISA added three vulnerabilities to its Known Exploited Vulnerabilities catalog:
- CVE-2026-9198 — IBM Langflow code injection.
- CVE-2026-18556 — N-able N-central authentication bypass using an alternate path or channel.
- CVE-2026-34486 — Apache Tomcat missing encryption of sensitive data.
KEV placement means defenders should treat these as observed attack paths, not theoretical backlog items. Start with externally reachable systems and assets where exploitation would provide broad administrative control. For each match, record the owner, current version, exposure, remediation deadline, and whether retrospective investigation is required.
Chrome 151 fixes 41 security issues
Google’s August 6 stable desktop update contains 41 security fixes, including six critical vulnerabilities. The fixed versions are 151.0.7922.108/.109 for Windows and macOS and 151.0.7922.108 for Linux. Several critical issues involve use-after-free conditions, while another is an out-of-bounds write in ANGLE.
Google did not state in the release note that any listed Chrome vulnerability was being exploited in the wild. That distinction matters: the number and severity of fixes justify rapid rollout, but defenders should not add an active-exploitation claim that the vendor did not make.
Browser teams should verify the version after a restart rather than relying only on update-download telemetry. Devices that remain below the fixed build should be grouped by cause: pending restart, update-service failure, unsupported operating system, or unmanaged installation.
TeamCity: protect the build pipeline
JetBrains updated its advisory for CVE-2026-63077 on August 7. The critical vulnerability affects all TeamCity On-Premises versions and may allow an unauthenticated attacker with HTTP or HTTPS access to bypass authentication and execute operating-system commands with the privileges of the TeamCity server process.
The issue is fixed in TeamCity 2025.11.7 and 2026.1.3. JetBrains also provides a security patch plugin for supported older installations that cannot be upgraded immediately. TeamCity Cloud customers do not need to act; JetBrains says the required measures were already applied there.
A compromised build server can expose stored credentials, alter configuration, and undermine downstream artifacts. After patching, review authentication and server logs, build configuration changes, stored secrets, agent activity, and artifact integrity. Restrict TeamCity access to trusted networks wherever possible and avoid running the server with unnecessary operating-system privileges.
Firefox for Android receives a high-impact fix
Mozilla released Firefox for Android 153.0.3 on August 4 to address CVE-2026-18809, an information-disclosure vulnerability found by the Mozilla Fuzzing Team. Mozilla rates the issue as high impact.
Mobile browser coverage is easy to miss when patch reporting concentrates on desktop endpoints. Organizations managing Android devices should confirm that Firefox has reached 153.0.3 and that application-update policies apply off the corporate network as well as on it.
Monday handoff
| Priority | Owner | Evidence to collect |
|---|---|---|
| N-central Hotfix 2 and compromise assessment | RMM owner and incident response | Build 2026.3.1.10, server review, endpoint hunt results |
| CISA KEV exposure check | Vulnerability management | Asset matches, internet exposure, remediation and hunt status |
| Chrome 151 rollout | Endpoint management | Running version after restart and exception list |
| TeamCity remediation | DevOps platform owner | Fixed version or patch plugin, access review, artifact checks |
| Firefox for Android 153.0.3 | Mobile device management | Application version compliance |
The week’s common lesson is that patch completion and incident closure are not the same thing. For actively exploited or remotely exploitable management platforms, teams must verify the fixed build and determine whether the attacker arrived before the fix.
Sources
- Google Chrome stable desktop update, August 6, 2026
- N-able N-central security update, August 6, 2026
- CISA Known Exploited Vulnerabilities additions, August 4, 2026
- JetBrains TeamCity CVE-2026-63077 advisory
- Mozilla MFSA 2026-73
