High-risk security vulnerabilities affecting GeoServer, macOS, and SAP Commerce Cloud have come under active exploitation.
The GeoServer flaw was first disclosed on August 12 by a security researcher and has yet to receive a CVE identifier. The vulnerability is an SQL injection issue in the open-source platform that can lead to remote code execution. GeoServer released versions 3.0.1, 2.28.5, and 2.27.6 to fix the issue.
According to WatchTowr, first exploitation attempts have observed within hours of public disclosure and the number of attempts have since increased to hundreds coming from a small number of source IP addresses. Researchers said they didn’t observed any follow-up activity.
Another exploited vulnerability (CVE-2026-65400) affects macOS Screen Sharing. Apple fixed the authentication bypass on August 6. The flaw allows attackers to access systems without valid credentials when the Screen Sharing service is exposed to the internet.
The Netherlands’ National Cyber Security Centre said it received a report of the flaw being exploited against systems with TCP port 5900 exposed. In one reported case, attackers gained root access and installed a Monero cryptocurrency miner.
The third exploited flaw is CVE-2026-58231 in the SAP Commerce Cloud software. It stems from insufficient authorization checks and input validation. Successful exploitation can allow unauthenticated attackers to execute arbitrary code. Defused reported seeing exploitation attempts three days after SAP released a patch for the vulnerability.
Organizations are strongly advised to apply security patches as soon as possible to minimize the risk of attacks.