Patching priorities for this week

# Patching priorities for this week Security teams generally pretend they follow a risk-based framework. In reality, most patch based on who is screaming the loudest in the Slack channel or which vendor's advisory uses the scariest font. If you want to actually reduce your surface area today, ignore the noise and look at what is being used as a door. The priority this week is N-able N-central. Specifically CVE-2026-18577 and CVE-2026-18556. These aren't theoretical bugs; they are authentication bypasses that were added to the CISA KEV on August 3rd and 4th. When a tool designed to manage other people's infrastructure has an auth bypass, it stops being a management tool and starts being a distribution system for ransomware. The incentive structure here is broken. Managed Service Providers (MSPs) are incentivized by stability and low ticket volume. Patching a core management server carries the risk of breaking connectivity for hundreds of clients. To an MSP owner, a brief window of vulnerability is often more acceptable than a day of downtime that triggers SLA penalties. The second-order effect is where the real damage happens. The victims aren't just the MSPs; they are every single downstream client who outsourced their security to "the experts" only to find out they've inherited a single, massive point of failure. Some will argue that these patches require extensive testing before deployment in complex environments. That is a convenient excuse. Testing is for feature updates, not for closing an open door while the burglars are already on the porch. If you're worried about stability, remember that there is no such thing as "stable" once an attacker has administrative access to your N-central server. Next on the list is JetBrains TeamCity (CVE-2026-63077). This was added to the KEV on August 5th. A deserialization flaw in a build server is a gift to any group wanting to inject malicious code directly into your software supply chain. If you're running this internet-facing, you aren't managing a pipeline; you're hosting a welcome mat. Then there's the Progress LoadMaster command injection (CVE-2026-8037). The federal patch deadline is today, August 10th. If you are in the public sector and haven't hit this yet, your compliance officer is probably already sweating. As for everything else, let it wait. Apache Tomcat has a missing encryption flaw (CVE-2026-34486). It's serious, but it doesn't have the same immediate "house on fire" energy as an active auth bypass in an MSP tool. The Cisco SD-WAN bugs, including three that hit a CVSS 9.8, are technically critical, but unless you see evidence of active exploitation in your specific environment, they shouldn't jump the queue ahead of the KEV additions. The noise this week is all about AI. OpenAI alone has seen over 80 stories hit the wire recently as people freak out over model risks and rogue hacks. It's a great distraction. While executives are arguing about the existential risk of an LLM, attackers are just using old-fashioned auth bypasses to walk through the front door. We spend so much time discussing "resilience" and "zero trust," yet we continue to hand the keys to our entire kingdom to third-party vendors whose primary incentive is billing hours, not hygiene. Why do we still treat MSPs as a security upgrade rather than a concentration of risk? If you're wondering where to start your Tuesday: fix N-able first. Then hit TeamCity. The Cisco bugs can wait until Wednesday.