What landed in CVE-land this week

The week of 15 August 2026 produced no headline kernel primitives, no supply-chain earthquakes, and no browser sandbox escapes with catchy names. What telemetry and public exploitation reports did show was a cluster of old CVEs surfacing in fresh incidents — long-tail exploitation that proves a CVE with a 2010 prefix can still be a live wire in 2026. This digest walks through eight of them, explains why each is resurfacing, and prescribes action before the next quarterly audit.

The pattern: pre-2016 CVEs, post-2025 blast radius

Six of the eight CVEs below predate the CVSS v3 base metric standard. Three predate widespread MFA adoption in the enterprise. All eight remain trivially exploitable against unpatched software today. What changed this week: two large ransomware-affiliate playbooks were leaked to public repositories, and both lean heavily on this exact class of long-tail bug. When affiliate tooling gets templated, weaponisation drops to paste the target IP into the Metasploit module and hit run. Our sensors logged more of that this week.

The eight

CVE-2010-0188 (CVSS 7.8) — Adobe Reader and Acrobat 8.x/9.x memory corruption via crafted PDF. Sixteen years old. It persists in phishing kits targeting PDFs opened in out-of-date readers shipped with legacy print appliances or document-processing workflows no one updates. If your mail-gateway sandbox does not detonate PDFs against a current Adobe Reader build, this payload class is invisible to you.

CVE-2010-0738 (CVSS 5.3) — The JBoss JMX-Console access-control bypass: verbs other than GET and POST are unauthenticated. A HEAD request to /jmx-console/HtmlAdaptor bypasses BASIC auth and lets an attacker invoke arbitrary MBean operations, including deploying a WAR. It remains the top hit when we scan perimeters for exposed JBoss 4.x — and we keep finding JBoss 4.x, typically behind an "internal only" load balancer listening on 0.0.0.0.

CVE-2010-1428 (CVSS 7.5) — Sibling to the above, same root cause in the JBoss web-console, fixed by the same CP08/CP09 patch line. Both vulnerabilities live on the same host; one is a proxy indicator for the other.

CVE-2010-2861 (CVSS 9.8) — Adobe ColdFusion 9.0.1 admin-console directory traversal via the locale parameter. Reads arbitrary files, including password.properties. ColdFusion administrator passwords in that era are salted with a known, hard-coded value, so a single read of password.properties yields full admin compromise in one hop. ColdFusion 9 is end-of-life but persists in the wild — most often on subsidiary or acquired infrastructure that never entered the parent's asset inventory.

CVE-2012-0507 (CVSS 9.8) — Oracle JRE AtomicReferenceArray type-confusion; the Flashback macOS botnet's initial vector. Any workstation running a legacy JRE plug-in — more common than you'd expect in air-gapped OT environments and specialised medical imaging viewers — is a one-click compromise via a malicious applet or a Java Web Start file.

CVE-2013-0431 (CVSS 5.3) — JMX-based sandbox escape in Oracle Java SE 7. Chained with a memory-corruption bug for full RCE. Its reappearance this week is exploit-kit residue: a repackaged 2013-era landing page grafted onto a 2026 malvertising campaign.

CVE-2013-0074 (CVSS 7.8) — Microsoft Silverlight 5 pointer-validation flaw. Silverlight is dead; Silverlight installers are not. Enterprise imaging systems, older SCADA HMIs, and a surprising volume of insurance-industry back-office tooling still ship with the runtime enabled.

CVE-2015-1701 (CVSS 7.8) — Win32k.sys local-privilege escalation, publicly exploited by APT28 in 2015. Affected surface: Windows Server 2003 and 2008, both unsupported, both still present in roughly 4% of the estates we assessed this quarter.

Detection: don't trust the CVE feed, trust the behaviour

Hunting CVE identifiers in your patch-management console is a losing race for long-tail bugs — the systems that carry these CVEs are typically the ones your console cannot see. Anchor detection to behaviour instead. Two queries worth loading into your SIEM today:

index=web sourcetype=access_combined
| rex field=uri "(?<verb_hint>/jmx-console/HtmlAdaptor|/web-console/Invoker)"
| where isnotnull(verb_hint) AND method!="GET" AND method!="POST"
| stats count by src_ip, method, uri, status
| where count > 0

That surfaces the CVE-2010-0738 / CVE-2010-1428 bypass pattern regardless of whether you have inventoried the JBoss instance. For ColdFusion administrator traversal, the tell is the locale parameter carrying a path separator or a .properties extension:

index=web uri="/CFIDE/administrator/*"
| rex field=uri "locale=(?<loc>[^&]+)"
| where match(loc, "(\.\.|/|%2f|%2e%2e|\.properties)")
| stats count values(src_ip) as srcs by uri

Neither query needs an updated CVE feed. Both catch exploitation attempts today.

Hardening actions worth queuing this sprint

  1. Enumerate every internet-reachable JBoss 4.x and ColdFusion 9.x instance across every business unit, including recently acquired ones. Confirm — do not assume — that "internal only" segments are not answering on the public interface. Two of the four JBoss exposures we found this week were listening on both.
  2. Enforce a browser-policy allow-list via group policy to kill Silverlight and legacy JRE plug-ins. When a business owner claims a workflow requires them, ask for the exact URL; nine times out of ten a modern replacement exists that the owner has not been told about.
  3. For any Windows Server 2003/2008 you cannot decommission this quarter, place it behind an authenticating jump host and disable RDP and SMB from user VLANs. CVE-2015-1701 requires local execution — remove the paths that grant it.
  4. Rebuild your mail-gateway PDF detonation profile against both a current and a legacy Adobe Reader build. The delta between the two is where CVE-2010-0188-class payloads hide.
  5. Add the eight CVEs above to your monthly attack-surface report as a fixed watch-list, separate from the rolling top-10. Long-tail bugs need long-tail governance.

Why we keep writing this post

Week after week, customer telemetry and public exploitation feeds show the same shape: a handful of new bugs and a much larger tail of decade-old bugs still generating incident tickets. The industry narrative rewards novelty; attackers reward reliability. A 2010 JBoss bypass that executes on the first try is more valuable to an affiliate than a 2026 zero-day that might not deliver. Defenders who plan around that asymmetry — inventorying legacy stacks, hunting exploitation behaviour rather than CVE strings, closing the paths to privileged execution — are the ones whose weeks stay quiet.

Verifiable security.