Active Exploitation of TrueConf, Microsoft CVSS 10.0 Flaws, and Elementor Pro

On 20 August 2026, CISA confirmed active exploitation of two TrueConf Server vulnerabilities allowing unauthenticated remote code execution. The same day, Microsoft disclosed four separate CVSS 10.0 vulnerabilities affecting Exchange Online, Entra ID, Azure Arc, and Azure Managed Instance for Apache Cassandra. Meanwhile, six million WordPress sites face exposure through a critical unauthenticated file upload flaw in Elementor Pro. For UK small businesses, these disclosures highlight a consistent pattern: the attack surface extends beyond directly owned infrastructure to suppliers, cloud services, and website platforms. This episode examines each vulnerability in detail, explains the supply chain implications, and provides five actionable steps to assess exposure before the end of the week. Whether your risk sits with an MSP running TrueConf, a WordPress site built years ago and quietly forgotten, or a Microsoft 365 tenant with no audit logging enabled, the common thread is visibility and ownership. Without knowing what’s in your environment, who is responsible for patching, and whether anyone is reviewing the logs, you cannot defend it. This episode makes the business case for addressing these gaps and offers practical guidance grounded in the Cyber Essentials standard and UK GDPR obligations.

Chapters

• Introduction Corrine introduces three critical security disclosures from 20 August 2026: CISA’s confirmation of active exploitation of TrueConf Server vulnerabilities, Microsoft’s disclosure of four CVSS 10.0 flaws, and a critical Elementor Pro WordPress plugin vulnerability affecting six million sites.
• TrueConf Server: Two KEV Entries, Actively Exploited CISA added CVE-2026-72529 and CVE-2026-72530 to the Known Exploited Vulnerabilities catalogue. Both allow unauthenticated remote code execution on TrueConf Server. The vulnerabilities form a complete attack chain from network access to full host compromise, with confirmed active exploitation. CISA mandates immediate vendor mitigations or discontinuation of the product.
• Call to Action Listeners are encouraged to follow the show, leave ratings, and share the episode with others who would benefit from actionable cybersecurity intelligence.
• Microsoft’s Overnight Disclosure: Four CVSS 10.0 Flaws Microsoft disclosed four maximum-severity vulnerabilities on 20 August 2026. CVE-2026-65770 affects Azure Managed Instance for Apache Cassandra. CVE-2026-65801 affects Exchange Online. CVE-2026-65816 and CVE-2026-69555 affect Azure Arc. CVE-2026-69836 affects Microsoft Entra ID. All allow unauthenticated remote code execution or privilege escalation. These components underpin Microsoft 365 and Azure infrastructure used widely by UK small businesses.
• Elementor Pro: Six Million WordPress Sites at Risk CVE-2026-32475 is a critical unauthenticated file upload vulnerability in Elementor Pro, a WordPress page builder plugin installed on six million sites. The flaw allows attackers to upload PHP files and achieve full site takeover, including persistent backdoors and malicious administrator accounts. Patchstack expects active exploitation to follow disclosure. Many UK small business websites lack formal ownership of plugin updates.
• Why This Matters for Your Supply Chain Attack surfaces extend beyond directly owned infrastructure to suppliers, MSPs, cloud platforms, and website hosting. TrueConf may reside in supplier environments. Elementor Pro likely exists on forgotten WordPress sites. Microsoft 365 flaws require tenant-level monitoring. Without visibility into these dependencies, businesses cannot assess or mitigate risk.
• Making the Business Case Three arguments support investment in patching and monitoring: the cost of a breach under UK GDPR includes notification obligations and ICO investigations; Cyber Essentials mandates patching critical vulnerabilities within fourteen days; and monitoring costs less than post-incident discovery. Basic Microsoft 365 audit logging is included in most subscriptions and costs nothing to enable.
• What to Do Before Friday Five specific actions: verify TrueConf exposure with IT providers; update Elementor Pro on WordPress sites; enable Microsoft 365 audit logging; review Entra ID sign-in logs for anomalies; and confirm MSP patch SLAs meet the fourteen-day Cyber Essentials standard. These steps provide immediate visibility and reduce exposure.
• Conclusion The episode reinforces that attack surfaces in 2026 encompass suppliers, website platforms, and cloud dependencies. Knowing what is in the environment, who owns updates, and whether logs are reviewed are foundational to effective defence. Corrine closes with a reminder to return tomorrow for continued daily intelligence.

Links

• https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• https://msrc.microsoft.com/update-guide/
• https://patchstack.com/database/
• https://www.ncsc.gov.uk/cyberessentials/overview
• https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/