CVSS 10.0 command injection, a live vCenter traversal, and a face scanner (2026-08-12)

The receipts for 2026-08-12

This section is the day's evidence, not the vibe. Three things landed on 2026-08-12 that matter to anyone shipping a codebase an AI agent can touch: an Adobe patch bundle carrying three CVSS 10.0 flaws, an actively-exploited VMware vCenter traversal, and live facial recognition arriving on the London Underground.

Adobe shipped updates on 2026-08-12 for critical flaws in ColdFusion, Commerce, and Campaign Classic. The most severe is CVE-2026-48362, an operating-system command-injection flaw in ColdFusion rated CVSS 10.0, which can lead to arbitrary code execution. The source states three flaws reach CVSS 10.0 and names the products, but does not list the other two CVE IDs — so we won't invent them.

Threat actors have begun actively exploiting CVE-2026-59310, a directory-traversal flaw in Broadcom VMware vCenter Server rated CVSS 9.8, per findings attributed to QUIRSO and reported 2026-08-12. A network-adjacent attacker can exploit it to execute arbitrary code and, per the reporting, gain persistent remote access. Patches were released before exploitation was observed — this is a patch-gap story, not a zero-day.

British Transport Police brought live facial recognition (LFR) to the London Underground on 2026-08-12, with Victoria as the first station; privacy campaigners warn the technology is becoming routine. The source is a policy story, not a vulnerability. It belongs here anyway because it is a system quietly ingesting faces the way an agent quietly ingests your repo — same governance question, different sensor.

Our read: these three are one story. Two are about untrusted input reaching a shell or a filesystem, and one is about data being collected because it's collectible. If AI agents write, review, or deploy your code, both failure modes are now yours to defend.

OS command injection: the AI agent's favourite footgun

Command injection is when attacker-controlled input reaches a shell or an OS command interpreter and gets executed as a command. It is the vulnerability class behind ColdFusion CVE-2026-48362 (CVSS 10.0, disclosed 2026-08-12), and it is the class an autonomous agent is most likely to reintroduce.

CVE-2026-48362 sits at CVSS 10.0 because OS command injection collapses the gap between "I control a string" and "I control the host." The source does not publish exploitation details, and we won't reconstruct them. What's actionable is the shape: input crosses a trust boundary and lands where a command interpreter reads it. That shape is auditable without any exploit.

Agents are prone to this because generated code loves convenience. A model asked to "run the user's export command" or "shell out to ffmpeg" will happily build a string with interpolated input and hand it to exec, system, child_process.exec, os.system, or subprocess with shell=True. Each is a literal token worth grepping for in any agent-authored diff.

Our read: treat every string that an agent passes to a command interpreter as a CVE-2026-48362 in miniature. The defensive primitive is the same at every scale — pass arguments as an array, never as a concatenated shell string, and let the OS keep argument boundaries instead of the shell re-parsing them.

Directory traversal, now with active exploitation

Directory traversal (path traversal) is when input like ../ escapes an intended directory and reaches files the application never meant to expose. VMware vCenter CVE-2026-59310 (CVSS 9.8) is a traversal flaw that, per QUIRSO reporting on 2026-08-12, is being actively exploited to run arbitrary code and gain persistent remote access.

The instructive detail in CVE-2026-59310 is timing: patches existed before exploitation was observed. The gap between "fix available" and "fix applied" is where the incident lives. For a self-hosted vCenter, the agent-relevant lesson isn't the traversal string — it's that your inventory and patch latency are a security control you can measure.

In agent-operated codebases, traversal shows up wherever a model builds a path from input: path.join(base, userInput), reading a "template name," or serving a "requested file." The defensive check is canonicalization — resolve the final absolute path and assert it still sits under the intended base directory before any read or write happens.

Our read: command injection and traversal are the same bug wearing two coats — untrusted input reaching a powerful sink (a shell, a filesystem). An agent that understands "validate at the sink, not just the source" defends both CVE-2026-48362 and CVE-2026-59310 with one habit.

When the knowledge base is a person's face

This section covers data governance, using the 2026-08-12 London Underground facial-recognition rollout as the example. The link to code is direct: both a face scanner and an AI agent turn ambient data into a durable record that later gets treated as ground truth.

British Transport Police deployed live facial recognition at London Victoria on 2026-08-12, the reported first stop, with campaigners warning it is becoming routine. The source does not detail retention, vendor, or match thresholds, so we won't speculate on them. The defensible takeaway is narrow: biometric collection is now a baseline expectation on that transit network as of that date.

The parallel for builders: an AI agent reading your repo, tickets, and logs is also a collection system. Whatever it ingests can be surfaced later as authoritative — a stale secret, a private path, a customer name in a fixture. If it shouldn't become ground truth, it shouldn't be in the agent's context window in the first place.

Our read: "we can collect it" and "we should collect it" are different hypotheses, and only one has receipts. The same restraint that privacy campaigners ask of a face scanner is the restraint you want on what your agent is allowed to read, log, and persist.

Detection: what an agent should watch for

Detection here means the signals that reveal these bug classes and their exploitation, framed for defenders and their agents. This is monitoring and code-audit guidance, not attack tooling.

For command injection (the CVE-2026-48362 class), have your agent flag any code path where input reaches exec, execSync, child_process.exec, os.system, subprocess with shell=True, or backtick shell-outs. A string built with interpolation and handed to any of those is the finding — no exploit needed to justify the fix.

For traversal (the CVE-2026-59310 class), flag path construction from input that lacks a post-resolution containment check. The detectable pattern is a join/concatenation feeding a file read or write with no realpath/canonicalize-then-assert-prefix step. On self-hosted VMware vCenter, also treat unexpected outbound connections or new persistence on the appliance as an exploitation signal per the 2026-08-12 reporting.

For patch latency, the measurable detection is inventory drift: software present in your estate that is behind a known fix. Adobe ColdFusion, Commerce, Campaign Classic (patched 2026-08-12) and VMware vCenter (CVE-2026-59310) are today's concrete examples an agent can check your dependency and deployment manifests against.

What to do about it

This section is the action list — concrete moves for a reader or their agent, tied to the 2026-08-12 sources. Do the mechanical ones first; they close the widest gap for the least effort.

• Patch now: apply Adobe's 2026-08-12 updates for ColdFusion (including CVE-2026-48362), Commerce, and Campaign Classic, and confirm VMware vCenter Server is patched against CVE-2026-59310 — the latter is under active exploitation, so treat it as a patch-gap emergency, not a maintenance-window item.
• Pin and inventory: record exact versions of ColdFusion, VMware vCenter, and every other internet-adjacent service so an agent can diff your estate against known-fixed versions and measure patch latency as a real metric.
• Audit the sinks: grep agent-authored code for exec, child_process.exec, os.system, and subprocess(..., shell=True); replace shell-string calls with array-argument APIs so the OS, not the shell, keeps argument boundaries.
• Contain paths: everywhere input builds a filesystem path, resolve to an absolute path and assert it stays under the intended base directory before any read or write — this is the one habit that covers the CVE-2026-59310 traversal class.
• Test defensively: add regression tests that feed ;, |, $(), and ../../etc/passwd style inputs to your command and file-path helpers and assert they are rejected or neutralized — detection you can run in CI beats detection you hope for in prod.
• Starve the context: treat your AI agent like the face scanner — decide what it is allowed to ingest and retain, and keep secrets, private paths, and PII out of its context window so nothing sensitive can later be quoted as ground truth.
• Avoid inventing detail: when the source is thin — the unnamed second and third CVSS 10.0 CVEs, vCenter retention specifics, LFR thresholds — leave the gap visible rather than letting an agent hallucinate a version or a config key into your knowledge base.

Sources

• Brit rail cops bring live facial recognition to the London Underground — theregister-security
• Adobe Patches Three CVSS 10.0 ColdFusion and Campaign Classic Flaws — the-hacker-news
• Attackers Exploit VMware vCenter Vulnerability to Gain Persistent Remote Access — the-hacker-news