The Wednesday BriefingWednesday, August 12, 2026
The FCC’s SIM-swap rules: what carriers now have to do
Wednesday, August 12, 2026. Covers August 6, 2026 to August 12, 2026.
From the editor
The FCC’s SIM-swap and port-out rules put the burden on US wireless carriers to authenticate customers before a number moves. They say nothing about how banks use SMS codes, which is why our explainer spends as much time on what the order doesn’t cover.
In this issue
New Explainer
The FCC’s SIM-swap rules: what carriers now have to do
The FCC’s 2023 order (FCC 23-95) requires US wireless carriers to authenticate customers securely before moving their number to a new SIM or provider, to notify customers of SIM change and port-out requests, and to offer account locks. It does not regulate how banks or apps use SMS codes.
Route to Compliance Fraud & risk
Exploited this week
4 additions to CISA’s KEV catalog, Aug 6 to Aug 12.
| CVE | Vendor and product | Vulnerability | Added | Due (federal) | Ransomware use |
|---|---|---|---|---|---|
| CVE-2026-72898 | Metabase Metabase | Metabase SQL Injection VulnerabilityCISA summaryMetabase contains a SQL Injection vulnerability that allows an unauthenticated remote attacker to inject arbitrary SQL into the Metabase application database, which can give them administrator access to the instance. From there, the attacker could change the application configuration, steal stored credentials for the connected databases, read any data accessible through those connections, and export data. | Unknown | ||
| CVE-2026-68820 | Microsoft Windows Ancillary Function Driver for WinSock | Microsoft Windows Ancillary Function Driver for WinSock Use-After-Free VulnerabilityCISA summaryMicrosoft Windows Ancillary Function Driver for WinSock contains a use-after-free vulnerability that allows an authorized attacker to elevate privileges locally. | Unknown | ||
| CVE-2026-20349 | Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) | Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) Heap Inspection VulnerabilityCISA summaryCisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) contain a heap inspection vulnerability that could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting in a denial of service (DoS) condition. | Unknown | ||
| CVE-2026-8037 | Progress LoadMaster | Progress LoadMaster Command Injection VulnerabilityCISA summaryProgress LoadMaster contains a command injection vulnerability that allows an un-authenticated attacker to execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input in multiple command endpoints. | Unknown |
Source: CISA Known Exploited Vulnerabilities catalog, version 2026.09.23. Due dates apply to US federal civilian agencies; summaries are CISA’s.