The Wednesday BriefingWednesday, August 19, 2026

SIM swap attacks, explained

Wednesday, August 19, 2026. Covers August 13, 2026 to August 19, 2026.

Edited by [BRIEFING EDITOR NAME] · August 19, 2026

From the editor

A phone number belongs to an account at the carrier, not to a piece of plastic. This week’s explainer walks through the three routes attackers use to move it, and what banks can check before trusting it.

In this issue

New Explainer

SIM swap attacks, explained

A criminal persuades, tricks or bribes a mobile carrier into moving a victim’s phone number to a SIM they control. From then on the victim’s calls and texts, including one-time passcodes, go to the attacker.

Route to Fraud & risk Security engineers Product & payments

Exploited this week

6 additions to CISA’s KEV catalog, Aug 13 to Aug 19.

CISA KEV additions, August 13, 2026 to August 19, 2026
CVE	Vendor and product	Vulnerability	Added	Due (federal)	Ransomware use
CVE-2026-64849	MLflow MLflow	MLflow Server-Side Request Forgery Vulnerability CISA summary MLflow contains a server-side request forgery vulnerability that can allow attackers to reach internal or cloud metadata services and receive response_status and response_body.	Aug 19	Sep 2	Unknown
CVE-2026-65400	Apple macOS	Apple macOS Improper Authentication Vulnerability CISA summary Apple macOS contains an improper authentication vulnerability that could allow an attacker on the network to authenticate to Screen Sharing without valid credentials.	Aug 18	Aug 21	Unknown
CVE-2026-59310	Broadcom VMware vCenter	Broadcom VMware vCenter Path Traversal Vulnerability CISA summary Broadcom VMware vCenter contains a path traversal vulnerability which could allow a threat actor with network access to vCenter to execute arbitrary code.	Aug 18	Aug 21	Known
CVE-2026-55040	Microsoft SharePoint	Microsoft SharePoint Weak Authentication Vulnerability CISA summary Microsoft SharePoint contains a weak authentication vulnerability which allows an unauthorized attacker to bypass a security feature over a network.	Aug 18	Aug 21	Unknown
CVE-2026-33824	Microsoft Internet Key Exchange (IKE) Service Extensions	Microsoft Internet Key Exchange (IKE) Service Extensions Double Free Vulnerability CISA summary Microsoft Internet Key Exchange (IKE) Service Extensions contains a double free vulnerability that could enable remote code execution.	Aug 18	Aug 21	Unknown
CVE-2025-62593	Ray-Project Ray	Ray-Project Ray Code Injection Vulnerability CISA summary Ray-Project Ray contains a code injection vulnerability that could allow remote code execution. Developers using Ray as a development tool may be exposed to this vulnerability exploitable through Firefox and Safari.	Aug 17	Aug 20	Unknown

Source: CISA Known Exploited Vulnerabilities catalog, version 2026.09.23. Due dates apply to US federal civilian agencies; summaries are CISA’s.