CISA KEV · August 2026
In August 2026, CISA added 31 vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, up from 26 in July 2026. 2 entries are known to be used in ransomware campaigns. The most affected vendors were Microsoft (4), PaperCut (2), Linux (2). Every entry below has reliable evidence of exploitation in the wild, so if you run the product, patch or mitigate it first.
| Added | CVE | Vulnerability | Federal due |
|---|---|---|---|
| 31 Aug 2026 | CVE-2026-82078 | PaperCut NG/MF Unsafe Reflection VulnerabilityPaperCut · NG/MF | |
| 31 Aug 2026 | CVE-2026-81578 | PaperCut NG/MF Missing Authentication for Critical Function VulnerabilityPaperCut · NG/MF | |
| 27 Aug 2026 | CVE-2026-66384 | JFrog Artifactory Improper Limitation of a Pathname to a Restricted Directory VulnerabilityJFrog · Artifactory | |
| 27 Aug 2026 | CVE-2026-53362 | Linux Kernel Unspecified VulnerabilityLinux · Kernel | |
| 27 Aug 2026 | CVE-2023-49105 | ownCloud Improper Authentication VulnerabilityownCloud · ownCloud | |
| 26 Aug 2026 | CVE-2026-8452 | Citrix NetScaler ADC and NetScaler Gateway Improper Restriction of Operations within the Bounds of a Memory Buffer VulnerabilityCitrix · NetScaler ADC and NetScaler Gateway | |
| 26 Aug 2026 | CVE-2022-0995 | Linux Kernel Out-of-Bounds Write VulnerabilityLinux · Kernel | |
| 26 Aug 2026 | CVE-2021-23758 | Ajax.NET Professional Deserialization of Untrusted Data VulnerabilityAjax.NET Professional · Ajax.NET Professional | |
| 26 Aug 2026 | CVE-2019-1068 | Microsoft SQL Server Remote Code Execution VulnerabilityMicrosoft · SQL Server | |
| 26 Aug 2026 | CVE-2015-5287 | Red Hat Automatic Bug Reporting Tool Privilege Escalation VulnerabilityRed Hat · Automatic Bug Reporting Tool | |
| 26 Aug 2026 | CVE-2015-3246 | Red Hat Libuser Race Condition VulnerabilityRed Hat · Libuser | |
| 25 Aug 2026 | CVE-2026-60004 | Gitea Code Injection VulnerabilityGitea · Gitea | |
| 24 Aug 2026 | CVE-2026-21962 | Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in Improper Access Control VulnerabilityOracle · HTTP Server and Oracle Weblogic Server Proxy Plug-in | |
| 21 Aug 2026 | CVE-2026-73570 | Zimbra Collaboration Suite (ZCS) OS Command Injection VulnerabilitySynacor · Zimbra Collaboration Suite (ZCS) | |
| 20 Aug 2026 | CVE-2026-72530 | TrueConf Server Code Injection VulnerabilityTrueConf · Server | |
| 20 Aug 2026 | CVE-2026-72529 | TrueConf Server Missing Authentication for Critical Function VulnerabilityTrueConf · Server | |
| 19 Aug 2026 | CVE-2026-64849 | MLflow Server-Side Request Forgery VulnerabilityMLflow · MLflow | |
| 18 Aug 2026 | CVE-2026-65400 | Apple macOS Improper Authentication VulnerabilityApple · macOS | |
| 18 Aug 2026 | CVE-2026-59310 | Broadcom VMware vCenter Path Traversal VulnerabilityRANSOMWAREBroadcom · VMware vCenter | |
| 18 Aug 2026 | CVE-2026-55040 | Microsoft SharePoint Weak Authentication VulnerabilityMicrosoft · SharePoint | |
| 18 Aug 2026 | CVE-2026-33824 | Microsoft Internet Key Exchange (IKE) Service Extensions Double Free VulnerabilityMicrosoft · Internet Key Exchange (IKE) Service Extensions | |
| 17 Aug 2026 | CVE-2025-62593 | Ray-Project Ray Code Injection VulnerabilityRay-Project · Ray | |
| 11 Aug 2026 | CVE-2026-72898 | Metabase SQL Injection VulnerabilityMetabase · Metabase | |
| 11 Aug 2026 | CVE-2026-68820 | Microsoft Windows Ancillary Function Driver for WinSock Use-After-Free VulnerabilityMicrosoft · Windows Ancillary Function Driver for WinSock | |
| 11 Aug 2026 | CVE-2026-20349 | Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) Heap Inspection VulnerabilityCisco · Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) | |
| 7 Aug 2026 | CVE-2026-8037 | Progress LoadMaster Command Injection VulnerabilityProgress · LoadMaster | |
| 5 Aug 2026 | CVE-2026-63077 | JetBrains TeamCity Deserialization of Untrusted Data VulnerabilityRANSOMWAREJetBrains · TeamCity | |
| 4 Aug 2026 | CVE-2026-9198 | IBM Langflow Code Injection VulnerabilityIBM · Langflow | |
| 4 Aug 2026 | CVE-2026-34486 | Apache Tomcat Missing Encryption of Sensitive Data VulnerabilityApache · Tomcat | |
| 4 Aug 2026 | CVE-2026-18556 | N-able N-central Authentication Bypass Using an Alternate Path or Channel VulnerabilityN-able · N-central | |
| 3 Aug 2026 | CVE-2026-18577 | N-able N-central Authentication Bypass Using an Alternate Path or Channel VulnerabilityN-able · N-central |
Run your vendors and products through stack check, pre-filled with this month's vendors; it also gives you an RSS feed for new additions. The long-run picture is on CVE Trends.
31 vulnerabilities. In July 2026 it added 26.
Microsoft, with 4 entries. Next were PaperCut (2), Linux (2), Red Hat (2).
It is the US Cybersecurity and Infrastructure Security Agency's list of vulnerabilities with reliable evidence of exploitation in the wild, currently 1,767 entries. US federal agencies must fix listed vulnerabilities by the due date; for everyone else it is the best public list of what to patch first.
How this is made: generated automatically from the CISA KEV catalog, grouped by the date CISA added each entry. Vulnerability names are CISA's. Federal due dates apply to US agencies under BOD 22-01; for everyone else they are a sensible upper bound.
We wire CISA KEV and EPSS into your scanner, SIEM and ticketing, so your team sees the few entries that match your estate, with deadlines an auditor accepts.
Get in touch →