Flaws added in August 2026
From Exploited flaws, HARD’s guide to the flaws being used in attacks
This article lists the flaws CISA added in August 2026. For the newest, see Exploited flaws.
In August 2026, CISA added 31 flaws to its list of vulnerabilities being used in attacks, 2 of them in things people have at home; 2 have been used by ransomware gangs. Most came from Microsoft (4), PaperCut (2) and Linux (2).[1]
Most let an attacker take over the product, running their own code or taking full control. It was the third most CISA added in any month of 2026.
List of flaws
Every flaw CISA added in August 2026, newest first, in plain English, each with an article of its own.[2] marks the ones used in ransomware.
Show
2 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2026-82078At work |
PaperCut NG/MF. Attackers can run their own code on PaperCut NG/MF. | At work |
CVE-2026-81578At work |
PaperCut NG/MF. Attackers can get into PaperCut NG/MF without a valid password. | At work |
3 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2026-66384At work |
JFrog Artifactory. Attackers can reach parts of JFrog Artifactory that should be locked to them. | At work |
CVE-2026-53362At work |
Linux Kernel. Someone who already has a foothold can use Linux Kernel to take full control of the machine. | At work |
CVE-2023-49105At work |
ownCloud. Attackers can get into ownCloud without a valid password. | At work |
6 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2026-8452At work |
Citrix NetScaler ADC and NetScaler Gateway. Attackers can crash Citrix NetScaler ADC and NetScaler Gateway or stop it working. | At work |
CVE-2022-0995At work |
Linux Kernel. Someone who already has a way in can corrupt memory in Linux Kernel to take more control. | At work |
CVE-2021-23758At work |
Ajax.NET Professional. Attackers can run their own code on Ajax.NET Professional. | At work |
CVE-2019-1068At work |
Microsoft SQL Server. Attackers can run their own code on Microsoft SQL Server. | At work |
CVE-2015-5287At work |
Red Hat Automatic Bug Reporting Tool. Someone who already has a foothold can use Red Hat Automatic Bug Reporting Tool to take full control of the machine. | At work |
CVE-2015-3246At work |
Red Hat Libuser. Someone who already has a foothold can use Red Hat Libuser to take full control of the machine. | At work |
1 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2026-60004At work |
Gitea. Attackers can run their own code on Gitea. | At work |
1 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2026-21962At work |
Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in. Attackers can reach parts of Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in that should be locked to them from anywhere, without logging in. | At work |
1 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2026-73570At work |
Synacor Zimbra Collaboration Suite (ZCS). Attackers can run their own code on Synacor Zimbra Collaboration Suite (ZCS) from anywhere, without logging in. | At work |
2 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2026-72530At work |
TrueConf Server. Attackers can run their own code on TrueConf Server. | At work |
CVE-2026-72529At work |
TrueConf Server. Attackers can get into TrueConf Server without a valid password. | At work |
1 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2026-64849At work |
MLflow. Attackers can make MLflow send requests into the network behind it from anywhere, without logging in. | At work |
4 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2026-65400At home |
Apple macOS. Attackers can get into Apple macOS without a valid password. | At home |
CVE-2026-59310† Used in ransomwareAt work |
Broadcom VMware vCenter. Attackers can run their own code on Broadcom VMware vCenter. | At work |
CVE-2026-55040At work |
Microsoft SharePoint. Attackers can get past a security protection in Microsoft SharePoint. | At work |
CVE-2026-33824At work |
Microsoft Internet Key Exchange (IKE) Service Extensions. Attackers can run their own code on Microsoft Internet Key Exchange (IKE) Service Extensions. | At work |
1 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2025-62593At work |
Ray-Project Ray. A booby-trapped web page can run an attacker's code through Ray-Project Ray. | At work |
3 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2026-72898At work |
Metabase. Attackers can use Metabase to take full control of the machine from anywhere, without logging in. | At work |
CVE-2026-68820At home |
Microsoft Windows Ancillary Function Driver for WinSock. Someone who already has a foothold can use Microsoft Windows Ancillary Function Driver for WinSock to take full control of the machine. | At home |
CVE-2026-20349At work |
Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD). Attackers can crash Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) or stop it working from anywhere, without logging in. | At work |
1 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2026-8037At work |
Progress LoadMaster. Someone who already has a way in can use Progress LoadMaster to run their own code. | At work |
1 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2026-63077† Used in ransomwareAt work |
JetBrains TeamCity. Attackers can run their own code on JetBrains TeamCity from anywhere, without logging in. | At work |
3 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2026-9198At work |
IBM Langflow. Attackers can run their own code on IBM Langflow from anywhere, without logging in. | At work |
CVE-2026-34486At work |
Apache Tomcat. Attackers can read information from Apache Tomcat that should be private. | At work |
CVE-2026-18556At work |
N-able N-central. Attackers can get into N-able N-central without a valid password. | At work |
1 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2026-18577At work |
N-able N-central. Attackers can get into N-able N-central without a valid password. | At work |
Companies
The flaws were in 23 companies’ products; the most were in Microsoft’s (4).
| Company | Flaws | Ransomware |
|---|---|---|
| Microsoft | 4 | – |
| Linux | 2 | – |
| N-able | 2 | – |
| PaperCut | 2 | – |
| Red Hat | 2 | – |
| TrueConf | 2 | – |
| Ajax.NET Professional | 1 | – |
| Apache | 1 | – |
| Apple | 1 | – |
| Broadcom | 1 | 1 |
| Cisco | 1 | – |
| Citrix | 1 | – |
| Gitea | 1 | – |
| IBM | 1 | – |
| JetBrains | 1 | 1 |
| 8 others | 8 |
Other months
Every month since CISA started the list; August 2026 is outlined.
| Year | Jan | Feb | Mar | Apr | May | Jun | Jul | Aug | Sep | Oct | Nov | Dec | Total |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 2026 | 17 | 28 | 26 | 31 | 21 | 23 | 26 | 31 | 43 | 36 | 282 | ||
| 2025 | 14 | 27 | 32 | 15 | 24 | 20 | 20 | 15 | 16 | 31 | 11 | 20 | 245 |
| 2024 | 21 | 9 | 10 | 10 | 14 | 9 | 14 | 19 | 25 | 17 | 22 | 16 | 186 |
| 2023 | 5 | 14 | 18 | 17 | 19 | 24 | 16 | 8 | 19 | 18 | 18 | 11 | 187 |
| 2022 | 40 | 32 | 226 | 45 | 83 | 48 | 3 | 23 | 24 | 12 | 10 | 9 | 555 |
| 2021 | 291 | 20 | 311 |
References
- ^ Cybersecurity and Infrastructure Security Agency. “Known Exploited Vulnerabilities Catalog”. Version 2026.10.30, updated 30 Oct 2026. CISA adds a flaw when it has reliable evidence of it being used in attacks; the date is when it was added, not when the attacks began.
- ^ HARD. Plain-English summaries written from CISA’s and NVD’s text, on each flaw’s page.
See also Exploited flaws, Companies, and Search for any app or company.