CISA Known Exploited Vulnerabilities

KEV additions — August 2026

25 CVEs entered the KEV catalog in August 2026.

Get an alert for each new CVE published for the software you run.

Set up CVE WatchFree account · no credit card

Added August 31, 20262

CVE	Vulnerability	CVSS	EPSS	Due date
CVE-2026-81578	PaperCut NG/MF Missing Authentication for Critical Function Vulnerability	—	85.6 %	Sep 14, 2026
CVE-2026-82078	PaperCut NG/MF Unsafe Reflection Vulnerability	—	63.5 %	Sep 14, 2026

Added August 27, 20262

CVE	Vulnerability	CVSS	EPSS	Due date
CVE-2026-53362	Linux Kernel Unspecified Vulnerability	—	0.7 %	Aug 30, 2026
CVE-2026-66384	JFrog Artifactory Improper Limitation of a Pathname to a Restricted Directory Vulnerability	5.3	0.7 %	Sep 10, 2026

Added August 26, 20264

CVE	Vulnerability	CVSS	EPSS	Due date
CVE-2019-1068	Microsoft SQL Server Remote Code Execution Vulnerability	8.8	57.3 %	Aug 29, 2026
CVE-2021-23758	Ajax.NET Professional Deserialization of Untrusted Data Vulnerability	9.8	82.6 %	Sep 9, 2026
CVE-2022-0995	Linux Kernel Out-of-Bounds Write Vulnerability	7.8	8.9 %	Sep 9, 2026
CVE-2026-8452	Citrix NetScaler ADC and NetScaler Gateway Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability	9.8	1.0 %	Aug 29, 2026

Added August 25, 20261

CVE	Vulnerability	CVSS	EPSS	Due date
CVE-2026-60004	Gitea Code Injection Vulnerability	9.8	24.0 %	Aug 28, 2026

Added August 24, 20261

CVE	Vulnerability	CVSS	EPSS	Due date
CVE-2026-21962	Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in Improper Access Control Vulnerability	10	73.2 %	Aug 27, 2026

Added August 21, 20261

CVE	Vulnerability	CVSS	EPSS	Due date
CVE-2026-73570	Zimbra Collaboration Suite (ZCS) OS Command Injection Vulnerability	8.9	71.7 %	Aug 24, 2026

Added August 20, 20262

CVE	Vulnerability	CVSS	EPSS	Due date
CVE-2026-72529	TrueConf Server Missing Authentication for Critical Function Vulnerability	9.8	1.5 %	Aug 23, 2026
CVE-2026-72530	TrueConf Server Code Injection Vulnerability	9	1.7 %	Sep 3, 2026

Added August 19, 20261

CVE	Vulnerability	CVSS	EPSS	Due date
CVE-2026-64849	MLflow Server-Side Request Forgery Vulnerability	9.3	9.8 %	Sep 2, 2026

Added August 18, 20264

CVE	Vulnerability	CVSS	EPSS	Due date
CVE-2026-33824	Microsoft Internet Key Exchange (IKE) Service Extensions Double Free Vulnerability	9.8	1.6 %	Aug 21, 2026
CVE-2026-55040	Microsoft SharePoint Weak Authentication Vulnerability	9.1	69.5 %	Aug 21, 2026
CVE-2026-59310	vCenter directory-traversal vulnerability	9.8	2.6 %	Aug 21, 2026
CVE-2026-65400	Apple macOS Improper Authentication Vulnerability	7.1	1.7 %	Aug 21, 2026

Added August 11, 20263

CVE	Vulnerability	CVSS	EPSS	Due date
CVE-2026-20349	Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) Heap Inspection Vulnerability	8.6	1.0 %	Aug 14, 2026
CVE-2026-68820	Microsoft Windows Ancillary Function Driver for WinSock Use-After-Free Vulnerability	7	0.3 %	Aug 25, 2026
CVE-2026-72898	Metabase SQL Injection Vulnerability	10	97.3 %	Aug 14, 2026

Added August 5, 20261

CVE	Vulnerability	CVSS	EPSS	Due date
CVE-2026-63077	JetBrains TeamCity Deserialization of Untrusted Data Vulnerability	9.8	89.6 %	Aug 8, 2026

Added August 4, 20262

CVE	Vulnerability	CVSS	EPSS	Due date
CVE-2026-18556	N-able N-central Authentication Bypass Using an Alternate Path or Channel Vulnerability	—	7.9 %	Aug 7, 2026
CVE-2026-9198	Unauthenticated Remote Code Execution via Auto-Login Bypass and Code Validation	9.8	28.7 %	Aug 7, 2026

Added August 3, 20261

CVE	Vulnerability	CVSS	EPSS	Due date
CVE-2026-18577	N-able N-central Authentication Bypass Using an Alternate Path or Channel Vulnerability	8.1	14.6 %	Aug 6, 2026

← All recent KEV additions