CISA Known Exploited Vulnerabilities

KEV additions — August 2026

26 CVEs entered the KEV catalog in August 2026.

Added August 31, 20262

CVE	Vulnerability	CVSS	EPSS	Due date
CVE-2026-81578	PaperCut NG/MF Missing Authentication for Critical Function Vulnerability	—	0.4 %	September 14, 2026
CVE-2026-82078	PaperCut NG/MF Unsafe Reflection Vulnerability	—	0.5 %	September 14, 2026

Added August 27, 20262

CVE	Vulnerability	CVSS	EPSS	Due date
CVE-2026-53362	Linux Kernel Unspecified Vulnerability	—	0.2 %	August 30, 2026
CVE-2026-66384	JFrog Artifactory Improper Limitation of a Pathname to a Restricted Directory Vulnerability	5.3	0.3 %	September 10, 2026

Added August 26, 20264

CVE	Vulnerability	CVSS	EPSS	Due date
CVE-2019-1068	Microsoft SQL Server Remote Code Execution Vulnerability	8.8	41.6 %	August 29, 2026
CVE-2021-23758	Ajax.NET Professional Deserialization of Untrusted Data Vulnerability	9.8	87.8 %	September 9, 2026
CVE-2022-0995	Linux Kernel Out-of-Bounds Write Vulnerability	7.8	20.5 %	September 9, 2026
CVE-2026-8452	Citrix NetScaler ADC and NetScaler Gateway Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability	9.8	0.4 %	August 29, 2026

Added August 25, 20261

CVE	Vulnerability	CVSS	EPSS	Due date
CVE-2026-60004	Gitea Code Injection Vulnerability	9.8	82.4 %	August 28, 2026

Added August 24, 20261

CVE	Vulnerability	CVSS	EPSS	Due date
CVE-2026-21962	Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in Improper Access Control Vulnerability	10	0.0 %	August 27, 2026

Added August 21, 20262

CVE	Vulnerability	CVSS	EPSS	Due date
CVE-2026-69836	Microsoft Entra ID Deserialization of Untrusted Data Vulnerability	10	1.4 %	August 24, 2026
CVE-2026-73570	Zimbra Collaboration Suite (ZCS) OS Command Injection Vulnerability	8.9	0.5 %	August 24, 2026

Added August 20, 20262

CVE	Vulnerability	CVSS	EPSS	Due date
CVE-2026-72529	TrueConf Server Missing Authentication for Critical Function Vulnerability	9.8	0.8 %	August 23, 2026
CVE-2026-72530	TrueConf Server Code Injection Vulnerability	9	1.0 %	September 3, 2026

Added August 19, 20261

CVE	Vulnerability	CVSS	EPSS	Due date
CVE-2026-64849	MLflow Server-Side Request Forgery Vulnerability	9.3	1.1 %	September 2, 2026

Added August 18, 20264

CVE	Vulnerability	CVSS	EPSS	Due date
CVE-2026-33824	Microsoft Internet Key Exchange (IKE) Service Extensions Double Free Vulnerability	9.8	0.1 %	August 21, 2026
CVE-2026-55040	Microsoft SharePoint Weak Authentication Vulnerability	9.1	0.7 %	August 21, 2026
CVE-2026-59310	vCenter directory-traversal vulnerability	9.8	1.1 %	August 21, 2026
CVE-2026-65400	Apple macOS Improper Authentication Vulnerability	7.1	0.3 %	August 21, 2026

Added August 11, 20263

CVE	Vulnerability	CVSS	EPSS	Due date
CVE-2026-20349	Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) Heap Inspection Vulnerability	8.6	1.0 %	August 14, 2026
CVE-2026-68820	Microsoft Windows Ancillary Function Driver for WinSock Use-After-Free Vulnerability	7	0.4 %	August 25, 2026
CVE-2026-72898	Metabase SQL Injection Vulnerability	10	0.7 %	August 14, 2026

Added August 5, 20261

CVE	Vulnerability	CVSS	EPSS	Due date
CVE-2026-63077	JetBrains TeamCity Deserialization of Untrusted Data Vulnerability	9.8	0.6 %	August 8, 2026

Added August 4, 20262

CVE	Vulnerability	CVSS	EPSS	Due date
CVE-2026-18556	N-able N-central Authentication Bypass Using an Alternate Path or Channel Vulnerability	—	0.3 %	August 7, 2026
CVE-2026-9198	Unauthenticated Remote Code Execution via Auto-Login Bypass and Code Validation	9.8	0.4 %	August 7, 2026

Added August 3, 20261

CVE	Vulnerability	CVSS	EPSS	Due date
CVE-2026-18577	N-able N-central Authentication Bypass Using an Alternate Path or Channel Vulnerability	8.1	2.5 %	August 6, 2026

← All recent KEV additions