Exploited in August 2026: 26 KEV Additions, 18 With an EPSS Under 1%

Every month CISA adds a few dozen CVEs to its Known Exploited Vulnerabilities catalog. Each addition is a fact, not a prediction: someone was seen exploiting the vulnerability against real targets. That makes the catalog the best available check on the scores security teams sort their patch queues by. This is the August 2026 readout, computed from the isMalicious CVE catalog on 3 September 2026. The queries are published so the numbers can be checked, and the live list is at /cve/kev.

The month in numbers

| Measure | August 2026 | | ------------------------------------------------- | ------------------ | | CVEs added to KEV | 26 | | Without a CVSS v3 score at the time of reading | 4 | | Scored below CVSS 7.0 (High) | 1 of the 22 scored | | EPSS below 1% | 18 | | EPSS below 10% | 22 | | EPSS at or above 50% | 2 | | Median EPSS | 0.7% | | Median delay from CVE publication to KEV addition | 8 days | | Added within 3 days of publication | 12 | | Added more than 4 years after publication | 3 | | Due date set at 3 days | 18 | | Due date set at 14 days | 8 | | Flagged by CISA as known ransomware use | 0 |

Additions by week: 3 (week of 27 July, spilling into August), 4, 3, 9, 8, then 2 on the last day of the month.

Finding 1: exploited does not mean predicted

EPSS is a model that estimates, for every CVE, the probability that exploitation activity will be observed in the next 30 days. It is trained on public signals: exploit code, vendor advisories, mentions, the vulnerability's characteristics. It is the best public predictor we have, and it is what a lot of prioritisation tooling sorts by.

Against the August KEV additions it looks like this: 18 of 26 score under 1%, four sit between 1% and 10%, and only two clear 50%. The median is 0.7%. In other words, if a team had patched everything above the common 10% EPSS threshold, it would have covered 4 of the 26 vulnerabilities CISA confirmed as exploited that month.

This is not a failure of EPSS so much as a statement about timing. A brand-new vulnerability has no public exploit, no chatter and no history, so the model has little to work with. Exploitation in the wild, which is what puts a CVE in KEV, frequently happens before any of those signals appear. The two vulnerabilities above 50% EPSS are both old: CVE-2021-23758 (Ajax.NET Professional, EPSS 88%) and CVE-2019-1068 (Microsoft SQL Server, EPSS 42%). EPSS had years to learn about them. For the 23 CVEs published in 2026, the model was scoring in the dark.

Practical reading: EPSS is a good sort key for the backlog and a poor gate for the newest vulnerabilities. A KEV entry should override an EPSS score, not be compared to it.

Finding 2: severity is not exploitation either

Of the 22 additions that carry a CVSS v3 score, 21 are High or Critical. That sounds like CVSS agrees with KEV, until you look at the base rate: 86,991 of the 106,481 CVEs in our catalog score 4.0 or higher, and 51,290 score 7.0 or higher. Ranking by CVSS puts the 26 exploited vulnerabilities somewhere inside a set of fifty thousand.

The one scored addition below High is worth naming: CVE-2026-66384, a path restriction bypass in JFrog Artifactory at CVSS 5.3, exploited in the wild and given a fourteen-day deadline. Four more additions had no CVSS score at all when CISA added them, including two PaperCut NG/MF flaws added on 31 August and a Linux kernel vulnerability listed as "unspecified". A queue sorted by severity would have left those five at the bottom or off the list.

Finding 3: the deadlines say how CISA reads the risk

CISA sets a remediation due date for federal agencies with every addition. In August the split was 18 additions at three days and 8 at fourteen. Three days is the short fuse, applied when the agency judges the vulnerability an immediate risk. The fourteen-day group includes the three legacy CVEs, the Artifactory bypass, and the two TrueConf Server flaws.

The due date is the field the dated search queries ask for ("CVE due date CISA"), and it is the one field that encodes CISA's own urgency judgement. It is on every row of /cve/kev.

Finding 4: most additions are fast, a few are very late

Twelve of the 26 were added within three days of the CVE being published, and eight within one day. Those are vulnerabilities disclosed because they were already being exploited, so publication and KEV listing arrive together. The median delay is 8 days.

The tail is long. CVE-2026-21962 (Oracle HTTP Server, CVSS 10.0) was added 216 days after publication. CVE-2026-33824 (Microsoft IKE, CVSS 9.8) waited 103 days. And three vulnerabilities from 2019, 2021 and 2022 were added between 1,600 and 2,600 days after publication. Old, high-severity, high-EPSS vulnerabilities in widely deployed software keep being exploited because they keep being unpatched.

What this means for a patch queue

1. Treat KEV membership as a hard first sort key. A KEV entry with an EPSS of 0.3% is more urgent than a CVSS 9.8 with no exploitation evidence.
2. Use EPSS to order what is left, and expect it to be wrong about this week's disclosures. Re-read it: the score moves when exploit code appears.
3. Do not let a missing or medium CVSS score push a vulnerability out of view. Five of August's exploited CVEs had no score or a medium one.
4. Watch the KEV due date. It is CISA's own urgency signal and it is free.

Method

Source: the isMalicious CVE catalog, which syncs the NVD, the CISA KEV feed and daily EPSS scores. Window: kevDateAdded from 2026-08-01 to 2026-08-31 inclusive, UTC. Scores are as read on 2026-09-03; EPSS in particular moves daily, and the scores on the day of each addition were mostly lower still, since exploit signals accumulate after listing. The whole KEV catalog held 1,310 entries at the time of reading, of which 189 have an EPSS below 1% today and 648 above 50%. The queries are in docs/queries/kev-monthly-readout.sql in the isMalicious repository; the live list with due dates is at ismalicious.com/cve/kev, and each CVE above links to its advisory page.