The Top CVEs of August 2026: Attackers Cashed In on Patches Defenders Already Had
August 2026 produced only two true zero-days. Almost everything else CISA flagged as under attack had been patched weeks or months earlier — the month attackers spent cashing in on fixes defenders already had.
August 2026 produced only two true zero-days. Almost everything else CISA flagged as under attack had been patched weeks or months earlier — the month attackers spent cashing in on fixes defenders already had.
How we rank (the CyberSignal method)
We sort on four signals, in order. First, confirmed active exploitation — CISA KEV listing or credible vendor and researcher telemetry. Second, exposure and attacker value: internet-facing, unauthenticated, widely deployed. Third, patch availability, where an unpatched or bypassable fix outranks a clean one. Fourth, blast radius, which favours identity systems, collaboration servers, edge appliances and CI/CD over single endpoints. A base score is an input to that judgment, never the output. That is how a CVSS 7.0 privilege-escalation bug can outrank a 9.8 that nobody has touched.
The August 2026 ranked list
CVSS per NVD/CISA; rank reflects exploitation and exposure, not the raw score.
Tier 1 — Actively exploited (fix these first)
PaperCut was the only clean zero-day of the month, and it was a bad one. On August 27 PaperCut told customers it was investigating confirmed intrusions, then shipped an out-of-cycle patch in the middle of the Australian night. Within a day and a half, two CVEs had been assigned, researchers at watchTowr and Huntress had broken the first patch, and the vendor had replaced it with Release 2. There is no unaffected version of PaperCut NG or MF. We covered the disclosure as it moved in PaperCut Confirms Two Chained Zero-Days Exploited Across All NG and MF Versions, and the practical instruction has not changed: install Release 2 even if you already applied the first emergency patch, because the first patch is bypassable.
Windows IKE is the clearest example of the month's real theme. CVE-2026-33824 is a double free in the Internet Key Exchange service extensions, reachable over UDP 500 and 4500 with no authentication, affecting every supported build of Windows 10, 11 and Server. Microsoft fixed it in April. CISA added it to KEV on August 18 — four months later — because attackers finally started using it. Nothing about the vulnerability changed in that window. What changed was that someone did the work, and every organisation still carrying the April update as a backlog ticket became a target. We wrote up that KEV batch in CISA Flags Four Actively Exploited Flaws in macOS, SharePoint, vCenter, and Microsoft IKE.
vCenter and NetScaler show how fast the virtualization and edge control planes get hit. Broadcom disclosed CVE-2026-59310 on July 29, a directory traversal in the vCenter Syslog service that yields unauthenticated remote code execution; a suspected APT was exploiting it within five days, with hundreds of servers compromised across dozens of countries — see Two Critical Flaws Under Active Attack: VMware vCenter and SharePoint Race the Patch Clock. Citrix's CVE-2026-8452 followed a stranger path: disclosed on June 30 as a memory overflow causing denial of service, it was demonstrated in mid-August as a route to unauthenticated remote code execution, and hit KEV on August 26 with web shells already turning up on appliances. NetScaler has now supplied three separate exploited flaws in three months, after CVE-2026-8451 and the CVSS 9.3 pre-auth bypass CVE-2026-19490.
Two flaws in this tier were exploited because a proof-of-concept went public, not because a patch was missing. Progress fixed the Kemp LoadMaster command-injection bug on June 4; exploitation attempts began on June 29, the day a full technical analysis with working exploit code appeared, and by the time CISA listed it on August 7 defenders had recorded 792 attempts — the story we covered in Progress Kemp LoadMaster CVE-2026-8037 Added to CISA KEV After 792 Exploit Attempts. SharePoint's CVE-2026-55040 compressed the same sequence into about 24 hours: Rapid7 published its JWT-forgery analysis and PoC on August 11, honeypots recorded exploitation on August 12. Microsoft had shipped the fix in July. We covered both the original patch and Rapid7's chained-RCE research.
Metabase and macOS both punish self-hosted defaults. Metabase's unauthenticated SQL injection through the password-reset endpoint — now tracked as CVE-2026-72898 and scored 10.0 — was exploited as a zero-day against Metabase Cloud in early August before it had a CVE at all; Framework and Tally subsequently disclosed data theft. The reason it ranks so highly is not the score but what a business-intelligence console holds: the stored credentials for every database it queries. Our original coverage is in Metabase CVSS 10.0 Zero-Day Exploited in the Wild. Apple's CVE-2026-65400 lets an attacker on the network authenticate to Screen Sharing without valid credentials; the Dutch NCSC confirmed exploitation on August 15, and observed activity ran to Monero mining on exposed Macs.
The lowest-scoring entry deserves the most attention. CVE-2026-68820, a use-after-free in AFD.sys, is a local privilege escalation rated 7.0 — Important, not Critical. Check Point attributed exploitation to Lazarus as part of the long-running Operation Dream Job campaign, using the bug to load a new build of the FudModule kernel rootkit after initial compromise. A 7.0 that a state-sponsored group uses to get into ring 0 is not a 7.0 problem. It is also a reminder of what CVSS measures: the technical characteristics of the flaw, not the capability of the people using it. If you triage strictly by score, this one lands below dozens of unexploited Criticals — which is precisely how a rootkit ends up on a defense contractor's network.
Cisco's CVE-2026-20349 rounds out the tier and illustrates the opposite adjustment. It is exploited, unauthenticated and internet-facing, which normally means top three. But its impact is a device reload, not compromise — a firewall that falls over rather than one that lets an attacker through. That still matters when the device is your VPN concentrator, so it stays on the list; it just does not outrank a pre-auth RCE.
Tier 2 — Patch-now criticals (no confirmed attacks yet)
Microsoft's August Patch Tuesday was the second monster in as many months: roughly 421 CVEs, about 62 of them Critical, one exploited zero-day and two publicly disclosed before a fix existed. We covered the release in Microsoft's August 2026 Patch Tuesday: 421 CVEs and an Actively Exploited afd.sys Zero-Day, and it followed July's record 569-CVE cycle.
Four of the Critical fixes cluster in core Windows networking — DNS Server, Deployment Services, QUIC and DHCP Server — and all four are remote code execution flaws requiring no authentication. Three do not even require the attacker to sit on the same network segment. CVE-2026-62878 in Windows DNS Server drew the most attention, both because researchers described it as wormable and because DNS Server is almost always co-resident with a domain controller. Compromise there is not a server problem, it is a directory problem. CVE-2026-62815 in Microsoft QUIC is the other one worth pulling forward: a use-after-free in the transport underneath HTTP/3, exploitable by a single crafted packet with no user interaction.
Neither has confirmed exploitation as of this writing, which is exactly why they sit in Tier 2 rather than Tier 1. The August record suggests how long that distinction tends to last once someone publishes working code.
Tier 3 — Self-hosted and infrastructure
SAP's August patch day carried five Critical notes, topped by CVE-2026-58231 (CVSS 10.0) in the SAP Commerce Cloud Data Hub Adapter and CVE-2026-44772 (9.9) in Manufacturing Integration and Intelligence. The one to watch on unmanaged estates is CVE-2026-34265 (9.8), a memory-corruption flaw in DIAG protocol parsing that spans NetWeaver ABAP kernel versions 7.22 through 9.19 and is reachable without authentication.
SonicWall shipped fixes for six flaws in Global Management System, a product retired in October 2025 — including CVE-2026-66147 (9.4), a command injection in the GMS Dispatcher Service, and CVE-2026-66145 (9.1), an RCE via zip-slip file write. SonicWall reports no evidence of exploitation. The more useful signal is that a discontinued management platform still warranted an emergency Critical patch, which tells you how many are still running.
Finally, CISA's August 26 batch included five vulnerabilities from 2015 to 2022 — Red Hat libuser, Red Hat ABRT, Microsoft SQL Server, Ajax.NET Professional and the Linux kernel. Legacy KEV additions are easy to skim past. They are worth a query against your asset inventory, because the reason they were added is that somebody is currently succeeding with them.
The CyberSignal Analysis
Signal 01 — The patch gap, not the zero-day, is the story
Strip August down to its arithmetic. Sixteen KEV additions. Two zero-days. Five entries from 2015 to 2022. Everything else was a flaw with a published vendor fix — April for Windows IKE, June 4 for LoadMaster, June 30 for NetScaler, July for SharePoint, July 29 for vCenter. The attacker workload in August was not vulnerability research. It was reading advisories, weaponising what researchers had already published, and scanning for organisations that had not deployed the fix yet.
That reframes what a vulnerability-management programme is actually competing against. The dangerous interval is not disclosure-to-patch, which is a vendor problem, but patch-to-deployment, which is yours. LoadMaster gives the cleanest measurement: 25 quiet days after the patch shipped, then exploitation the day working code went public. The organisations breached were not victims of an unknowable flaw. They were three weeks late on a known one, and a researcher's publish button decided when that mattered. Treating a shipped patch as a resolved risk is the assumption August punished, repeatedly. A functioning vulnerability management programme has to measure deployment coverage, not patch availability.
Signal 02 — Public PoC is now the exploitation trigger, and the fuse is about a day
Two data points from August sit uncomfortably close together. SharePoint CVE-2026-55040: PoC published August 11, honeypot exploitation August 12. NetScaler CVE-2026-8452: publicly characterised as a denial-of-service bug for six weeks, then reclassified as unauthenticated RCE after researchers demonstrated it in mid-August, with KEV listing eleven days later. In both cases the vulnerability had existed and been patched for weeks. What changed was that the exploitation cost dropped to near zero.
The operational conclusion is uncomfortable but clear: PoC publication, not CVE publication, is the event your patch SLA should key on. Most programmes still run 30-day cycles for Criticals, which was a defensible number when weaponisation took months. It is not defensible against a 24-hour fuse. This does not mean patching everything in a day — nobody can. It means building a fast lane for the small set of flaws where public exploit code exists, and accepting that the rest of the queue moves at normal speed. If you cannot distinguish the two, understanding the difference between a zero-day exploit, a vulnerability and an attack is where that triage starts.
Signal 03 — CVSS keeps mis-ranking the things that actually hurt
August produced a clean natural experiment. The highest-scoring entries on this list — 9.8s in Windows DNS Server and Microsoft QUIC — have no confirmed exploitation. The entry doing the most real-world damage scores 7.0, because AFD.sys requires local access and therefore loses points for attack vector. Lazarus does not care: they already had a foothold from Operation Dream Job phishing, and needed exactly one thing, a route to kernel privileges. The base score measured the wrong stage of the attack.
The inverse also showed up. Cisco's CVE-2026-20349 scores 8.6 and is confirmed exploited, but only causes reloads. Under a strict score-plus-exploitation rule it outranks the Metabase and PaperCut entries. Under a blast-radius rule it does not, because a firewall reboot is an outage and a PaperCut Application Server is code execution inside your network. Neither adjustment is available to a team that sorts a spreadsheet by CVSS descending. That is the whole argument for a ranking method: the score tells you how the flaw behaves, not how much it will cost you.
