Threat Intelligence Report — August 29, 2026 | 7 New KEVs · 242 Victims

Report Date: 2026-08-29

New KEVs: 7  — unchanged vs last weekRansomware Victims: 242  ▼ -2 vs last week

7 vulnerabilities were added to the CISA Known Exploited Vulnerabilities catalog this period. Microsoft products show the strongest concentration of risk signals this week. Threat intelligence sources this period reference APT28 / Fancy Bear (Russia). Ransomware activity is moderate with 242 new victims posted to leak sites over the last 7 days, with Qilin posting the most victims.

Patch This Week

The top 3 KEVs to remediate right now, ranked by CISA deadline proximity, ransomware exploitation, and severity. These are confirmed exploited — if you do nothing else today, patch these.

1. CVE-2026-21962 – Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in | CVSS 10.0 | EPSS 42.0% / 99th pct
   CISA deadline: 2026-08-27 (overdue by 2d) — Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
2. CVE-2026-60004 – Gitea Gitea | CVSS 9.8 | EPSS 84.6% / 100th pct | PoC Available
   CISA deadline: 2026-08-28 (overdue by 1d) — Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
3. CVE-2026-8452 – Citrix NetScaler ADC and NetScaler Gateway | CVSS 8.8 | EPSS 1.6% / 74th pct
   CISA deadline: 2026-08-29 (0d remaining) — Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Top KEVs

Vulnerabilities confirmed actively exploited in the wild by CISA — ranked by ransomware use, then severity. Patch these before anything else.

This Reporting Window

• CVE-2026-21962 – Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in | CVSS 10.0 (CRITICAL) | AV: Network | EPSS 42.0% / 99th pct | Ransomware Use: No
• CVE-2023-49105 – ownCloud ownCloud | CVSS 9.8 (CRITICAL) | AV: Network | EPSS 41.2% / 99th pct | Ransomware Use: No
• CVE-2026-60004 – Gitea Gitea | CVSS 9.8 (CRITICAL) | AV: Network | EPSS 84.6% / 100th pct | Ransomware Use: No | PoC Available
• CVE-2026-8452 – Citrix NetScaler ADC and NetScaler Gateway | CVSS 8.8 (HIGH) | AV: Network | EPSS 1.6% / 74th pct | Ransomware Use: No
• CVE-2019-1068 – Microsoft SQL Server | CVSS 8.8 (HIGH) | AV: Network | EPSS 52.8% / 99th pct | Ransomware Use: No
• CVE-2021-23758 – Ajax.NET Professional Ajax.NET Professional | CVSS 8.1 (HIGH) | AV: Network | EPSS 83.6% / 100th pct | Ransomware Use: No | PoC Available
• CVE-2026-53362 – Linux Kernel | CVSS 7.8 (HIGH) | AV: Local | EPSS 0.5% / 41th pct | Ransomware Use: No

Security News

Advisories, threat research, and incident reports from 12 sources across government, commercial research, and security journalism — prioritized by source credibility.

• CISA ICS AdvisoryAdvisory · 2 days ago – All-Line Equipment Company Fuel-Boss
  View CSAF Summary Successful exploitation of these vulnerabilities could allow attackers to execute arbitrary commands or code remotely on affected systems. The following versions of All-Line Equipment Company Fuel-Boss …
• CISA ICS AdvisoryAdvisory · 2 days ago – Rockwell Automation OTTO Fleet Manager
  View CSAF Summary Successful exploitation of this vulnerability could reduce the computational cost required for an attacker to perform offline brute-force attacks against stored password hashes. The following versions o…
• CISA ICS AdvisoryAdvisory · 2 days ago – Xiiaozet LK100W
  View CSAF Summary Successful exploitation of these vulnerabilities could allow an attacker to take control over the device. The following versions of Xiiaozet LK100W are affected: LK100W <2.1.240 (CVE-2026-78037, CVE-…
• SANS ISCResearch · yesterday – Some Malicious PE Stats, (Thu, Aug 27th)
  During my last FOR610 session, a student asked me if I had some statistics in mind about the compilers used to generate malicious PE files? A couple of months ago, I shared some stats about the trend in 64bits VS. 3…
• SANS ISCResearch · 2 days ago – A polymorphic phishing page (that occasionally breaks itself), (Thu, Aug 27th)
  As I&#x27ve mentioned before in some of my diaries, from time to time, I like to go over phishing messages that get caught in my various spam traps or sent to us here at the Internet Storm Center.
• Unit 42Research · 4 days ago – The State of AI-Enabled Malware August 2026: From Brand Abuse to Agentic Execution
  Explore Unit 42 research on AI-enabled malware. Learn how existing behavioral detection and endpoint analytics stop AI-authored code before execution. The post The State of AI-Enabled Malware August 2026: From Brand Abus…
• Unit 42Incident · 8 days ago – Connecting the Dots: Securing the Overlooked Corners of the Software Development Lifecycle (SDLC) Supply Chain
  Attackers are targeting CI/CD pipelines and developer tools instead of application code, requiring total SDLC visibility and strict security controls The post Connecting the Dots: Securing the Overlooked Corners of the S…
• Sophos X-OpsResearch · 10 days ago – Fake AI, real malware: Attackers impersonating AI brands
  <p>A year of MDR casework shows attackers repeatedly exploiting demand for AI tools</p> Categories: Threat Research Tags: AI, malvertising, infostealer, Sophos X-Ops
• Sophos X-OpsResearch · 12 days ago – 2608-patch-tuesday
  <p>421 CVEs, a relatively small set of Edge patches, and two spicy stragglers</p> Categories: Threat Research Tags: Patch Tuesday, MICROSOFT PATCH TUESDAY
• The RecordIncident · yesterday – PaperCut warns of hackers using printer management software flaw in attacks
  PaperCut released an emergency advisory on Thursday evening saying vulnerabilities in their print management software, PaperCut NG and MF, are under active exploitation.
• The RecordNews · 2 days ago – White House bans foreign-made equipment for power generation over cyber backdoor concerns
  The Trump administration is banning the acquisition of foreign-made components used to manage electricity and power, alleging that “certain foreign actors are increasingly creating and exploiting vulnerabilities” in …
• Security Affairs (APT)Incident · yesterday – Russian APT BlueDelta Uses HOOKEDGE to Target Defense and Diplomatic Organizations
  BlueDelta (APT28) uses webhook.site and Microsoft Edge to hide HOOKEDGE espionage traffic targeting European governments. Recorded Future’s Insikt Group documented a campaign by BlueDelta, the Russian GRU-linked gr…
• Security Affairs (APT)News · 2 days ago – Dark Caracal Deploys New Go Malware With Ethereum-Based C2 Fallback
  Dark Caracal targets Venezuela with GoCaracal, an upgraded Bandook toolkit and an Ethereum fallback for resilient C2 communications. Dark Caracal is back with new malware and the same hunting grounds. Arctic Wolf Labs re…
• Security Affairs (Cybercrime)Incident · yesterday – Love Electric Breach: 877,000 Driver Records Offered for $600
  Love Electric’s alleged data breach exposes sensitive driver data and highlights the identity risks created by third-party salary sacrifice providers. A seller on an English-language data-breach forum claimed on Au…
• Security Affairs (Cybercrime)News · 2 days ago – Australian Police Charge Two Over TeamPCP Credential Theft
  Australian police charged two men linked to TeamPCP over malware hidden in open-source code that stole 500,000+ credentials from 1,000+ organizations. Australian police have charged two men from Western Australia over a …

Ransomware Activity

Victim counts posted to ransomware group leak sites — use this to gauge which groups are most active and which sectors and regions are being targeted.

26 new victims posted today
7-day total: 242 via Ransomware.live

Infostealer Exposure: 2,181 employee credentials and 15,458 user credentials compromised via infostealer malware across victim organisations — indicating credential theft likely preceded these ransomware deployments.

Most Active Groups

Group Intelligence

• Qilin — Qilin ransomware was first observed in July of 2022. Qilin Ransomware is written in Golang and supports multiple encryption modes; all of which are controlled by the operator. Qilin actors practice double extortion – demanding payment for a decryptor, as well as for the non-release of stolen data.
• Coinbasecartel — CoinbaseCartel specializes in data acquisition through system access and strategic partnerships. It focus exclusively on data exfiltration—our operations never involve system encryption or operational disruption.
• Krybit — Krybit is an emerging RaaS group that launched in late March 2026, offering affiliates an 80/20 revenue split with support for Windows, Linux, ESXi, and NAS device encryption, and became notable for a public feud with rival group 0APT in which each breached and leaked the other's operator data.
• Thegentlemen — The Gentlemen is a RaaS group that emerged in July–August 2025, rapidly claiming over 320 victims across 17+ countries by offering affiliates a 90% revenue share, deploying a Go-based locker against Windows, Linux, NAS, and BSD systems; a compromised C2 server in 2026 revealed more than 1,570 linked victims.

Most Targeted Sectors

Top Countries

US (79), DE (13), GB (12), BR (8), IT (8)

Notable Incidents

• ATF (Government & Defense · US) — claimed by Qilin. N/A Press coverage →
• Brazosport College (Education · US) — claimed by Qilin. N/A Press coverage →
• icnavais.com (Not Found · PT) — claimed by Lockbit5. The Itaguaí Construções Navais S.A. known as ICN, is a Brazilian state-owned defence company special… Press coverage →
• City of Mitchell (Government & Defense · US) — claimed by Storm. Mitchell is a city in and the county seat of Davison County, South Dakota, United States. Mitchell is the principal city of the Mitchell Micropolitan Statistical Area, which includes all of Davison and Hanson counties.
  … Press coverage →
• Newton County School System (Education · US) — claimed by Qilin. N/A Press coverage →

Vendor-Specific Risks

Vendors with confirmed KEV exploitation this week — the stacked bar shows how that exposure breaks down across exploited CVEs (red), critical CVEs to watch (orange), and news mentions (yellow). Prioritize patching vendors with the largest red segment.