Threat Intelligence Report — August 18, 2026 | 5 New KEVs · 236 Victims

Report Date: 2026-08-18

New KEVs: 5  — unchanged vs last weekRansomware Victims: 236  ▼ -11 vs last week

5 vulnerabilities were added to the CISA Known Exploited Vulnerabilities catalog this period. Microsoft products show the strongest concentration of risk signals this week. Threat intelligence sources this period reference Medusa. Ransomware activity is moderate with 236 new victims posted to leak sites over the last 7 days, with Clop posting the most victims.

Patch This Week

The top 3 KEVs to remediate right now, ranked by CISA deadline proximity, ransomware exploitation, and severity. These are confirmed exploited — if you do nothing else today, patch these.

1. CVE-2025-62593 – Ray-Project Ray | CVSS 9.4 | EPSS 1.0% / 60th pct | PoC Available
   CISA deadline: 2026-08-20 (2d remaining) — Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
2. CVE-2026-33824 – Microsoft Internet Key Exchange (IKE) Service Extensions | CVSS 9.8 | EPSS 55.9% / 99th pct
   CISA deadline: 2026-08-21 (3d remaining) — Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
3. CVE-2026-59310 – Broadcom VMware vCenter | CVSS 9.8 | EPSS 1.1% / 64th pct
   CISA deadline: 2026-08-21 (3d remaining) — Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Top KEVs

Vulnerabilities confirmed actively exploited in the wild by CISA — ranked by ransomware use, then severity. Patch these before anything else.

New Today

• CVE-2026-33824 – Microsoft Internet Key Exchange (IKE) Service Extensions | CVSS 9.8 (CRITICAL) | AV: Network | EPSS 55.9% / 99th pct | Ransomware Use: No
• CVE-2026-59310 – Broadcom VMware vCenter | CVSS 9.8 (CRITICAL) | AV: Network | EPSS 1.1% / 64th pct | Ransomware Use: No
• CVE-2026-65400 – Apple macOS | CVSS 9.8 (CRITICAL) | AV: Network | EPSS 0.5% / 40th pct | Ransomware Use: No
• CVE-2026-55040 – Microsoft SharePoint | CVSS 9.1 (CRITICAL) | AV: Network | EPSS 4.0% / 90th pct | Ransomware Use: No | PoC Available

Still Outstanding

• CVE-2025-62593 – Ray-Project Ray | CVSS 9.4 (CRITICAL) | AV: Network | EPSS 1.0% / 60th pct | Ransomware Use: No | PoC Available

Security News

Advisories, threat research, and incident reports from 12 sources across government, commercial research, and security journalism — prioritized by source credibility.

• CISA ICS AdvisoryAdvisory · today – Siemens Simcenter Nastran
  View CSAF Summary Simcenter Nastran is affected by a stack overflow vulnerability that could be triggered when an application binary reads arbitrary string as a file argument. If a user is tricked to run one of the impac…
• CISA ICS AdvisoryAdvisory · today – CISA Malcolm
  View CSAF Summary Successful exploitation of these vulnerabilities could allow an attacker to cause a denial-of-service condition or execute arbitrary code. The following versions of CISA Malcolm are affected: Malcolm &l…
• CISA ICS AdvisoryAdvisory · 5 days ago – Siemens Siveillance Video
  View CSAF Summary Siveillance Video Management Servers contains a vulnerability that could allow a Remote Code Execution attack. Siemens has released new versions for the affected products and recommends to update to the…
• SANS ISCResearch · yesterday – Apple Patches iOS and macOS, (Mon, Aug 17th)
  Apple today released updates for iOS/iPadOS (26 and 18) and macOS 26. This update fixes 108 vulnerabilities and comes about two weeks after the much smaller macOS update that addressed the single screen-sharing vulnerabi…
• SANS ISCResearch · 2 days ago – Wireshark 4.6.8 Released, (Sun, Aug 16th)
  Wireshark release 4.6.8 fixes 28 vulnerabilities and 25 bugs.
• Unit 42Incident · today – Threat Brief: Mitigating Large-Scale Credential Attacks (Updated August 18)
  We provide guidance for preparing for and mitigating large-scale credential attacks, focusing on recent campaigns targeting security vendors' devices. The post Threat Brief: Mitigating Large-Scale Credential Attacks (Upd…
• Unit 42Research · 7 days ago – Kimwolf v7: An Evolution of the Kimwolf Botnet
  Discover how Kimwolf v7 targets Android IoT devices with HTTP/2 DDoS fingerprinting, Ethereum ENS C2 resolution and Tor backup routing. The post Kimwolf v7: An Evolution of the Kimwolf Botnet appeared first on Unit 42 .
• Sophos X-OpsResearch · yesterday – 2608-patch-tuesday
  <p>423 CVEs, no Edge patches, and a small shift in CWE findings</p> Categories: Threat Research Tags: Patch Tuesday, MICROSOFT PATCH TUESDAY
• Sophos X-OpsResearch · 7 days ago – deno-case-studies
  Attack TTPs combine fileless execution, wide LOLBin use Categories: Threat Research
• The RecordIncident · today – More than 200 victims of Medusa ransomware identified over the last year, CISA says
  The Cybersecurity and Infrastructure Security Agency (CISA) and FBI updated an advisory on the group initially released in March 2025 — writing that as of April 2026, Medusa actors have hit more than 500 victims. CISA …
• The RecordIncident · today – Berlin cuts two state ministries off government network after security breach
  The affected ministries — one responsible for urban development, construction and housing, and the other for mobility, transport, climate protection and the environment — have been isolated from government networks s…
• Security Affairs (APT)News · 2 days ago – Mustang Panda Upgrades CoolClient With a Kernel Rootkit
  Mustang Panda upgraded CoolClient with a signed kernel driver that hides processes, files and network activity, making the backdoor harder to detect. HoneyMyte, also known as Mustang Panda, has pushed its CoolClient back…
• Security Affairs (APT)Incident · 2 days ago – APT36 Suspected in PATCHCORD Espionage Campaign Using Google Sheets C2
  Acronis uncovered PATCHCORD, a stealthy backdoor targeting Afghan telecom and South Asian infrastructure via fake VPN tools and Google Sheets C2. Researchers at Acronis just documented an espionage operation that reads l…
• Security Affairs (Cybercrime)Incident · today – Hackers Expose Data of 1.2 Million Heights Finance Customers
  A Heights Finance breach exposed personal and financial data of over 1.2 million people after hackers compromised a third-party cloud platform. Heights Finance is a U.S. consumer finance company that provides personal lo…
• Security Affairs (Cybercrime)News · today – New Mirai-Based Evooo1Bot Botnet Targets Linux Devices
  Evooo1Bot is a Mirai-based Linux botnet that hijacks routers and IoT devices for DDoS attacks, credential theft and criminal proxy services. Fortinet’s FortiGuard Labs disclosed Evooo1Bot in mid-August, a previousl…

Ransomware Activity

Victim counts posted to ransomware group leak sites — use this to gauge which groups are most active and which sectors and regions are being targeted.

26 new victims posted today
7-day total: 236 via Ransomware.live

Infostealer Exposure: 1,997 employee credentials and 80,077 user credentials compromised via infostealer malware across victim organisations — indicating credential theft likely preceded these ransomware deployments.

Most Active Groups

Group Intelligence

• Clop — The ransomware group known as Cl0p is a variant of a previously known strain dubbed CryptoMix. It is worth noting that this variant was delivered as the final payload in a phishing campaign in 2019 and was exclusively financially motivated, with attacks carried out by the threat actors TA505.<br> <br> At that time, malicious actors sent phishing emails that led to a macro-enabled document that would drop a loader called 'Get2.' After gaining an initial foothold in the system or infrastructure, the actors began using reconnaissance, lateral movement, and exfiltration techniques to prepare for the deployment of the ransomware.<br> <br> After the execution of the ransomware, Cl0p appends the extension '.clop' to the end of files, or other types of extensions such as '.CIIp, .Cllp, and .C_L_O_P,' as well as different versions of the ransom note that were also observed after encryption. Depending on the variant, any of the ransom text files were created with names like 'ClopReadMe.txt, README_README.txt, Cl0pReadMe.txt, and READ_ME_!!!.TXT.'<br> <br> The Clop operation has shifted from delivering its final payload via phishing and has begun initiating attacks using vulnerabilities that resulted in the exploitation and infection of victims' infrastructures.<BR>Source: https://github.com/crocodyli/ThreatActors-TTPs
• Qilin — Qilin ransomware was first observed in July of 2022. Qilin Ransomware is written in Golang and supports multiple encryption modes; all of which are controlled by the operator. Qilin actors practice double extortion – demanding payment for a decryptor, as well as for the non-release of stolen data.
• Thegentlemen — The Gentlemen is a RaaS group that emerged in July–August 2025, rapidly claiming over 320 victims across 17+ countries by offering affiliates a 90% revenue share, deploying a Go-based locker against Windows, Linux, NAS, and BSD systems; a compromised C2 server in 2026 revealed more than 1,570 linked victims.
• Incransom — INC Ransom is a prolific ransomware-as-a-service operation active since July 2023 that systematically targets healthcare, government, education, and manufacturing sectors in North America and Europe, having posted over 200 victims in 2025 alone with no sector off-limits.

Most Targeted Sectors

Top Countries

US (78), DE (18), IT (15), GB (12), AU (9)

Notable Incidents

• Berlin Brandenburgische Wohnungsbaugenossenschaft (Other · DE) — claimed by Qilin. N/A Press coverage →
• Woodhaven Association (Other · US) — claimed by Play. United States Press coverage →
• Foresee Pharmaceuticals (Healthcare · TW) — claimed by Incransom. Foresee Pharmaceuticals Co., Ltd.
  https://www.foreseepharma.com

  Total leak: 1,2TB

  Leak includes: Drug Master File, ASMF, FDA/EMA, R&D, Financial statements, Clinical study reports and other confidential informati… Press coverage →

• vgrn.de (Energy & Utilities · DE) — claimed by Lockbit5. Verbandsgemeinde Rhein-Nahe is a company that operates in the Government industry. Press coverage →
• Cook Medical LLC (Healthcare · US) — claimed by Shinyhunters. Customer data, employee data, and other internal corporate data was compromised. The Company engaged with us but made several paltry offers, did not want to pay what we asked for and decided they are okay with the data l… Press coverage →

Vendor-Specific Risks

Vendors with confirmed KEV exploitation this week — the stacked bar shows how that exposure breaks down across exploited CVEs (red), critical CVEs to watch (orange), and news mentions (yellow). Prioritize patching vendors with the largest red segment.