Report Date: 2026-08-28
New KEVs: 7 — unchanged vs last weekRansomware Victims: 248 ▲ +15 vs last week
7 vulnerabilities were added to the CISA Known Exploited Vulnerabilities catalog this period. Microsoft products show the strongest concentration of risk signals this week. Ransomware activity is moderate with 248 new victims posted to leak sites over the last 7 days, with Qilin posting the most victims.
Patch This Week
The top 3 KEVs to remediate right now, ranked by CISA deadline proximity, ransomware exploitation, and severity. These are confirmed exploited — if you do nothing else today, patch these.
- CVE-2026-21962 – Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in | CVSS 10.0 | EPSS 42.0% / 99th pct
CISA deadline: 2026-08-27 (overdue by 1d) — Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. - CVE-2026-60004 – Gitea Gitea | CVSS 9.8 | EPSS 82.4% / 100th pct | PoC Available
CISA deadline: 2026-08-28 (0d remaining) — Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. - CVE-2026-8452 – Citrix NetScaler ADC and NetScaler Gateway | CVSS 8.8 | EPSS 1.6% / 74th pct
CISA deadline: 2026-08-29 (1d remaining) — Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Top KEVs
Vulnerabilities confirmed actively exploited in the wild by CISA — ranked by ransomware use, then severity. Patch these before anything else.
This Reporting Window
- CVE-2026-21962 – Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in | CVSS 10.0 (CRITICAL) | AV: Network | EPSS 42.0% / 99th pct | Ransomware Use: No
- CVE-2023-49105 – ownCloud ownCloud | CVSS 9.8 (CRITICAL) | AV: Network | EPSS 11.1% / 96th pct | Ransomware Use: No
- CVE-2026-60004 – Gitea Gitea | CVSS 9.8 (CRITICAL) | AV: Network | EPSS 82.4% / 100th pct | Ransomware Use: No | PoC Available
- CVE-2026-8452 – Citrix NetScaler ADC and NetScaler Gateway | CVSS 8.8 (HIGH) | AV: Network | EPSS 1.6% / 74th pct | Ransomware Use: No
- CVE-2019-1068 – Microsoft SQL Server | CVSS 8.8 (HIGH) | AV: Network | EPSS 52.8% / 99th pct | Ransomware Use: No
- CVE-2021-23758 – Ajax.NET Professional Ajax.NET Professional | CVSS 8.1 (HIGH) | AV: Network | EPSS 83.6% / 100th pct | Ransomware Use: No | PoC Available
- CVE-2026-53362 – Linux Kernel | CVSS 7.8 (HIGH) | AV: Local | EPSS 0.3% / 18th pct | Ransomware Use: No
Security News
Advisories, threat research, and incident reports from 12 sources across government, commercial research, and security journalism — prioritized by source credibility.
- CISA ICS AdvisoryAdvisory · yesterday – All-Line Equipment Company Fuel-Boss
View CSAF Summary Successful exploitation of these vulnerabilities could allow attackers to execute arbitrary commands or code remotely on affected systems. The following versions of All-Line Equipment Company Fuel-Boss … - CISA ICS AdvisoryAdvisory · yesterday – Rockwell Automation OTTO Fleet Manager
View CSAF Summary Successful exploitation of this vulnerability could reduce the computational cost required for an attacker to perform offline brute-force attacks against stored password hashes. The following versions o… - CISA ICS AdvisoryAdvisory · yesterday – Xiiaozet LK100W
View CSAF Summary Successful exploitation of these vulnerabilities could allow an attacker to take control over the device. The following versions of Xiiaozet LK100W are affected: LK100W <2.1.240 (CVE-2026-78037, CVE-… - SANS ISCResearch · yesterday – A polymorphic phishing page (that occasionally breaks itself), (Thu, Aug 27th)
As I've mentioned before in some of my diaries, from time to time, I like to go over phishing messages that get caught in my various spam traps or sent to us here at the Internet Storm Center.
 - SANS ISCResearch · 3 days ago – Obfuscating IP Addresses as Hostnames, (Tue, Aug 25th)
It is pretty obvious that hostnames can replace IP addresses. Pretty much any software accepting an IP address will also accept a hostname as an argument. Last week, I wrote about scans for the cloud metadata service lis… - Unit 42Research · 3 days ago – The State of AI-Enabled Malware August 2026: From Brand Abuse to Agentic Execution
Explore Unit 42 research on AI-enabled malware. Learn how existing behavioral detection and endpoint analytics stop AI-authored code before execution. The post The State of AI-Enabled Malware August 2026: From Brand Abus… - Unit 42Incident · 7 days ago – Connecting the Dots: Securing the Overlooked Corners of the Software Development Lifecycle (SDLC) Supply Chain
Attackers are targeting CI/CD pipelines and developer tools instead of application code, requiring total SDLC visibility and strict security controls The post Connecting the Dots: Securing the Overlooked Corners of the S… - Sophos X-OpsResearch · 9 days ago – Fake AI, real malware: Attackers impersonating AI brands
<p>A year of MDR casework shows attackers repeatedly exploiting demand for AI tools</p> Categories: Threat Research Tags: AI, malvertising, infostealer, Sophos X-Ops - Sophos X-OpsResearch · 11 days ago – 2608-patch-tuesday
<p>421 CVEs, a relatively small set of Edge patches, and two spicy stragglers</p> Categories: Threat Research Tags: Patch Tuesday, MICROSOFT PATCH TUESDAY - The RecordNews · yesterday – White House bans foreign-made equipment for power generation over cyber backdoor concerns
The Trump administration is banning the acquisition of foreign-made components used to manage electricity and power, alleging that âcertain foreign actors are increasingly creating and exploiting vulnerabilitiesâ in … - The RecordIncident · yesterday – Chinese and Russian spies stepping up cyberattacks, German companies report
Foreign intelligence services, particularly those from China and Russia, are increasingly behind cyberattacks on German companies, according to a new survey of the countryâs private sector. - Security Affairs (APT)News · yesterday – Dark Caracal Deploys New Go Malware With Ethereum-Based C2 Fallback
Dark Caracal targets Venezuela with GoCaracal, an upgraded Bandook toolkit and an Ethereum fallback for resilient C2 communications. Dark Caracal is back with new malware and the same hunting grounds. Arctic Wolf Labs re… - Security Affairs (APT)News · 2 days ago – FBI Seizes China-Linked Hacking Platforms QScan and QTRouter Used Against Critical Infrastructure
FBI seizes QScan and QTRouter, China-linked platforms used to hide intrusions and target U.S. critical infrastructure. The U.S. Department of Justice and the FBI have seized two platforms, QScan and QTRouter, used by a C… - Security Affairs (Cybercrime)News · yesterday – Australian Police Charge Two Over TeamPCP Credential Theft
Australian police charged two men linked to TeamPCP over malware hidden in open-source code that stole 500,000+ credentials from 1,000+ organizations. Australian police have charged two men from Western Australia over a … - Security Affairs (Cybercrime)Incident · 2 days ago – Operation Jackal: 58 Arrests Expose the Money Laundering Machine Behind Global Scams
INTERPOL’s Operation Jackal IV made 58 arrests and exposed global networks laundering money from scams, fraud and sextortion. INTERPOL announced that Operation Jackal IV, running from November 2025 to June 2026, led to 5…
Ransomware Activity
Victim counts posted to ransomware group leak sites — use this to gauge which groups are most active and which sectors and regions are being targeted.
40 new victims posted today
7-day total: 248 via Ransomware.live
Infostealer Exposure: 2,180 employee credentials and 15,507 user credentials compromised via infostealer malware across victim organisations — indicating credential theft likely preceded these ransomware deployments.
Most Active Groups
Group Intelligence
- Qilin — Qilin ransomware was first observed in July of 2022. Qilin Ransomware is written in Golang and supports multiple encryption modes; all of which are controlled by the operator. Qilin actors practice double extortion – demanding payment for a decryptor, as well as for the non-release of stolen data.
- Thegentlemen — The Gentlemen is a RaaS group that emerged in July–August 2025, rapidly claiming over 320 victims across 17+ countries by offering affiliates a 90% revenue share, deploying a Go-based locker against Windows, Linux, NAS, and BSD systems; a compromised C2 server in 2026 revealed more than 1,570 linked victims.
- Coinbasecartel — CoinbaseCartel specializes in data acquisition through system access and strategic partnerships. It focus exclusively on data exfiltration—our operations never involve system encryption or operational disruption.
- Krybit — Krybit is an emerging RaaS group that launched in late March 2026, offering affiliates an 80/20 revenue split with support for Windows, Linux, ESXi, and NAS device encryption, and became notable for a public feud with rival group 0APT in which each breached and leaked the other's operator data.
Most Targeted Sectors
Top Countries
US (85), DE (14), GB (10), IT (10), MX (8)
Notable Incidents
- ATF (Government & Defense · US) — claimed by Qilin. N/A Press coverage →
- Brazosport College (Education · US) — claimed by Qilin. N/A Press coverage →
- icnavais.com (Not Found · PT) — claimed by Lockbit5. The Itaguaí Construções Navais S.A. known as ICN, is a Brazilian state-owned defence company special… Press coverage →
- City of Mitchell (Government & Defense · US) — claimed by Storm. Mitchell is a city in and the county seat of Davison County, South Dakota, United States. Mitchell is the principal city of the Mitchell Micropolitan Statistical Area, which includes all of Davison and Hanson counties.
… Press coverage → - adt.com (Professional Services · US) — claimed by Lockbit5. ADT is a security company that offers security systems, cameras, alarms ad home automation services…. Press coverage →
Vendor-Specific Risks
Vendors with confirmed KEV exploitation this week — the stacked bar shows how that exposure breaks down across exploited CVEs (red), critical CVEs to watch (orange), and news mentions (yellow). Prioritize patching vendors with the largest red segment.
Stay Ahead
Found this useful? Get the daily report in your reader.
Free. No account. No email. Follow in Feedly, Inoreader, or any RSS reader.