Threat Intelligence Report — August 30, 2026 | 7 New KEVs · 238 Victims

Report Date: 2026-08-30

New KEVs: 7  — unchanged vs last weekRansomware Victims: 238  ▼ -16 vs last week

7 vulnerabilities were added to the CISA Known Exploited Vulnerabilities catalog this period. Microsoft products show the strongest concentration of risk signals this week. Threat intelligence sources this period reference APT28 / Fancy Bear (Russia) and Rhysida. Ransomware activity is moderate with 238 new victims posted to leak sites over the last 7 days, with Qilin posting the most victims.

Patch This Week

The top 3 KEVs to remediate right now, ranked by CISA deadline proximity, ransomware exploitation, and severity. These are confirmed exploited — if you do nothing else today, patch these.

1. CVE-2026-21962 – Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in | CVSS 10.0 | EPSS 42.0% / 99th pct
   CISA deadline: 2026-08-27 (overdue by 3d) — Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
2. CVE-2026-60004 – Gitea Gitea | CVSS 9.8 | EPSS 84.6% / 100th pct | PoC Available
   CISA deadline: 2026-08-28 (overdue by 2d) — Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
3. CVE-2026-8452 – Citrix NetScaler ADC and NetScaler Gateway | CVSS 8.8 | EPSS 1.6% / 74th pct
   CISA deadline: 2026-08-29 (overdue by 1d) — Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Top KEVs

Vulnerabilities confirmed actively exploited in the wild by CISA — ranked by ransomware use, then severity. Patch these before anything else.

This Reporting Window

• CVE-2026-21962 – Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in | CVSS 10.0 (CRITICAL) | AV: Network | EPSS 42.0% / 99th pct | Ransomware Use: No
• CVE-2023-49105 – ownCloud ownCloud | CVSS 9.8 (CRITICAL) | AV: Network | EPSS 43.2% / 99th pct | Ransomware Use: No
• CVE-2026-60004 – Gitea Gitea | CVSS 9.8 (CRITICAL) | AV: Network | EPSS 84.6% / 100th pct | Ransomware Use: No | PoC Available
• CVE-2026-8452 – Citrix NetScaler ADC and NetScaler Gateway | CVSS 8.8 (HIGH) | AV: Network | EPSS 1.6% / 74th pct | Ransomware Use: No
• CVE-2019-1068 – Microsoft SQL Server | CVSS 8.8 (HIGH) | AV: Network | EPSS 52.8% / 99th pct | Ransomware Use: No
• CVE-2021-23758 – Ajax.NET Professional Ajax.NET Professional | CVSS 8.1 (HIGH) | AV: Network | EPSS 83.6% / 100th pct | Ransomware Use: No | PoC Available
• CVE-2026-53362 – Linux Kernel | CVSS 7.8 (HIGH) | AV: Local | EPSS 0.5% / 42th pct | Ransomware Use: No

Security News

Advisories, threat research, and incident reports from 12 sources across government, commercial research, and security journalism — prioritized by source credibility.

• CISA ICS AdvisoryAdvisory · 3 days ago – All-Line Equipment Company Fuel-Boss
  View CSAF Summary Successful exploitation of these vulnerabilities could allow attackers to execute arbitrary commands or code remotely on affected systems. The following versions of All-Line Equipment Company Fuel-Boss …
• CISA ICS AdvisoryAdvisory · 3 days ago – Rockwell Automation OTTO Fleet Manager
  View CSAF Summary Successful exploitation of this vulnerability could reduce the computational cost required for an attacker to perform offline brute-force attacks against stored password hashes. The following versions o…
• CISA ICS AdvisoryAdvisory · 3 days ago – Xiiaozet LK100W
  View CSAF Summary Successful exploitation of these vulnerabilities could allow an attacker to take control over the device. The following versions of Xiiaozet LK100W are affected: LK100W <2.1.240 (CVE-2026-78037, CVE-…
• SANS ISCResearch · 2 days ago – Some Malicious PE Stats, (Thu, Aug 27th)
  During my last FOR610 session, a student asked me if I had some statistics in mind about the compilers used to generate malicious PE files? A couple of months ago, I shared some stats about the trend in 64bits VS. 3…
• SANS ISCResearch · 3 days ago – A polymorphic phishing page (that occasionally breaks itself), (Thu, Aug 27th)
  As I&#x27ve mentioned before in some of my diaries, from time to time, I like to go over phishing messages that get caught in my various spam traps or sent to us here at the Internet Storm Center.
• Unit 42Research · 5 days ago – The State of AI-Enabled Malware August 2026: From Brand Abuse to Agentic Execution
  Explore Unit 42 research on AI-enabled malware. Learn how existing behavioral detection and endpoint analytics stop AI-authored code before execution. The post The State of AI-Enabled Malware August 2026: From Brand Abus…
• Unit 42Incident · 9 days ago – Connecting the Dots: Securing the Overlooked Corners of the Software Development Lifecycle (SDLC) Supply Chain
  Attackers are targeting CI/CD pipelines and developer tools instead of application code, requiring total SDLC visibility and strict security controls The post Connecting the Dots: Securing the Overlooked Corners of the S…
• Sophos X-OpsResearch · 11 days ago – Fake AI, real malware: Attackers impersonating AI brands
  <p>A year of MDR casework shows attackers repeatedly exploiting demand for AI tools</p> Categories: Threat Research Tags: AI, malvertising, infostealer, Sophos X-Ops
• Sophos X-OpsResearch · 13 days ago – 2608-patch-tuesday
  <p>421 CVEs, a relatively small set of Edge patches, and two spicy stragglers</p> Categories: Threat Research Tags: Patch Tuesday, MICROSOFT PATCH TUESDAY
• The RecordIncident · 2 days ago – PaperCut warns of hackers using printer management software flaw in attacks
  PaperCut released an emergency advisory on Thursday evening saying vulnerabilities in their print management software, PaperCut NG and MF, are under active exploitation.
• The RecordNews · 3 days ago – White House bans foreign-made equipment for power generation over cyber backdoor concerns
  The Trump administration is banning the acquisition of foreign-made components used to manage electricity and power, alleging that “certain foreign actors are increasingly creating and exploiting vulnerabilities” in …
• Security Affairs (APT)Incident · yesterday – Philippine Nuclear and Naval Targets Hit by Suspected Chinese Operator
  An alleged Chinese-speaking actor breached Philippine nuclear and naval targets by exploiting known flaws, stealing sensitive data. A suspected Chinese-speaking operator targeted a Philippine nuclear research body and a …
• Security Affairs (APT)Incident · 2 days ago – Russian APT BlueDelta Uses HOOKEDGE to Target Defense and Diplomatic Organizations
  BlueDelta (APT28) uses webhook.site and Microsoft Edge to hide HOOKEDGE espionage traffic targeting European governments. Recorded Future’s Insikt Group documented a campaign by BlueDelta, the Russian GRU-linked gr…
• Security Affairs (Cybercrime)Incident · today – Extortion Group FulcrumSec Claims 86GB Manchester Airports Group Data Theft
  Extortion group FulcrumSec claims they stole 86GB of Manchester Airports Group data after finding API credentials exposed in client-side JavaScript. Manchester Airports Group (MAG) disclosed a data breach on August 27 af…
• Security Affairs (Cybercrime)Incident · yesterday – Rhysida Ransomware Group Targets Berlin Government Ahead of Vote
  Berlin ‘s government faces a Rhysida ransomware attack weeks before elections, with officials refusing to pay despite a claimed 5.79 TB data theft. Berlin’s state government confirmed this week it’s dea…

Ransomware Activity

Victim counts posted to ransomware group leak sites — use this to gauge which groups are most active and which sectors and regions are being targeted.

45 new victims posted today
7-day total: 238 via Ransomware.live

Infostealer Exposure: 951 employee credentials and 53,521 user credentials compromised via infostealer malware across victim organisations — indicating credential theft likely preceded these ransomware deployments.

Most Active Groups

Group Intelligence

• Qilin — Qilin ransomware was first observed in July of 2022. Qilin Ransomware is written in Golang and supports multiple encryption modes; all of which are controlled by the operator. Qilin actors practice double extortion – demanding payment for a decryptor, as well as for the non-release of stolen data.
• Thegentlemen — The Gentlemen is a RaaS group that emerged in July–August 2025, rapidly claiming over 320 victims across 17+ countries by offering affiliates a 90% revenue share, deploying a Go-based locker against Windows, Linux, NAS, and BSD systems; a compromised C2 server in 2026 revealed more than 1,570 linked victims.
• Krybit — Krybit is an emerging RaaS group that launched in late March 2026, offering affiliates an 80/20 revenue split with support for Windows, Linux, ESXi, and NAS device encryption, and became notable for a public feud with rival group 0APT in which each breached and leaked the other's operator data.
• Akira — The Akira ransomware group is said to have emerged in March 2023, and there's much speculation about its ties to the former CONTI ransomware group.<br> <br> It's worth noting that with the end of CONTI's operation, several affiliates migrated to independent campaigns such as Royal, BlackBasta, and others.<br> <br> According to some reports, Akira affiliates also work with other ransomware operations, such as Snatch and BlackByte, as an open directory of tools used by an Akira operator was identified, which also had connections to the Snatch ransomware.<br> <br> The first version of the Akira ransomware was written in C++ and appended files with the '.akira' extension, creating a ransom note named 'akira_readme.txt,' partially based on the Conti V2 source code. However, on June 29, 2023, a decryptor for this version was reportedly released by Avast.<br> <br> Subsequently, a version was released that fixed the decryption flaw on July 2, 2023. Since then, the new version is said to be written in Rust, this time called 'megazord.exe,' and it changes the extension to '.powerranges' for encrypted files.<br> <br> Most of Akira's initial access vectors use brute-force attempts on Cisco VPN devices (which use single-factor authentication only).<br> Additionally, exploitation of CVEs: CVE-2019-6693 and CVE-2022-40684 for initial access has been identified.<BR>Source: https://github.com/crocodyli/ThreatActors-TTPs

Most Targeted Sectors

Top Countries

US (61), DE (20), GB (15), BR (9), MX (8)

Notable Incidents

• www.sankovn.com (Not Found · VN) — claimed by Krybit. Sanko Fastem (Vietnam) Co., Ltd. is a Vietnamese subsidiary of Sanko Fastem (Thailand) under the Sanko Techno Group (Jap… Press coverage →
• ATF (Government & Defense · US) — claimed by Qilin. N/A Press coverage →
• Brazosport College (Education · US) — claimed by Qilin. N/A Press coverage →
• City of Mitchell (Government & Defense · US) — claimed by Storm. Mitchell is a city in and the county seat of Davison County, South Dakota, United States. Mitchell is the principal city of the Mitchell Micropolitan Statistical Area, which includes all of Davison and Hanson counties.
  … Press coverage →
• Newton County School System (Education · US) — claimed by Qilin. N/A Press coverage →

Vendor-Specific Risks

Vendors with confirmed KEV exploitation this week — the stacked bar shows how that exposure breaks down across exploited CVEs (red), critical CVEs to watch (orange), and news mentions (yellow). Prioritize patching vendors with the largest red segment.