Report Date: 2026-09-01
New KEVs: 7 ▲ +1 vs last weekRansomware Victims: 0 ▼ -252 vs last week
7 vulnerabilities were added to the CISA Known Exploited Vulnerabilities catalog this period. Papercut products show the strongest concentration of risk signals this week.
Patch This Week
The top 3 KEVs to remediate right now, ranked by CISA deadline proximity, ransomware exploitation, and severity. These are confirmed exploited — if you do nothing else today, patch these.
- CVE-2026-8452 – Citrix NetScaler ADC and NetScaler Gateway | CVSS 8.8 | EPSS 1.6% / 74th pct
CISA deadline: 2026-08-29 (overdue by 3d) — Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. - CVE-2019-1068 – Microsoft SQL Server | CVSS 8.8 | EPSS 52.8% / 99th pct
CISA deadline: 2026-08-29 (overdue by 3d) — Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. - CVE-2023-49105 – ownCloud ownCloud | CVSS 9.8 | EPSS 43.2% / 99th pct
CISA deadline: 2026-08-30 (overdue by 2d) — Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Top KEVs
Vulnerabilities confirmed actively exploited in the wild by CISA — ranked by ransomware use, then severity. Patch these before anything else.
This Reporting Window
- CVE-2023-49105 – ownCloud ownCloud | CVSS 9.8 (CRITICAL) | AV: Network | EPSS 43.2% / 99th pct | Ransomware Use: No
- CVE-2026-82078 – PaperCut NG/MF | CVSS 9.4 (CRITICAL) | AV: Network | EPSS 0.5% / 38th pct | Ransomware Use: No
- CVE-2026-81578 – PaperCut NG/MF | CVSS 8.8 (HIGH) | AV: Network | EPSS 0.4% / 32th pct | Ransomware Use: No
- CVE-2026-8452 – Citrix NetScaler ADC and NetScaler Gateway | CVSS 8.8 (HIGH) | AV: Network | EPSS 1.6% / 74th pct | Ransomware Use: No
- CVE-2019-1068 – Microsoft SQL Server | CVSS 8.8 (HIGH) | AV: Network | EPSS 52.8% / 99th pct | Ransomware Use: No
- CVE-2021-23758 – Ajax.NET Professional Ajax.NET Professional | CVSS 8.1 (HIGH) | AV: Network | EPSS 83.6% / 100th pct | Ransomware Use: No | PoC Available
- CVE-2026-53362 – Linux Kernel | CVSS 7.8 (HIGH) | AV: Local | EPSS 0.5% / 42th pct | Ransomware Use: No
Security News
Advisories, threat research, and incident reports from 12 sources across government, commercial research, and security journalism — prioritized by source credibility.
- CISA ICS AdvisoryAdvisory · 5 days ago – All-Line Equipment Company Fuel-Boss
View CSAF Summary Successful exploitation of these vulnerabilities could allow attackers to execute arbitrary commands or code remotely on affected systems. The following versions of All-Line Equipment Company Fuel-Boss … - CISA ICS AdvisoryAdvisory · 5 days ago – Ebyte NA111-M
View CSAF Summary Successful exploitation of these vulnerabilities could allow an attacker to fully compromise the device. The following versions of Ebyte NA111-M are affected: NA111-M Firmware 9013-2-17 (CVE-2026-73125,… - CISA ICS AdvisoryAdvisory · 5 days ago – Applied Systems Engineering ASE2000 V2 Communications Test Set
View CSAF Summary Successful exploitation of these vulnerabilities could allow an attacker to read or write arbitrary local files, cause the application to issue outbound network requests, or intercept the connection to … - SANS ISCResearch · 4 days ago – Some Malicious PE Stats, (Thu, Aug 27th)
During my last FOR610 session, a student asked me if I had some statistics in mind about the compilers used to generate malicious PE files? A couple of months ago, I shared some stats about the trend in 64bits VS. 3… - SANS ISCResearch · 5 days ago – A polymorphic phishing page (that occasionally breaks itself), (Thu, Aug 27th)
As I've mentioned before in some of my diaries, from time to time, I like to go over phishing messages that get caught in my various spam traps or sent to us here at the Internet Storm Center.
 - Unit 42Research · yesterday – Spring Ring: An Inside Look at Voice Phishing Campaigns in Microsoft Teams
Learn how the Spring Ring campaign abuses Microsoft Teams and voice phishing to deploy malware and target enterprise domain controllers. The post Spring Ring: An Inside Look at Voice Phishing Campaigns in Microsoft Teams… - Unit 42Research · 7 days ago – The State of AI-Enabled Malware August 2026: From Brand Abuse to Agentic Execution
Explore Unit 42 research on AI-enabled malware. Learn how existing behavioral detection and endpoint analytics stop AI-authored code before execution. The post The State of AI-Enabled Malware August 2026: From Brand Abus… - Sophos X-OpsResearch · 13 days ago – Fake AI, real malware: Attackers impersonating AI brands
<p>A year of MDR casework shows attackers repeatedly exploiting demand for AI tools</p> Categories: Threat Research Tags: AI, malvertising, infostealer, Sophos X-Ops - Sophos X-OpsResearch · 15 days ago – 2608-patch-tuesday
<p>421 CVEs, a relatively small set of Edge patches, and two spicy stragglers</p> Categories: Threat Research Tags: Patch Tuesday, MICROSOFT PATCH TUESDAY - The RecordIncident · yesterday – Fraudsters steal $6 million from Tectonic crypto platform after inflating token price
At least $6 million was stolen from crypto platform Tectonic after an attacker manipulated the price of the Tonic coin over the weekend. - The RecordIncident · yesterday – Berlin says it wonât pay ransom after hackers steal government data
Governing Mayor Kai Wegner said that Berlin had received an extortion demand following the cyberattack, which was discovered in mid-August. - Security Affairs (APT)Incident · yesterday – China-linked Fire Ant Hides Inside Trusted Infrastructure
Fire Ant hijacked Cisco routers, stole credentials and altered logs to hide its tracks, using trusted infrastructure to reach high-value networks. Chinese-linked cyber espionage group Fire Ant has spent the past year qui… - Security Affairs (APT)Incident · 3 days ago – Philippine Nuclear and Naval Targets Hit by Suspected Chinese Operator
An alleged Chinese-speaking actor breached Philippine nuclear and naval targets by exploiting known flaws, stealing sensitive data. A suspected Chinese-speaking operator targeted a Philippine nuclear research body and a … - Security Affairs (Cybercrime)News · yesterday – ValleyRAT: When Legitimate Software Becomes a Malware Delivery Tool
ValleyRAT hides behind legitimate adware, using DLL sideloading to evade detection, steal data and give Silver Fox control of infected systems. ValleyRAT doesn’t always need to disguise itself as a cracked game or … - Security Affairs (Cybercrime)Incident · 2 days ago – Extortion Group FulcrumSec Claims 86GB Manchester Airports Group Data Theft
Extortion group FulcrumSec claims they stole 86GB of Manchester Airports Group data after finding API credentials exposed in client-side JavaScript. Manchester Airports Group (MAG) disclosed a data breach on August 27 af…
Ransomware Activity
Ransomware activity data could not be retrieved for this reporting window.
Vendor-Specific Risks
Vendors with confirmed KEV exploitation this week — the stacked bar shows how that exposure breaks down across exploited CVEs (red), critical CVEs to watch (orange), and news mentions (yellow). Prioritize patching vendors with the largest red segment.
Stay Ahead
Found this useful? Get the daily report in your reader.
Free. No account. No email. Follow in Feedly, Inoreader, or any RSS reader.