Microsoft shipped 421 security fixes this month. Exactly one of them was being used to attack anyone.
That one scored 7.0. Forty-two others were rated “critical” with higher numbers, and none of those were under attack. Patch by severity score in August and you queued 42 vulnerabilities ahead of the only one that mattered.
The CISA KEV catalog is what separates the two groups, and it added 9 vulnerabilities in August 2026.
You already know the feeling. A patch list lands, everything is red, and there’s no way to do it all this week. The question isn’t which CVE is worst on paper. It’s which one someone is using against you right now.
This article covers the 5 Known Exploited Vulnerabilities that matter most to network teams, with the exact fixed versions, the log windows to audit, and the exploitation-probability data that reorders the whole list.
If you run Cisco ASA or FTD firewalls, manage endpoints through N-central, or have Metabase or TeamCity reachable from the internet, check your patch status as you go.
Here’s what to fix. Right now.
What Is CISA KEV and Why Does It Matter to Network Engineers?
The CISA KEV catalog is the U.S. Cybersecurity and Infrastructure Security Agency’s live list of CVEs confirmed to be actively exploited in the wild. Not theoretical. Not “could be used.” Actually being used, against real targets.
Every entry meets three criteria:
- Has an assigned CVE ID
- Has clear remediation guidance available
- Has reliable evidence of active exploitation in the wild
Under Binding Operational Directive 22-01, all U.S. federal civilian agencies must patch KEV-listed vulnerabilities within set deadlines. Those deadlines usually run 14 to 21 days.
In August, seven of the nine came with a 3-day deadline.
That’s worth pausing on. CISA compresses the window when exploitation is already widespread and the damage is already happening. Seven 3-day deadlines in one month is not routine housekeeping.
Private companies aren’t legally bound by BOD 22-01. But a KEV listing means attackers are using this vulnerability right now, against organisations like yours. The government is telling its own agencies to drop everything. The private-sector answer should be the same.
The catalog passed 1,665 total entries with the 2026-08-14 release. August’s Patch Tuesday alone accounted for 421 fixes, 42 of them rated critical, according to Rapid7’s analysis.
The 5 Most Critical CISA KEV Entries of August 2026
CVE #1: CVE-2026-72898 – Metabase Unauthenticated SQL Injection (CVSS 10.0)
CVSS 10.0. A perfect score, and a zero-day that attackers were using before anyone knew it existed.
What it is: An unauthenticated SQL injection in Metabase, the open-source business intelligence tool. An attacker injects arbitrary SQL into the Metabase application database with no login at all. Successful exploitation hands over administrator access to the instance.
What an attacker gets: Full admin on your BI platform. Think about what Metabase actually holds. It’s the tool you deliberately connected to everything: the production database, the finance warehouse, the customer records. Every one of those connection strings sits in the platform an unauthenticated attacker just took over.
That’s why a BI tool outranks a firewall on this month’s list. The blast radius isn’t Metabase. It’s every database Metabase can reach.
Affected versions: Metabase 0.58/1.58 through 0.63.4 and equivalent builds.
| Event | Date |
|---|---|
| Active exploitation confirmed by vendor | 2026-08 |
| CISA KEV added | 2026-08-11 |
| FCEB patch deadline | 2026-08-14 |
What to do:
- Upgrade Metabase past 0.63.4 immediately
- Pull it off the public internet. Metabase belongs behind a VPN or an SSO proxy, never on a public IP
- Rotate every database credential Metabase holds. Assume they’re already gone
- Audit query logs and admin account creation events for anything you didn’t do
Getting this call right is the difference between a Tuesday afternoon and a breach notification. If your team wants structured training on the reasoning behind these decisions, our Security Operations courses cover vulnerability triage and incident response with real threat-intelligence feeds.
CVE #2: CVE-2026-63077 – JetBrains TeamCity Deserialization RCE (CVSS 9.8)
Unauthenticated remote code execution on your build server. Sit with that one for a second.
What it is: Deserialization of untrusted data in TeamCity On-Premises. An unauthenticated attacker sends a crafted HTTP/S request and executes arbitrary code on the server.
Why this is worse than the score suggests: Your CI/CD server holds signing keys, deployment credentials, and cloud API tokens. Worse, it has legitimate write access to production. That access is the entire point of the tool.
An attacker who owns TeamCity doesn’t need to break into anything else. They don’t pivot, they don’t escalate, they don’t dodge your firewall rules. They just ask your pipeline to deploy their code, and your pipeline does it, because that’s its job.
That’s a supply chain compromise wearing a server compromise as a disguise.
| Event | Date |
|---|---|
| JetBrains advisory published | 2026-07 |
| Exploitation observed in the wild | 2026-08 |
| CISA KEV added | 2026-08-05 |
| FCEB patch deadline | 2026-08-08 |
Roughly a week from public disclosure to confirmed exploitation. That’s the window you’re working with now, and it keeps shrinking.
What to do:
- Update TeamCity On-Premises to 2025.11.7 or 2026.1.3 per the JetBrains advisory
- TeamCity should never be internet-facing. Put it behind a VPN
- Rotate all deployment credentials, signing keys, and cloud tokens stored in TeamCity
- Review build history for pipeline changes nobody on your team made, and for build agents you don’t recognise
CVE #3: CVE-2026-8037 – Progress Kemp LoadMaster Pre-Auth Command Injection (CVSS 9.6, EPSS 99%)
This is the one to patch first, and its CVSS score won’t tell you that.
Telemetry recorded 792 exploitation attempts over 41 days, from 65 unique IP addresses across 18 countries. Exploitation began on 2026-06-29. CISA didn’t add it to KEV until 2026-08-07.
Read those two dates again. Attackers had a six-week head start on the official warning.
What it is: Multiple LoadMaster API endpoints process unsanitised attacker-controlled input. The vulnerable code allocates a heap buffer with malloc() and fails to properly null-terminate escaped strings, allowing out-of-bounds reads into adjacent heap memory. An attacker manipulates that memory to inject shell commands, which the appliance runs via system(). No credentials needed at any point.
Why network engineers should care most about this one: A load balancer sits in front of your application traffic and terminates TLS. Root on that box means reading plaintext for every service behind it, plus a trusted pivot into your DMZ that your firewall rules already permit. You built those rules to trust this device.
| Event | Date |
|---|---|
| Exploitation activity began | 2026-06-29 |
| CISA KEV added | 2026-08-07 |
| FCEB patch deadline | 2026-08-10 |
What to do:
- Patch LoadMaster to the fixed release from Progress immediately
- Restrict the management API to management network segments. It should never be internet-reachable
- Audit API access logs from 2026-06-29 forward, not from the KEV date. Starting at the listing misses six weeks of attacks
- Rotate any credentials stored on or reachable from the appliance
CVE #4: CVE-2026-18556 and CVE-2026-18577 – N-able N-central Authentication Bypass (CVSS 7.4 and 8.1)
Two CVEs, one root cause. The first patch didn’t work, and attackers noticed before most customers did.
What it is: An authentication bypass in N-able N-central, the RMM platform MSPs use to manage client endpoint fleets. CVE-2026-18556 came first. Its fix didn’t fully resolve the underlying authentication logic, leaving a residual bypass tracked as CVE-2026-18577. Both give an unauthenticated attacker administrative access to the N-central server.
What attackers actually did with it: After getting in, they used N-central’s built-in Take Control feature to reach managed endpoints, then deployed Cloudflare Tunnel (cloudflared) for persistent remote access.
No malware. No custom tooling. They used the legitimate remote-access features the platform ships with, which is exactly why this is hard to spot. Your monitoring sees an admin using Take Control. That’s Tuesday.
Why this is the scariest entry on the list: N-central is a one-to-many compromise. An MSP running it manages endpoints across dozens of client organisations. One bypassed login reaches all of them, and the traffic looks like normal management activity because it is normal management activity, just performed by the wrong person.
| Event | Date |
|---|---|
| N-able advisory for CVE-2026-18556 | 2026-08-01 |
| Exploitation of CVE-2026-18577 observed | 2026-08-01 |
| Hotfix released (build 2026.3.1.7) | 2026-08-02 |
| CISA KEV added (CVE-2026-18577) | 2026-08-03 |
| CISA KEV added (CVE-2026-18556) | 2026-08-04 |
Advisory, exploitation, incomplete fix, second CVE, and two KEV listings inside four days.
What to do:
- Update to N-central 2026.3 Hotfix 1 (build 2026.3.1.7) or later. The earlier fix is not sufficient
- Hunt for
cloudflaredprocesses on the N-central server and on managed endpoints. That’s the documented persistence mechanism - Review Take Control session logs for sessions your technicians didn’t start
- Rotate all N-central administrative credentials and API tokens
- If you’re an MSP, notify affected clients. This reaches their endpoints, not just your server
CVE #5: CVE-2026-20349 – Cisco ASA and FTD Remote DoS (CVSS 8.6)
An unauthenticated attacker can reload your firewall. Repeatedly, if they feel like it.
What it is: A heap inspection flaw (CWE-244, improper clearing of heap memory before release) in the Remote Access SSL VPN service of Cisco Secure Firewall ASA and FTD software. Insufficient error checking while processing HTTP requests means a malformed request triggers an unexpected device reload.
What an attacker gets: Denial of service, not code execution. Be clear about that. But the device in question is both your perimeter firewall and your remote access VPN concentrator, and exploitation needs no credentials and no administrator interaction.
Lose that box and your remote workforce can’t connect while your perimeter enforcement drops. An outage and a security gap, arriving together, on the device you’d normally use to investigate both.
| Event | Date |
|---|---|
| Exploited in the wild | 2026-08 |
| CISA KEV added | 2026-08-11 |
| FCEB patch deadline | 2026-08-14 |
What to do:
- Patch FTD to 7.0.9.1-1, 7.2.11.1-2, 7.4.7.1-1, 7.6.4.1-2, 7.7.11.1-2, or 10.0.0.1-2
- Patch ASA to 9.18.4.50, 9.20.4.235, 9.22.3.191, 9.23.1.211, or 9.24.1.221 depending on your train
- Confirm the exact fixed release for your platform on the Cisco security advisory portal
- If you can’t patch immediately, restrict Remote Access SSL VPN to known source ranges where your deployment allows it
- Review device logs for unexplained reloads going back through July
Not sure which services your FTD deployment actually exposes? Our complete guide to Cisco Firepower Threat Defence walks through the platform architecture and where the remote access VPN service fits.
August 2026 CISA KEV: Patch Priority at a Glance
Here’s every August addition. Sorted by EPSS, not CVSS, because that ordering reflects what’s actually likely to hit you in the next 30 days.
| CVE | Product | CVSS | EPSS | Percentile | KEV Added | Deadline |
|---|---|---|---|---|---|---|
| CVE-2026-8037 | Progress Kemp LoadMaster | 9.6 | 99.31% | 99.9 | 2026-08-07 | 2026-08-10 |
| CVE-2026-34486 | Apache Tomcat | – | 82.93% | 99.6 | 2026-08-04 | 2026-08-07 |
| CVE-2026-9198 | IBM Langflow | – | 17.35% | 96.8 | 2026-08-04 | 2026-08-07 |
| CVE-2026-63077 | JetBrains TeamCity | 9.8 | 10.72% | 95.4 | 2026-08-05 | 2026-08-08 |
| CVE-2026-72898 | Metabase | 10.0 | 10.40% | 95.3 | 2026-08-11 | 2026-08-14 |
| CVE-2026-18577 | N-able N-central | 8.1 | 4.10% | 89.9 | 2026-08-03 | 2026-08-06 |
| CVE-2026-20349 | Cisco ASA / FTD | 8.6 | 0.87% | 55.9 | 2026-08-11 | 2026-08-14 |
| CVE-2026-18556 | N-able N-central | 7.4 | 0.49% | 40.1 | 2026-08-04 | 2026-08-07 |
| CVE-2026-68820 | Windows WinSock (AFD) | 7.0 | 0.33% | 26.1 | 2026-08-11 | 2026-08-25 |
EPSS scores from FIRST.org, dated 2026-08-16.
Look at the top and bottom of that table. The highest CVSS score in the group, Metabase at 10.0, sits fifth by exploitation probability. The one at the top scored 9.6.
Why CVSS Alone Would Have Ranked These Wrong
Three different numbers get called “the score,” and they answer three different questions.
| Signal | Question it answers | What it can’t tell you |
|---|---|---|
| CVSS | How bad is this if someone exploits it? | Whether anyone will |
| EPSS | How likely is exploitation in the next 30 days? | Whether it’s happening to you now |
| CISA KEV | Is this confirmed exploited right now? | How severe the damage would be |
CVSS is a severity rating. It describes the worst case, assuming exploitation happens. It says nothing about probability, which is the part you need when you can only patch three things this week.
August gave us two clean demonstrations.
The LoadMaster case. CVE-2026-8037 scored 9.6, below Metabase’s 10.0. Sort by CVSS and it’s second. But its EPSS is 99.31% against Metabase’s 10.40%. Near-certain exploitation versus roughly one in ten. Both belong on the list, but only one of them was already logging 792 attempts before CISA published the warning.
The Microsoft case. CVE-2026-68820 is a use-after-free elevation of privilege in the Windows Ancillary Function Driver for WinSock, CVSS 7.0, rated only “important.” Check Point researchers reported it exploited by North Korean actors deploying a kernel-mode rootkit in a new wave of the Operation Dream Job campaign.
Microsoft published 421 CVEs that month. Forty-two were rated critical. The single one with confirmed exploitation scored 7.0 and wasn’t one of them.
The practical rule: patch KEV entries first, order what’s left by EPSS, and use CVSS to decide how much damage control to plan. Severity tells you how hard you’d fall. Probability tells you how close you are to the edge.
That reordering is most of the job, and it takes about ten minutes a month once the feeds are wired up.
Four Patterns from August 2026’s KEV Additions
Management platforms are the target, not endpoints. Metabase, TeamCity, N-central, LoadMaster. Four of the five are tools that manage other things. Attackers stopped going after endpoints one at a time. They go after the console that already holds trusted access to all of them, because you built that trust yourself and your monitoring treats it as normal.
CVSS did not predict what mattered. Covered above, and it’s the reason the priority table in this article is sorted by EPSS. We flagged the same gap in April’s KEV roundup, where three medium-severity Cisco SD-WAN CVEs chained into full administrative control. Two months, same lesson: severity scores describe damage, not likelihood.
Incomplete patches are their own vulnerability. CVE-2026-18577 exists only because the fix for CVE-2026-18556 didn’t fully close the hole. Applying a vendor patch isn’t the end of the job. Verify the fix addressed the root cause, and watch for follow-up advisories on anything you just patched, especially when the first advisory shipped fast.
Exploitation predates the KEV listing, often by weeks. LoadMaster exploitation started 2026-06-29 and the KEV entry landed 2026-08-07. Six weeks of attacks before the official listing. When you audit logs after a KEV entry, don’t start from the KEV date. Go back at least 30 to 60 days, or you’ll declare yourself clean while looking at the wrong window.
How to Build a CISA KEV Response Workflow
Network engineers can’t manually monitor every CVE feed. Here’s a workflow that runs itself.
Step 1: Ingest the KEV feed, and the EPSS feed alongside it. CISA publishes a machine-readable JSON feed at cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json. FIRST.org publishes EPSS scores through a public API. Splunk, Microsoft Sentinel, and Wazuh all have KEV integrations. Pull both, because KEV tells you what’s confirmed and EPSS tells you what’s coming.
Step 2: Map every KEV entry to your asset inventory automatically. If a new KEV entry hits and you have to manually check whether you run the affected software, you’re already behind. Your CMDB should answer that question without a human.
Step 3: Use CISA’s deadline, not a fixed internal SLA. Seven of August’s nine entries carried a 3-day deadline. A blanket “14-day policy” would have missed all seven. CISA compresses the window for a reason. Inherit their number rather than picking your own.
Step 4: Treat every KEV patch as a change ticket with an owner. No KEV entry should sit in a backlog without an assigned name and a due date.
Step 5: Report KEV patch coverage in security reviews. KEV remediation rate is an externally validated metric. It means something to executives and auditors in a way that raw vulnerability counts never will.
Patch coverage is one input into a wider picture. Our guide on what a security posture assessment involves covers how KEV remediation sits alongside asset inventory, configuration review, and control testing.
For structured lab exercises covering Cisco and Fortinet security configuration, the SMEnode Labs certification workbooks pair well with classroom training.
Frequently Asked Questions
How many CVEs did CISA add to KEV in August 2026?
CISA added 9 vulnerabilities to the Known Exploited Vulnerabilities catalog in August 2026: CVE-2026-18577 and CVE-2026-18556 (N-able N-central), CVE-2026-34486 (Apache Tomcat), CVE-2026-9198 (IBM Langflow), CVE-2026-63077 (JetBrains TeamCity), CVE-2026-8037 (Progress LoadMaster), CVE-2026-20349 (Cisco ASA/FTD), CVE-2026-68820 (Microsoft Windows WinSock), and CVE-2026-72898 (Metabase). The catalog reached 1,665 total entries with the 2026-08-14 release.
What was the highest CVSS score in August 2026’s CISA KEV additions?
CVE-2026-72898 in Metabase received a perfect CVSS 10.0. It’s an unauthenticated SQL injection that gives a remote attacker administrator access to the Metabase instance with no credentials, and it was exploited as a zero-day before public disclosure.
Which August 2026 CVE had the highest exploitation probability?
CVE-2026-8037 in Progress Kemp LoadMaster, with an EPSS score of 99.31%, placing it in the 99.9th percentile. EPSS estimates the probability that a vulnerability will be exploited within the next 30 days, so 99.31% means exploitation is close to certain. Telemetry recorded 792 exploitation attempts over 41 days from 65 IP addresses in 18 countries.
What’s the difference between CVSS, EPSS, and CISA KEV?
CVSS rates how severe the damage would be if a vulnerability is exploited. EPSS estimates how likely exploitation is in the next 30 days. CISA KEV confirms that exploitation is already happening in the wild. Use them in that reverse order when prioritising: patch KEV entries first, sort the remainder by EPSS, and use CVSS to plan how much damage control each one needs.
Which August 2026 zero-day was actually exploited in Microsoft’s Patch Tuesday?
CVE-2026-68820, a use-after-free elevation of privilege flaw in the Windows Ancillary Function Driver for WinSock, CVSS 7.0. Check Point researchers reported it was exploited by North Korean attackers to deploy a kernel-mode rootkit as part of a new wave of the Operation Dream Job campaign. Microsoft published 421 CVEs that month and this was the only one with confirmed exploitation, despite 42 vulnerabilities carrying a higher “critical” rating.
Why did N-able N-central get two separate CVEs in the same week?
The original fix for CVE-2026-18556 did not fully resolve the underlying authentication logic issue, leaving a residual authentication bypass that attackers could still use. That residual bypass was assigned CVE-2026-18577. N-able released N-central 2026.3 Hotfix 1 (build 2026.3.1.7) on 2026-08-02 to address it. If you applied only the first fix, you’re still exposed.
Does CISA KEV apply to private companies?
CISA KEV’s formal requirements apply only to U.S. Federal Civilian Executive Branch agencies under BOD 22-01. Private sector organisations aren’t legally required to follow KEV deadlines. That said, a KEV listing means real attackers are targeting real organisations with this vulnerability right now. The most defensible private-sector position is to treat KEV deadlines as the benchmark for your highest-priority patch queue.
How far back should I check logs after a CVE hits the KEV catalog?
At least 30 to 60 days before the KEV listing date. August 2026 shows why. Progress LoadMaster exploitation began on 2026-06-29 but the KEV entry didn’t appear until 2026-08-07, a six-week gap. Auditing only from the KEV date forward would miss the entire attack window and produce a false all-clear.
What to Do This Week
When a CVE enters the CISA KEV catalog, the question isn’t “should we patch this?” It’s “why haven’t we patched this already?”
Check your status against these five, in this order:
- CVE-2026-8037 – Progress Kemp LoadMaster: patch now, audit logs from 2026-06-29 (EPSS 99%)
- CVE-2026-63077 – JetBrains TeamCity: update to 2025.11.7 or 2026.1.3, rotate deployment credentials
- CVE-2026-72898 – Metabase: upgrade past 0.63.4, rotate every database credential it holds
- CVE-2026-18556 / 18577 – N-able N-central: apply Hotfix 1 build 2026.3.1.7, hunt for
cloudflared - CVE-2026-20349 – Cisco ASA / FTD: patch to the fixed train for your platform
If any of these are unpatched, that’s your priority today. If you’re not sure, that’s your priority in the next hour.
The teams that handle months like August well aren’t the ones with more staff. They’re the ones who wired up the feeds, agreed the priority order in advance, and stopped re-litigating it every Patch Tuesday.
Just starting out in security and wondering where the certification ladder begins? Our breakdown of the Security+ passing score covers the entry point most engineers take first.
Build the judgement to make these calls under pressure. Our CCIE Security programme is taught live by instructors who’ve run this infrastructure in production, not pre-recorded slide decks. Every class has its own group with the instructor in it, so when you’re stuck on a triage decision at 2am, there’s a real person to ask.
