Zero-day report: August 2026
CISA added 31 exploited vulnerabilities to its catalog in August 2026, 5 more than July (26). 11 were zero-days, listed within a week of going public. 2 are known to be used by ransomware. The most-hit vendor was Microsoft, with 4.
By technology
Most-hit vendors
Every flaw added in August 2026
- PaperCut · NG/MFPaperCut NG/MF Missing Authentication for Critical Function Vulnerability
- PaperCut · NG/MFPaperCut NG/MF Unsafe Reflection Vulnerability
- ownCloud · ownCloudownCloud Improper Authentication Vulnerability
- Linux · KernelLinux Kernel Unspecified Vulnerability
- JFrog · ArtifactoryJFrog Artifactory Improper Limitation of a Pathname to a Restricted Directory Vulnerability
- Red Hat · LibuserRed Hat Libuser Race Condition Vulnerability
- Red Hat · Automatic Bug Reporting ToolRed Hat Automatic Bug Reporting Tool Privilege Escalation Vulnerability
- Microsoft · SQL ServerMicrosoft SQL Server Remote Code Execution Vulnerability
- Ajax.NET Professional · Ajax.NET ProfessionalAjax.NET Professional Deserialization of Untrusted Data Vulnerability
- Linux · KernelLinux Kernel Out-of-Bounds Write Vulnerability
- Citrix · NetScaler ADC and NetScaler GatewayCitrix NetScaler ADC and NetScaler Gateway Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability
- Gitea · GiteaGitea Code Injection Vulnerability
- Oracle · HTTP Server and Oracle Weblogic Server Proxy Plug-inOracle HTTP Server and Oracle Weblogic Server Proxy Plug-in Improper Access Control Vulnerability
- Synacor · Zimbra Collaboration Suite (ZCS)Zimbra Collaboration Suite (ZCS) OS Command Injection Vulnerability
- TrueConf · ServerTrueConf Server Missing Authentication for Critical Function Vulnerability
- TrueConf · ServerTrueConf Server Code Injection Vulnerability
- MLflow · MLflowMLflow Server-Side Request Forgery Vulnerability
- Microsoft · Internet Key Exchange (IKE) Service ExtensionsMicrosoft Internet Key Exchange (IKE) Service Extensions Double Free Vulnerability
- Microsoft · SharePointMicrosoft SharePoint Weak Authentication Vulnerability
- VMware · VMware vCenterBroadcom VMware vCenter Path Traversal Vulnerability
- Apple · macOSApple macOS Improper Authentication Vulnerability
- Ray-Project · RayRay-Project Ray Code Injection Vulnerability
- Cisco · Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) Heap Inspection Vulnerability
- Microsoft · Windows Ancillary Function Driver for WinSock Microsoft Windows Ancillary Function Driver for WinSock Use-After-Free Vulnerability
- Metabase · MetabaseMetabase SQL Injection Vulnerability
- Progress · LoadMasterProgress LoadMaster Command Injection Vulnerability
- JetBrains · TeamCityJetBrains TeamCity Deserialization of Untrusted Data Vulnerability
- N-able · N-centralN-able N-central Authentication Bypass Using an Alternate Path or Channel Vulnerability
- Apache · TomcatApache Tomcat Missing Encryption of Sensitive Data Vulnerability
- IBM · LangflowIBM Langflow Code Injection Vulnerability
- N-able · N-centralN-able N-central Authentication Bypass Using an Alternate Path or Channel Vulnerability
Source: CISA's Known Exploited Vulnerabilities catalog, by the date CISA added each flaw. Ransomware use is CISA's flag.