Skip to content
eastbaycyber
CISA KEV additions

CISA Adds 4 Known Exploited Vulnerabilities to Catalog (August 18, 2026)

Source: CISA KEV Catalog · Updated 2026-09-25

Summary

On August 18, 2026, CISA added 4 vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog: CVE-2026-33824, CVE-2026-59310, CVE-2026-55040, CVE-2026-65400. A KEV listing means CISA has evidence of active exploitation. CISA sets a remediation due date for US federal civilian agencies under its binding operational directives; any organization running the affected products should treat these as patch-now priorities.

CVE-2026-33824: Microsoft Internet Key Exchange (IKE) Service Extensions Double Free Vulnerability

Microsoft · Internet Key Exchange (IKE) Service Extensions

Microsoft Internet Key Exchange (IKE) Service Extensions contains a double free vulnerability that could enable remote code execution.

Federal due date
2026-08-21
Ransomware use
Unknown
Added
2026-08-18

Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

NVD record · Microsoft KEV history

CVE-2026-59310: Broadcom VMware vCenter Path Traversal Vulnerability

Broadcom · VMware vCenter

Broadcom VMware vCenter contains a path traversal vulnerability which could allow a threat actor with network access to vCenter to execute arbitrary code.

Federal due date
2026-08-21
Ransomware use
Known
Added
2026-08-18

Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

NVD record

CVE-2026-55040: Microsoft SharePoint Weak Authentication Vulnerability

Microsoft · SharePoint

Microsoft SharePoint contains a weak authentication vulnerability which allows an unauthorized attacker to bypass a security feature over a network.

Federal due date
2026-08-21
Ransomware use
Unknown
Added
2026-08-18

Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

NVD record · Microsoft KEV history

CVE-2026-65400: Apple macOS Improper Authentication Vulnerability

Apple · macOS

Apple macOS contains an improper authentication vulnerability that could allow an attacker on the network to authenticate to Screen Sharing without valid credentials.

Federal due date
2026-08-21
Ransomware use
Unknown
Added
2026-08-18

Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

NVD record · Apple KEV history

Also added to KEV in August 2026

  • August 31, 2026: CVE-2026-82078, PaperCut NG/MF (PaperCut NG/MF Unsafe Reflection Vulnerability)
  • August 31, 2026: CVE-2026-81578, PaperCut NG/MF (PaperCut NG/MF Missing Authentication for Critical Function Vulnerability)
  • August 27, 2026: CVE-2026-66384, JFrog Artifactory (JFrog Artifactory Improper Limitation of a Pathname to a Restricted Directory Vu)
  • August 27, 2026: CVE-2026-53362, Linux Kernel (Linux Kernel Unspecified Vulnerability)
  • August 27, 2026: CVE-2023-49105, ownCloud ownCloud (ownCloud Improper Authentication Vulnerability)
  • August 26, 2026: CVE-2026-8452, Citrix NetScaler ADC and NetScaler Gateway (Citrix NetScaler ADC and NetScaler Gateway Improper Restriction of Operations wi)
  • August 26, 2026: CVE-2022-0995, Linux Kernel (Linux Kernel Out-of-Bounds Write Vulnerability)
  • August 26, 2026: CVE-2021-23758, Ajax.NET Professional Ajax.NET Professional (Ajax.NET Professional Deserialization of Untrusted Data Vulnerability)
  • August 26, 2026: CVE-2019-1068, Microsoft SQL Server (Microsoft SQL Server Remote Code Execution Vulnerability)
  • August 26, 2026: CVE-2015-5287, Red Hat Automatic Bug Reporting Tool (Red Hat Automatic Bug Reporting Tool Privilege Escalation Vulnerability)
  • August 26, 2026: CVE-2015-3246, Red Hat Libuser (Red Hat Libuser Race Condition Vulnerability)
  • August 25, 2026: CVE-2026-60004, Gitea Gitea (Gitea Code Injection Vulnerability)
  • August 24, 2026: CVE-2026-21962, Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in (Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in Improper Access Cont)
  • August 21, 2026: CVE-2026-73570, Synacor Zimbra Collaboration Suite (ZCS) (Zimbra Collaboration Suite (ZCS) OS Command Injection Vulnerability)
  • August 20, 2026: CVE-2026-72530, TrueConf Server (TrueConf Server Code Injection Vulnerability)
  • August 20, 2026: CVE-2026-72529, TrueConf Server (TrueConf Server Missing Authentication for Critical Function Vulnerability)
  • August 19, 2026: CVE-2026-64849, MLflow MLflow (MLflow Server-Side Request Forgery Vulnerability)
  • August 17, 2026: CVE-2025-62593, Ray-Project Ray (Ray-Project Ray Code Injection Vulnerability)
  • August 11, 2026: CVE-2026-72898, Metabase Metabase (Metabase SQL Injection Vulnerability)
  • August 11, 2026: CVE-2026-68820, Microsoft Windows Ancillary Function Driver for WinSock (Microsoft Windows Ancillary Function Driver for WinSock Use-After-Free Vulnerabi)
  • August 11, 2026: CVE-2026-20349, Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) (Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Thre)
  • August 7, 2026: CVE-2026-8037, Progress LoadMaster (Progress LoadMaster Command Injection Vulnerability)
  • August 5, 2026: CVE-2026-63077, JetBrains TeamCity (JetBrains TeamCity Deserialization of Untrusted Data Vulnerability)
  • August 4, 2026: CVE-2026-9198, IBM Langflow (IBM Langflow Code Injection Vulnerability)
  • August 4, 2026: CVE-2026-34486, Apache Tomcat (Apache Tomcat Missing Encryption of Sensitive Data Vulnerability)

Check whether you run these products: our vulnerability scanner comparison covers tools that detect KEV-listed flaws. See also the KEV dashboard and KEV history by vendor.