VulnerabilityhighExploited in the wild

August 2026 CVE Landscape

Recorded Futureby Insikt Group®Sep 8, 2026 · 00:00 UTC (Sep 8, 2026)7 min read4 · 2 reads

AI summary · glm-5.3-flashSummaries by Vani AI

Insikt Group catalogs 73 high-impact August 2026 CVEs (43 Very Critical), including PaperCut, Zimbra, and Metabase flaws actively exploited or weaponized.

Recorded Future's Insikt Group identified 73 high-impact vulnerabilities in August 2026, 43 rated Very Critical, spanning 45 vendors with Microsoft accounting for roughly 11%. 31 vulnerabilities surfaced via CISA's KEV catalog, with others validated via open sources, vendor telemetry, and honeypot data. New Nuclei detection templates were released for CVE-2025-62593 (Ray), CVE-2026-72898 (Metabase), and CVE-2026-9198 (IBM Langflow). The report also highlights two AI-assisted operations: UAT-10147 exploited Zimbra, AjaxPro, Nacos, and Telerik servers before using DeepAudit and PentestGPT post-compromise, while a separate Chinese-speaking actor weaponized Hermes Agent and DeepSeek in a failed attempt.

Key facts

73 high-impact CVEs identified, 43 rated Very Critical, down 14% from July
31 vulnerabilities added to CISA KEV catalog; Microsoft accounted for ~11% of all CVEs
Nuclei templates published for Ray (CVE-2025-62593), Metabase (CVE-2026-72898), IBM Langflow (CVE-2026-9198)
UAT-10147 used AI tooling (DeepAudit, PentestGPT) post-compromise against Zimbra and other servers
Prior PaperCut CVEs CVE-2026-81578 and CVE-2026-82078 tied to AI-orchestrated campaign

Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

CVEs: CVE-2025-62593 CVE-2026-72898 CVE-2026-9198 CVE-2026-81578 CVE-2026-82078 CVE-2026-3395 CVE-2026-59800

Tags: ai-assisted-offense cisa insikt-group kev monthly-report nuclei vulnerability-management

Vendors: Microsoft PaperCut Zimbra Metabase Ray IBM Langflow IBM Recorded Future CISA Red Hat
Products: Microsoft Windows PaperCut NG/MF Zimbra Metabase Ray IBM Langflow Microsoft SQL Server Ajax.NET Professional Red Hat Libuser sudo
Threat actors: UAT-10147
Organizations: Recorded Future Insikt Group CISA U.S. Cybersecurity and Infrastructure Security Agency
AI models: DeepSeek Hermes Agent DeepAudit PentestGPT

Vulnerabilities mentioned

All

CVE	Vulnerability	CVSS	EPSS	Signals	Published
CVE-2025-62593	Actively Exploited Browser-Based RCE in Ray AI Compute Engine	9.4	60%	KEVPoC	Nov 26, 2025 KEV Aug 17, 2026
CVE-2026-3395	A flaw has been found in MaxSite CMS up to 109.1	5.5	4%		Mar 1, 2026
CVE-2026-59800	9Router before 0.4.44 contains an OS command injection vulnerability in the unauthenticated POST /api/tunnel/tailscale-install endpoint (this route is not…	9.2	2%		Jul 7, 2026
CVE-2026-72898	Unauthenticated SQL Injection in Metabase Grants Admin Access	10.0	99%	KEVPoC ×3	Aug 10, 2026 KEV Aug 11, 2026
CVE-2026-82078 +1 related CVE CVE-2026-81578	Unsafe Reflection RCE in PaperCut NG/MF, Chained with Auth Bypass in Attacks	9.4 group max	61%	KEV	Aug 28, 2026 KEV Aug 31, 2026
CVE-2026-9198	Unauthenticated RCE Chain in IBM Langflow OSS 1.0.0-1.10.0	9.8	29%	KEVPoC	Jul 17, 2026 KEV Aug 4, 2026

From the original article

7 min read at recordedfuture.com

In August 2026, Insikt Group® identified 73 high-impact vulnerabilities that should be prioritized for remediation, 43 of which had a Very Critical Recorded Future Risk Score. This represents a 14% decrease from last month.

Recorded Future

By Insikt Group® · recordedfuture.com

Read the full article at Recorded Future

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.