60
60
60
60
60
60
60
60
60
60
August 2026 CVE Landscape
Insikt Group catalogs 73 high-impact August 2026 CVEs (43 Very Critical), including PaperCut, Zimbra, and Metabase flaws actively exploited or weaponized.
Recorded Future's Insikt Group identified 73 high-impact vulnerabilities in August 2026, 43 rated Very Critical, spanning 45 vendors with Microsoft accounting for roughly 11%. 31 vulnerabilities surfaced via CISA's KEV catalog, with others validated via open sources, vendor telemetry, and honeypot data. New Nuclei detection templates were released for CVE-2025-62593 (Ray), CVE-2026-72898 (Metabase), and CVE-2026-9198 (IBM Langflow). The report also highlights two AI-assisted operations: UAT-10147 exploited Zimbra, AjaxPro, Nacos, and Telerik servers before using DeepAudit and PentestGPT post-compromise, while a separate Chinese-speaking actor weaponized Hermes Agent and DeepSeek in a failed attempt.
68
PaperCut Flaws Exploited in Attacks on U.S. and European Schools
Attackers are chaining recently disclosed PaperCut flaws CVE-2026-81578 and CVE-2026-82078 to steal credentials and create privileged accounts at US and European schools.
Arctic Wolf researchers observed threat actors exploiting PaperCut servers via CVE-2026-81578 and CVE-2026-82078, chaining an authentication bypass with remote code execution. Post-exploitation included creating a privileged account named Administrator17, downloading credential-harvesting tools with certutil, Meterpreter Java payloads, and registry hive collection to recover the Windows BootKey and reach the SAM database. PaperCut disclosed active exploitation on August 27, 2026, and CISA added both flaws to its Known Exploited Vulnerabilities catalog on August 31. PaperCut has a history of exploitation, including attacks that delivered LockBit ransomware.
75
Attackers Exploit PaperCut Flaws to Steal Credentials From Schools and Universities
Attackers exploit newly disclosed PaperCut auth bypass CVE-2026-81578 and RCE CVE-2026-82078 to steal credentials from schools and universities in the US and Europe.
Arctic Wolf observed threat actors chaining CVE-2026-81578 (authentication bypass) and CVE-2026-82078 (remote code execution) in PaperCut to execute commands, perform reconnaissance, and create privileged accounts on servers at K-12 schools and universities in the US and Europe. Post-exploitation includes registry hive collection with lsa_collect.exe delivered via certutil, Meterpreter Java payloads from 194.180.48.134, and searches of PaperCut config files for passwords, LDAP bindings, and tokens. Stolen logins could provide a pathway into other critical systems across compromised environments.
74
Unit 42 Researchers Discover Multiple Espionage Operations Targeting Southeast Asian Government
Unit 42 attributes three espionage clusters targeting a Southeast Asian government to Stately Taurus, Alloy Taurus, and Gelsemium APTs.
Unit 42 investigated espionage attacks starting in late 2022 against multiple governmental entities in a Southeast Asian country, including critical infrastructure, public healthcare, financial administrators, and ministries. Analysis revealed three distinct clusters: CL-STA-0044 attributed to Stately Taurus (Mustang Panda), CL-STA-0045 to Alloy Taurus (GALLIUM), and CL-STA-0046 to Gelsemium. The first cluster used a ToneShell backdoor variant, ShadowPad, China Chopper web shells, Impacket, and credential dumping tools across roughly Q1 2021 to Q3 2023. All three operated with distinct tools, infrastructure, and long-term surveillance tradecraft consistent with APTs.
70
60
60
Russian Cyber Threat Actor Uses GenAI to Compromise Fortinet Firewalls
60
60
60
60
60
60
XE Hacker Group Exploits VeraCore Zero
60
60
60
60
60
60
60
60
60
60
60
60
60
60
60
60
60
Metasploit 6.2.0 comes with 138 new modules, 148 enhancements and features
60