55
42
42
60
42
42
55
30
55
30
August 2026 CVE Landscape
Insikt Group catalogs 73 high-impact August 2026 CVEs (43 Very Critical), including PaperCut, Zimbra, and Metabase flaws actively exploited or weaponized.
Recorded Future's Insikt Group identified 73 high-impact vulnerabilities in August 2026, 43 rated Very Critical, spanning 45 vendors with Microsoft accounting for roughly 11%. 31 vulnerabilities surfaced via CISA's KEV catalog, with others validated via open sources, vendor telemetry, and honeypot data. New Nuclei detection templates were released for CVE-2025-62593 (Ray), CVE-2026-72898 (Metabase), and CVE-2026-9198 (IBM Langflow). The report also highlights two AI-assisted operations: UAT-10147 exploited Zimbra, AjaxPro, Nacos, and Telerik servers before using DeepAudit and PentestGPT post-compromise, while a separate Chinese-speaking actor weaponized Hermes Agent and DeepSeek in a failed attempt.
68
42
42
45
47
55
42
42
57
60
47
42
30
42
60
45
Veeam, Terraform MCP, Django Patch Critical Flaws, Led by CVSS 10.0 Cross
60
60
42
30
Chrome DevTools Technique Enables Authenticated Session Hijacking in Live Windows Browsers
SpecterOps released CDP-Enable-BOF, a Beacon Object File that enables Chrome DevTools Protocol in live Chrome or Edge processes on Windows for session hijacking.
SpecterOps released CDP-Enable-BOF, an x64 Beacon Object File that activates Chrome DevTools Protocol inside running chrome.exe or msedge.exe processes on Windows, exposing cookies, history, saved passwords, and authenticated sessions without administrator rights. It calls Chromium's StartRemoteDebuggingServer on the browser UI thread to stay reliable under CFG, TLS, and CET, and was tested on Chrome 147 and Edge 147. The technique builds on work by DeathFlamingo and Cedric Van Bockhaven; Google had hardened remote debugging in Chrome 136 after attackers used it to steal cookies post-App-Bound Encryption. Defenders can watch Sysmon Event IDs 8 and 10 for injection into browser processes.
45
30
New Chaos Variant Targets Misconfigured Cloud Deployments, Adds SOCKS Proxy
Darktrace says the Chaos botnet now targets misconfigured cloud deployments like Hadoop and added a SOCKS proxy for traffic relaying.
Darktrace identified a new 64-bit ELF variant of the Chaos botnet targeting misconfigured cloud deployments, expanding beyond the malware's traditional focus on routers and edge devices. Captured in a deliberately misconfigured Hadoop honeypot instance, the intrusion began with an HTTP request creating an application that ran embedded shell commands to fetch the Chaos agent binary from pan.tenire[.]com, set chmod 777 permissions, execute it, and delete the artifact to reduce forensic traces. The restructured variant adds a SOCKS proxy feature letting compromised systems ferry attacker traffic, while removing SSH-based spread and router-exploit functions, suggesting monetization beyond crypto mining and DDoS-for-hire. Possible Chinese origin is suggested by language artifacts and infrastructure; the delivery domain was previously used in Silver Fox's Operation Silk Lure phishing campaign delivering ValleyRAT.
40
47
35
42
35
57
30
42