August 2026 Vulnerability Insights and Key Exploitation Trends
August 2026 marked a significant moment in vulnerability management, as Insikt Group® identified 73 critical vulnerabilities earmarked for urgent remediation. Of these, 43 received a Very Critical Recorded Future Risk Score, reflecting a 14% reduction from the previous month. These vulnerabilities mainly stemmed from the US Cybersecurity and Infrastructure Security Agency’s (CISA) Known Exploited Vulnerabilities catalog, open-source validations by Insikt, vendor telemetry, and some sourced through honeypot data.
The vulnerabilities impacted products across 45 different vendors, with Microsoft accounting for approximately 11% of the total. This widespread exposure includes various domains such as remote management, virtualization, application delivery, collaboration, artificial intelligence, analytics, and endpoint technologies.
Detection Templates and Key CVEs
In addressing the August vulnerabilities, Insikt Group developed Nuclei templates for detecting three specific CVEs: CVE-2025-62593 (Ray), CVE-2026-72898 (Metabase), and CVE-2026-9198 (IBM Langflow). Prior templates were also created for CVE-2026-3395 (MaxSite CMS) and CVE-2026-59800 (decolua 9Router), although the latter were exploited before August's reporting period. A noteworthy mention is the creation of a template addressing a GitHub issue affecting Apache Log4j, which was classified by Apache as a hardening gap rather than a CVE. Access to these templates is provided to clients through the Recorded Future Intelligence Platform.
Vulnerability Overview for August 2026
Below is a comprehensive table detailing the 70 vulnerabilities that were actively exploited or operationally weaponized during August 2026. Please note the exclusion of the three CVEs identified primarily via honeypot sources.
Score
Table 1: List of actively exploited vulnerabilities in August 2026, drawn from Recorded Future data, excluding honeypot-sourced CVEs.
Emerging Exploitation Trends
- This month clearly illustrated two AI-driven operations in cybersecurity. The group UAT-10147 exploited vulnerabilities in Zimbra, AjaxPro, Nacos, and Telerik servers, employing the use of tools like DeepAudit and PentestGPT in post-compromise situations. Separately, another Chinese-speaking actor attempted to utilize Hermes Agent and DeepSeek against Langflow and n8n, although those efforts were unsuccessful.
- Of the 73 vulnerabilities, 34 enabled remote code execution (RCE), with implications affecting various segments of Microsoft’s ecosystem, database servers, application delivery systems, and collaboration tools.
- Insikt identified public proof-of-concept (PoC) exploits for 53 vulnerabilities, underscoring the importance of continuous monitoring.
- The most prevalent weaknesses identified were in the classes of CWE-94 (Code Injection) and CWE-502 (Deserialization of Untrusted Data), with seven instances each, followed closely by CWE-287 (Improper Authentication) and CWE-306 (Missing Authentication for Critical Function), which appeared six times each.
- Aseveral vulnerabilities detected were found to be well over five years old, with the oldest exceeding 16 years in age.
Exploitation Methodologies: A Deep Dive
Insikt Group provided insights into how the threat actor UAT-10147 adeptly melded traditional exploitation techniques with AI tools during their operations. This group targeted various internet-facing Windows and Linux web servers and effectively weaponized multiple vulnerabilities at their disposal for both initial access and local privilege escalation post-compromise. For instance, notable exploits involved CVE-2019-18935 in Telerik UI for ASP.NET AJAX and CVE-2022-27925 in Zimbra amongst others, showcasing a strategic combination of aids in the cyber warfare arena.
