Name: Prioritized vulnerability dataset – Week 4 of August 2026
Creator: defend.network
Published: 2026-08-24T07:00:00Z
License: https://creativecommons.org/licenses/by/4.0/

Analyst Guidance

This week saw three confirmed critical vulnerabilities with active exploitation: CVE-2023-49105 (ownCloud) was added to CISA's Known Exploited Vulnerabilities catalog after targeting a nuclear research facility; PaperCut NG/MF flaws are under active exploitation with bypass techniques discovered against initial patches; and. Organizations running ownCloud, PaperCut print management, and WordPress-dependent sites should prioritize patching immediately.

CVE Details & Remediation

How to read this report

Verified facts — NVD & CISA KEV Partially verified — awaiting NVD enrichment AI analysis — synthesis, verify before acting

Actionable · Verified facts

NVD-published · CISA KEV cross-checked

🛡️CVE-2026-21962 – Oracle HTTP Server And Oracle Weblogic Server Proxy Plug-In ✓ NVD

CVSS10 NVD 3.1

Triage statusActive Exploit

Exploitation In the wild In CISA KEV ● New this week ★ Added to KEV this week

EPSS42% · P99

ActionPatch immediately

AffectedTechnology Finance Government

Remediation Steps

Apply the vendor security update for Oracle HTTP Server And Oracle Weblogic Server Proxy Plug-In as a priority.
Restrict network exposure of the affected service to trusted sources until patched.
Review logs and detections for indicators of exploitation.
Confirm fixed versions against the official vendor advisory before deploying.

References:

🛡️CVE-2026-16812 – Arista VeloCloud Orchestrator ✓ NVD

CVSS10 NVD 3.1

Triage statusActive Exploit

Exploitation In the wild In CISA KEV ↻ Ongoing

EPSS2% · P73

ActionPatch immediately

AffectedTechnology

Remediation Steps

Apply the vendor security update for Arista VeloCloud Orchestrator On-Prem as a priority.
Restrict network exposure of the affected service to trusted sources until patched.
Review logs and detections for indicators of exploitation.
Confirm fixed versions against the official vendor advisory before deploying.

References:

🛡️CVE-2026-72898 – Metabase ✓ NVD

CVSS10 NVD 3.1

Triage statusActive Exploit

Exploitation In the wild In CISA KEV ↻ Ongoing

EPSS79% · P100

ActionPatch immediately

Remediation Steps

Apply the vendor security update for Metabase Metabase as a priority.
Restrict network exposure of the affected service to trusted sources until patched.
Review logs and detections for indicators of exploitation.
Confirm fixed versions against the official vendor advisory before deploying.

References:

🛡️CVE-2023-49105 – Owncloud Server ✓ NVD

CVSS9.8 NVD 3.1

Triage statusActive Exploit

Exploitation In the wild In CISA KEV ● New this week ★ Added to KEV this week

EPSS43% · P99

ActionPatch immediately

Remediation Steps

Apply ownCloud security patch for CVE-2023-49105
Review access logs for unauthorized file access or exfiltration
Audit user accounts for unauthorized privilege escalation
Restrict network access to ownCloud instances to trusted networks

References:

🛡️CVE-2021-23758 – Ajaxpro.2 Project Ajaxpro.2 (also: Michaelschwarz) ✓ NVD

CVSS9.8 NVD 3.1

Triage statusActive Exploit

Exploitation In the wild In CISA KEV ● New this week ★ Added to KEV this week

EPSS84% · P100

ActionPatch immediately

AffectedTechnology

Remediation Steps

Apply the vendor security update for Ajaxpro.2 Project Ajaxpro.2 as a priority.
Restrict network exposure of the affected service to trusted sources until patched.
Review logs and detections for indicators of exploitation.
Confirm fixed versions against the official vendor advisory before deploying.

References:

🛡️CVE-2026-72529 – TrueConf Server ✓ NVD

CVSS9.8 NVD 3.1

Triage statusActive Exploit

Exploitation In the wild In CISA KEV

EPSS2% · P73

ActionPatch immediately

Remediation Steps

Apply the vendor security patch
Review system logs for evidence of exploitation
Verify affected systems are fully patched
Monitor for suspicious activity post-remediation

References:

🛡️CVE-2026-33824 – Microsoft Internet Key Exchange (IKE) Service Extensions ✓ NVD

CVSS9.8 NVD 3.1

Triage statusActive Exploit

Exploitation In the wild In CISA KEV

EPSS73% · P99

ActionPatch immediately

Remediation Steps

Consult CISA Known Exploited Vulnerabilities Catalog for affected product details
Apply vendor patch when available
Verify patch deployment across affected systems

References:

🛡️CVE-2026-59310 – Broadcom VMware VCenter ✓ NVD

CVSS9.8 NVD 3.1

Triage statusActive Exploit

Exploitation In the wild In CISA KEV ↻ Ongoing

EPSS46% · P99

ActionPatch immediately

AffectedHealthcare Government

Remediation Steps

Apply the vendor security update for Vmware Vcenter Server as a priority.
Restrict network exposure of the affected service to trusted sources until patched.
Review logs and detections for indicators of exploitation.
Confirm fixed versions against the official vendor advisory before deploying.

References:

🛡️CVE-2026-65400 – Apple MacOS ✓ NVD

CVSS9.8 NVD 3.1

Triage statusActive Exploit

Exploitation In the wild In CISA KEV ↻ Ongoing

EPSS10% · P95

ActionPatch immediately

AffectedHealthcare Government

Remediation Steps

Apply the vendor security update for Apple Macos as a priority.
Restrict network exposure of the affected service to trusted sources until patched.
Review logs and detections for indicators of exploitation.
Confirm fixed versions against the official vendor advisory before deploying.

References:

🛡️CVE-2026-8037 – Progress LoadMaster ✓ NVD

CVSS9.8 NVD 3.1

Triage statusActive Exploit

Exploitation In the wild In CISA KEV ↻ Ongoing

EPSS100% · P100

ActionPatch immediately

AffectedTechnology

Remediation Steps

Apply the vendor security update for Progress Connection Manager For Objectscale as a priority.
Restrict network exposure of the affected service to trusted sources until patched.
Review logs and detections for indicators of exploitation.
Confirm fixed versions against the official vendor advisory before deploying.

References:

🛡️CVE-2026-63077 – JetBrains TeamCity ✓ NVD

CVSS9.8 NVD 3.1

Triage statusActive Exploit

Exploitation In the wild In CISA KEV ↻ Ongoing

EPSS88% · P100

ActionPatch immediately

Remediation Steps

Check CISA's Known Exploited Vulnerabilities catalog for confirmation that this CVE affects your systems
Apply the vendor patch immediately
Monitor systems for evidence of exploitation
Review access logs for suspicious activity on affected assets

References:

🛡️CVE-2026-9198 – IBM Langflow ✓ NVD

CVSS9.8 NVD 3.1

Triage statusActive Exploit

Exploitation In the wild In CISA KEV ↻ Ongoing

EPSS35% · P98

ActionPatch immediately

Remediation Steps

Consult CISA Known Exploited Vulnerabilities catalog for affected product details
Identify affected systems in your environment
Apply vendor patch as soon as available
Verify patch installation across all instances

References:

🛡️CVE-2026-60004 – Gitea ✓ NVD

CVSS9.8 NVD 3.1

Triage statusActive Exploit

Exploitation In the wild In CISA KEV ● New this week ★ Added to KEV this week

EPSS85% · P100

ActionPatch immediately

Remediation Steps

Apply the vendor security update for Gitea Gitea as a priority.
Restrict network exposure of the affected service to trusted sources until patched.
Review logs and detections for indicators of exploitation.
Confirm fixed versions against the official vendor advisory before deploying.

References:

https://nvd.nist.gov/vuln/detail/CVE-2026-60004

🛡️CVE-2026-8452 – Citrix NetScaler ADC And NetScaler Gateway ✓ NVD

CVSS9.8 NVD 3.1

Triage statusActive Exploit

Exploitation In the wild In CISA KEV ● New this week ★ Added to KEV this week

EPSS2% · P74

ActionPatch immediately

Remediation Steps

Apply the vendor security update for Citrix NetScaler ADC and NetScaler Gateway as a priority.
Restrict network exposure of the affected service to trusted sources until patched.
Review logs and detections for indicators of exploitation.
Confirm fixed versions against the official vendor advisory before deploying.

References:

🛡️CVE-2026-64849 – Lfprojects Mlflow ✓ NVD

CVSS9.3 NVD 3.1

Triage statusActive Exploit

Exploitation In the wild In CISA KEV

EPSS16% · P97

ActionPatch immediately

Remediation Steps

Apply the vendor security patch
Review system logs for evidence of exploitation
Verify affected systems are fully patched
Monitor for suspicious activity post-remediation

References:

🛡️CVE-2026-55040 – Microsoft SharePoint ✓ NVD

CVSS9.1 NVD 3.1

Triage statusActive Exploit

Exploitation In the wild In CISA KEV ↻ Ongoing

EPSS40% · P99

ActionPatch immediately

AffectedHealthcare Government

Remediation Steps

Apply the vendor security update for Microsoft Sharepoint Server as a priority.
Restrict network exposure of the affected service to trusted sources until patched.
Review logs and detections for indicators of exploitation.
Confirm fixed versions against the official vendor advisory before deploying.

References:

🛡️CVE-2026-72530 – TrueConf Server ✓ NVD

CVSS9 NVD 3.1

Triage statusActive Exploit

Exploitation In the wild In CISA KEV ↻ Ongoing

EPSS2% · P77

ActionPatch immediately

AffectedTransportation Technology Finance

Remediation Steps

Apply the vendor security update for Trueconf Server as a priority.
Restrict network exposure of the affected service to trusted sources until patched.
Review logs and detections for indicators of exploitation.
Confirm fixed versions against the official vendor advisory before deploying.

References:

🛡️CVE-2026-19478 – GitLab ✓ NVD

CVSS9.4 NVD 3.1

Triage statusActive Exploit

Exploitation In the wild

EPSS6% · P93

ActionPatch within 48 hours

Remediation Steps

Apply the latest GitLab security patch addressing CVE-2026-19478 immediately
Review audit logs for evidence of unauthorized project modifications or deletions
Restrict public project visibility to trusted users pending patch deployment
Monitor GitLab instances for suspicious code injection activity

References:

🛡️CVE-2026-73570 – Synacor Zimbra Collaboration Suite (ZCS) ✓ NVD

CVSS8.9 NVD 3.1

Triage statusActive Exploit

Exploitation In the wild In CISA KEV

EPSS21% · P97

ActionPatch immediately

AffectedTechnology Finance

Remediation Steps

Apply the vendor security update for Synacor Zimbra Collaboration Suite as a priority.
Restrict network exposure of the affected service to trusted sources until patched.
Review logs and detections for indicators of exploitation.
Confirm fixed versions against the official vendor advisory before deploying.

References:

🛡️CVE-2025-62593 – Ray-Project Ray ✓ NVD

CVSS8.8 NVD 3.1

Triage statusActive Exploit

Exploitation In the wild In CISA KEV ↻ Ongoing

EPSS17% · P97

ActionPatch immediately

AffectedTechnology Manufacturing Energy

Remediation Steps

Apply the vendor security update for Anyscale Ray as a priority.
Restrict network exposure of the affected service to trusted sources until patched.
Review logs and detections for indicators of exploitation.
Confirm fixed versions against the official vendor advisory before deploying.

References:

🛡️CVE-2019-1068 – Microsoft SQL Server ✓ NVD

CVSS8.8 NVD 3.1

Triage statusActive Exploit

Exploitation In the wild In CISA KEV ● New this week ★ Added to KEV this week

EPSS53% · P99

ActionPatch immediately

Remediation Steps

Apply the vendor security update for Microsoft SQL Server as a priority.
Restrict network exposure of the affected service to trusted sources until patched.
Review logs and detections for indicators of exploitation.
Confirm fixed versions against the official vendor advisory before deploying.

References:

🛡️CVE-2026-20349 – Cisco Secure Firewall Adaptive Security Appliance (ASA) And Secure Firewall Threat Defense (FTD) ✓ NVD

CVSS8.6 NVD 3.1

Triage statusActive Exploit

Exploitation In the wild In CISA KEV ↻ Ongoing

EPSS2% · P81

ActionPatch immediately

AffectedTechnology Government

Remediation Steps

Apply the vendor security update for Cisco Adaptive Security Appliance Software as a priority.
Restrict network exposure of the affected service to trusted sources until patched.
Review logs and detections for indicators of exploitation.
Confirm fixed versions against the official vendor advisory before deploying.

References:

🛡️CVE-2026-18577 – N-Able N-Central ✓ NVD

CVSS8.1 NVD 3.1

Triage statusActive Exploit

Exploitation In the wild In CISA KEV ↻ Ongoing

EPSS54% · P99

ActionPatch immediately

AffectedGovernment Technology

Remediation Steps

Apply the vendor security update for N-Able N-Central as a priority.
Restrict network exposure of the affected service to trusted sources until patched.
Review logs and detections for indicators of exploitation.
Confirm fixed versions against the official vendor advisory before deploying.

References:

🛡️CVE-2026-53362 – Linux Kernel ✓ NVD

CVSS7.8 NVD 3.1

Triage statusActive Exploit

Exploitation In the wild In CISA KEV ● New this week ★ Added to KEV this week

EPSS1% · P41

ActionPatch immediately

AffectedTechnology Finance Government

Remediation Steps

Apply the vendor security update for Linux Kernel as a priority.
Restrict network exposure of the affected service to trusted sources until patched.
Review logs and detections for indicators of exploitation.
Confirm fixed versions against the official vendor advisory before deploying.

References:

🛡️CVE-2015-5287 – Red Hat Automatic Bug Reporting Tool ✓ NVD

CVSS7.8 NVD 3.1

Triage statusActive Exploit

Exploitation In the wild In CISA KEV ● New this week ★ Added to KEV this week

EPSS5% · P92

ActionPatch immediately

Remediation Steps

Apply the vendor security update for Red Hat Automatic Bug Reporting Tool as a priority.
Restrict network exposure of the affected service to trusted sources until patched.
Review logs and detections for indicators of exploitation.
Confirm fixed versions against the official vendor advisory before deploying.

References:

🛡️CVE-2022-0995 – Linux Kernel ✓ NVD

CVSS7.8 NVD 3.1

Triage statusActive Exploit

Exploitation In the wild In CISA KEV ● New this week ★ Added to KEV this week

EPSS10% · P95

ActionPatch immediately

Remediation Steps

Apply the vendor security update for Linux Kernel as a priority.
Restrict network exposure of the affected service to trusted sources until patched.
Review logs and detections for indicators of exploitation.
Confirm fixed versions against the official vendor advisory before deploying.

References:

🛡️CVE-2026-34486 – Apache Tomcat ✓ NVD

CVSS7.5 NVD 3.1

Triage statusActive Exploit

Exploitation In the wild In CISA KEV ↻ Ongoing

EPSS99% · P100

ActionPatch immediately

AffectedTechnology Government

Remediation Steps

Apply the vendor security update for Apache Tomcat as a priority.
Restrict network exposure of the affected service to trusted sources until patched.
Review logs and detections for indicators of exploitation.
Confirm fixed versions against the official vendor advisory before deploying.

References:

🛡️CVE-2026-18556 – N-Able N-Central ✓ NVD

CVSS7.4 NVD 3.1

Triage statusActive Exploit

Exploitation In the wild In CISA KEV ↻ Ongoing

EPSS40% · P99

ActionPatch immediately

AffectedTechnology Government

Remediation Steps

Apply the vendor security update for N-Able N-Central as a priority.
Restrict network exposure of the affected service to trusted sources until patched.
Review logs and detections for indicators of exploitation.
Confirm fixed versions against the official vendor advisory before deploying.

References:

🛡️CVE-2026-68820 – Microsoft Windows Ancillary Function Driver For WinSock ✓ NVD

CVSS7 NVD 3.1

Triage statusActive Exploit

Exploitation In the wild In CISA KEV ↻ Ongoing

EPSS6% · P93

ActionPatch immediately

AffectedTechnology Government

Remediation Steps

Apply the vendor security update for Microsoft Windows 10 1607 as a priority.
Restrict network exposure of the affected service to trusted sources until patched.
Review logs and detections for indicators of exploitation.
Confirm fixed versions against the official vendor advisory before deploying.

References:

🛡️CVE-2026-76640 – Unitree G1 EDU Humanoid Robot ✓ NVD

CVSS7.5 NVD 3.1

Triage statusActive Exploit

Exploitation In the wild

EPSS<1% · P27

ActionPatch within 48 hours

Remediation Steps

Apply vendor security update for Unitree G1 EDU
Restrict Bluetooth Low Energy (BLE) access to authorized devices only
Audit robot system logs for unauthorized root access attempts
Consider disabling unnecessary wireless interfaces if operationally feasible

References:

🛡️CVE-2025-68686 – Fortinet FortiOS ✓ NVD

CVSS5.9 NVD 3.1

Triage statusActive Exploit

Exploitation In the wild In CISA KEV ↻ Ongoing

EPSS29% · P98

ActionPatch immediately

AffectedTechnology

Remediation Steps

Apply the vendor security update for Fortinet Fortios as a priority.
Restrict network exposure of the affected service to trusted sources until patched.
Review logs and detections for indicators of exploitation.
Confirm fixed versions against the official vendor advisory before deploying.

References:

🛡️CVE-2026-66384 – JFrog Artifactory ✓ NVD

CVSS5.3 NVD 3.1

Triage statusActive Exploit

Exploitation In the wild In CISA KEV ● New this week ★ Added to KEV this week

EPSS1% · P45

ActionPatch immediately

AffectedTechnology Finance Government

Remediation Steps

Apply the vendor security update for Jfrog Artifactory as a priority.
Restrict network exposure of the affected service to trusted sources until patched.
Review logs and detections for indicators of exploitation.
Confirm fixed versions against the official vendor advisory before deploying.

References:

🛡️CVE-2026-20316 – Cisco Secure Firewall Management Center (FMC) ✓ NVD

CVSS5.3 NVD 3.1

Triage statusActive Exploit

Exploitation In the wild In CISA KEV ↻ Ongoing

EPSS10% · P95

ActionPatch immediately

AffectedTechnology

Remediation Steps

Apply the vendor security update for Cisco Secure Firewall Management Center as a priority.
Restrict network exposure of the affected service to trusted sources until patched.
Review logs and detections for indicators of exploitation.
Confirm fixed versions against the official vendor advisory before deploying.

References:

🛡️CVE-2015-3246 – Red Hat Libuser ✓ NVD

CVSS5.1 NVD 3.1

Triage statusActive Exploit

Exploitation In the wild In CISA KEV ● New this week ★ Added to KEV this week

EPSS9% · P95

ActionPatch immediately

Remediation Steps

Apply the vendor security update for Red Hat Libuser as a priority.
Restrict network exposure of the affected service to trusted sources until patched.
Review logs and detections for indicators of exploitation.
Confirm fixed versions against the official vendor advisory before deploying.

References:

🛡️CVE-2026-76581 – WordPress plugins (WPMU DEV Dashboard, Avada, TranslatePress, Pods, GiveWP) ✓ NVD

CVSS9.8 NVD 3.1

Triage statusNo Known Exploit

ExploitationNo exploitation reported

EPSS<1% · P27

ActionPatch within 48 hours

AffectedTechnology

Remediation Steps

Update all affected WordPress plugins to patched versions
Review admin account login logs for unauthorized access
Audit user roles and permissions for unexpected changes
Consider temporary deactivation of vulnerable plugins if immediate patch is unavailable

References:

🛡️CVE-2026-15981 – MiniOrange SAML 2.0 SSO Plugin (WordPress) ✓ NVD

CVSS9.8 NVD 3.1

Triage statusNo Known Exploit

ExploitationNo exploitation reported ● New this week

EPSS1% · P54

ActionPatch within 48 hours

AffectedTechnology Finance Government

Remediation Steps

Apply the vendor security update for MiniOrange SAML 2.0 SSO Plugin (WordPress) as a priority.
Restrict network exposure of the affected service to trusted sources until patched.
Review logs and detections for indicators of exploitation.
Confirm fixed versions against the official vendor advisory before deploying.

References:

🛡️CVE-2026-18963 – Red Hat Keycloak ✓ NVD

CVSS9.1 NVD 3.1

Triage statusNo Known Exploit

ExploitationNo exploitation reported

EPSS3% · P87

ActionPatch within 48 hours

Remediation Steps

Apply Red Hat security patch for Keycloak immediately
Verify that password reset flows require proper authentication
Audit recent account activity and password reset requests
Consider implementing additional MFA controls for sensitive accounts

References:

🛡️CVE-2026-76639 – Unitree G1 EDU Humanoid Robot ✓ NVD

CVSS8.8 NVD 3.1

Triage statusNo Known Exploit

ExploitationNo exploitation reported

EPSS1% · P51

ActionPatch this week

Remediation Steps

Apply vendor security update for Unitree G1 EDU
Restrict network access to affected robots to trusted networks
Disable Bluetooth Low Energy (BLE) if not required for operations
Monitor robot systems for unauthorized access or anomalous behavior

References:

🛡️CVE-2026-61979 – MiniOrange SAML 2.0 SSO Plugin (WordPress) ✓ NVD

CVSS8.1 NVD 3.1

Triage statusNo Known Exploit

ExploitationNo exploitation reported ● New this week

EPSS<1% · P20

ActionPatch this week

AffectedTechnology Finance Government

Remediation Steps

Apply the vendor security update for MiniOrange SAML 2.0 SSO Plugin (WordPress) as a priority.
Restrict network exposure of the affected service to trusted sources until patched.
Review logs and detections for indicators of exploitation.
Confirm fixed versions against the official vendor advisory before deploying.

References:

https://patchstack.com/database/wordpress/plugin/miniorange-saml-20-single-sign-on/vulnerability/wordpress-saml-sp-single-sign-on-plugin-5-4-3-privilege-escalation-vulnerability?_s_id=cve

🛡️CVE-2026-19913 – Kaltura mwEmbed ✓ NVD

CVSS7.5 NVD 3.1

Triage statusNo Known Exploit

ExploitationNo exploitation reported ● New this week

EPSS<1% · P29

ActionPatch this week

AffectedGovernment Technology

Remediation Steps

Apply the vendor security update for Kaltura mwEmbed as a priority.
Restrict network exposure of the affected service to trusted sources until patched.
Review logs and detections for indicators of exploitation.
Confirm fixed versions against the official vendor advisory before deploying.

References:

https://kb.cert.org/vuls/id/308749

Editorial integrity

Verified facts (green zone): 40 CVE ID(s) verified verbatim against source articles; 40 published in NVD with full canonical data (vendor, product, CVSS, references); 32 confirmed exploited in CISA KEV; 2 with source-reported exploitation (KEV-pending).

AI-synthesized content (analyst summary, remediation step phrasing): generated by an AI model from 5 security feeds. Generic remediation guidance (apply patch, restrict network access, monitor logs) is best-practice and trusted; specific vendor steps and version numbers must be verified against the official advisories linked above. Verify before acting in production.

Adjustments before publication: 2 unverified claim(s) stripped or genericized.

Find an error? contact@defend.network

🤖 This vulnerability report was compiled by defend.network using AI-powered analysis of vulnerability databases, vendor advisories, and threat intelligence feeds. Always verify remediation steps through official vendor channels before implementing changes in production environments.