August 2026 CVE Landscape

Immediate Actions

Key Takeaways

• 73 high-impact vulnerabilities identified; 43 had Very Critical Recorded Future Risk Score, down 14% from July.
• 31 vulnerabilities listed in CISA KEV catalog; 53 had public PoC exploits or scanners available.
• UAT-10147 deployed QuasarRAT, NoodleRAT, EfsPotato, ASHX web shells, and rogue privileged accounts.
• Common weakness classes: CWE-94 and CWE-502 with seven each, CWE-287 and CWE-306 with six each.
• 17 vulnerabilities were at least five years old; oldest was approximately 16 years old.

Attack Chain

1. Initial Access: Exploit internet-facing Telerik, AjaxPro, Nacos, Zimbra, and NetScaler vulnerabilities
2. Privilege Escalation: Use Linux LPE exploits including CVE-2010-3904, CVE-2021-3156, CVE-2022-0847
3. AI-Assisted Reconnaissance: Deploy DeepAudit, PentestGPT, or Hermes Agent for vulnerability discovery and payload generation
4. Persistence: Install ASHX web shells, scheduled tasks, rogue accounts, NoodleRAT, QuasarRAT
5. Exfiltration: Exploit NetScaler to dump memory and extract authentication cookies

Affected Systems

• Microsoft Windows Server, Office, SQL Server, SharePoint
• Linux kernel-based systems
• Network appliances: Cisco ASA, Fortinet, Palo Alto, Citrix NetScaler
• AI/ML platforms: Ray, Metabase, IBM Langflow, MLflow, n8n, Marimo
• Collaboration platforms: Zimbra, WordPress, Roundcube, TrueConf
• Developer tools: Gitea, JetBrains TeamCity, GitLab, Jenkins

Vulnerabilities (CVEs)

Detection Availability

• Published: Other detection logic
• Platforms: Recorded Future Intelligence Platform

Nuclei templates available for CVE-2025-62593, CVE-2026-72898, CVE-2026-9198, and Apache Log4j Issue #4255 via Recorded Future Intelligence Platform.

Detection Engineering Assessment

Hypotheses are starting points derived from the article, not findings about your environment; validate against your own telemetry.

Hunting Hypotheses

Required Log Sources

• Web server access logs
• EDR process telemetry
• Network firewall logs
• CISA KEV catalog feeds
• Authentication logs
• Scheduled task creation logs

Key Behavioral Indicators

• Web server worker processes spawning shells or network tools
• Scheduled tasks referencing Chrome binary in unusual paths
• Windows Defender exclusion paths covering IIS directories
• Rogue local account creation with privileged group membership
• Unexpected outbound connections from web server processes
• Memory dump file creation on network appliances

Control Gaps

• Network-edge appliance exploitation may bypass EDR coverage
• AI-assisted exploitation workflows lack signature-based detection
• Legacy vulnerabilities older than five years may be deprioritized
• Web shell deployment in IIS may mimic legitimate application behavior

False Positive Assessment

Recommendations

Suggestions to evaluate against your own environment, tooling, and incident-response procedures — not directives.

Infrastructure Hardening

• Restrict internet-facing access to AI/ML platforms: Ray, Metabase, Langflow, n8n, MLflow.
• Apply network segmentation to isolate network appliances from internal networks.
• Enable enhanced logging on Citrix NetScaler and Cisco ASA appliances.
• Deploy Nuclei templates for CVE-2025-62593, CVE-2026-72898, CVE-2026-9198.

User Protection

• Deploy EDR with behavioral detection for web shell activity in IIS directories.
• Monitor for rogue privileged account creation on Windows and Linux systems.
• Enforce MFA for all remote access to network appliances and AI platforms.

Security Awareness

• Train server administrators to recognize web shell indicators and Defender exclusion abuse.
• Brief SOC teams on AI-assisted exploitation patterns and semi-autonomous attack workflows.

MITRE ATT&CK Mapping

Plain-Language Summary

Researchers found 73 serious security flaws exploited in August 2026 across products from 45 vendors. Chinese-speaking hackers used artificial intelligence tools to help find and exploit vulnerabilities in web servers and AI platforms. One group used tools called DeepAudit and PentestGPT after breaking in, while another used Hermes Agent and DeepSeek to automate attacks. Organizations should prioritize patching the listed vulnerabilities, especially those flagged in CISA's known exploited vulnerabilities catalog.