Recorded Future Identifies 73 High-Impact Vulnerabilities in August, 70 Actively Exploited
Summary
Recorded Future’s August 2026 review identified 73 high-impact vulnerabilities, including 70 reported as actively exploited or operationally weaponized. It also describes two AI-assisted threat operations and exploitation trends across affected technologies.
Key points
- The report identified 73 high-impact vulnerabilities across products from 45 vendors; 43 received a Very Critical risk score.
- Of the 73, 31 were listed in CISA’s Known Exploited Vulnerabilities catalog, 32 were validated from open sources, seven came from vendor telemetry, and three were surfaced through honeypots.
- The report lists 70 vulnerabilities as actively exploited or operationally weaponized in August, excluding the three primarily identified through honeypot data.
- 34 vulnerabilities enabled remote code execution, and public proof-of-concept exploits or scanners were identified for 53.
- UAT-10147 used AI tools during post-compromise operations alongside conventional exploitation, malware, web shells, and persistence methods; its workflows remained semi-autonomous with human involvement.
- A separate Chinese-speaking actor used Hermes Agent and DeepSeek to automate target enumeration and exploitation attempts; reported Langflow and n8n attempts failed, while other activity included memory exfiltration from three organizations via NetScaler and command execution on 11 Marimo deployments.
Article Details
- Publisher
- Recorded Future (Insikt Group)
- Report Period
- 2026-08
- Scope
- High-impact vulnerabilities and exploitation activity reported for August 2026.
- Sample Size
- 73 high-impact vulnerabilities; the exploitation table lists 70 and excludes three CVEs primarily surfaced through honeypot data.
- Key Statistics
- 43 of 73 vulnerabilities had a Very Critical Recorded Future Risk Score.
- 31 vulnerabilities were surfaced through CISA's KEV catalog; 32 were reported in open sources and validated by Insikt Group; seven came from security vendor telemetry; and three were surfaced exclusively through honeypot data.
- 34 of 73 vulnerabilities enabled remote code execution.
- Public proof-of-concept exploits or scanners were identified for 53 of 73 vulnerabilities.
- 17 vulnerabilities were at least five years old; the oldest was approximately 16 years old.
- Recommendations
- Prioritize vulnerabilities based on likelihood of exploitation as well as severity.
- Verify the validity of public proof-of-concept exploits before testing them.
- Identify internet-facing assets vulnerable to specific CVEs and prioritize and respond to vulnerable or misconfigured assets.
- Assess vulnerabilities in vendors' and partners' internet-facing systems.
CVE
CVE-2010-3904CVE-2010-3904CVE-2015-3246CVE-2015-3246CVE-2015-5287CVE-2015-5287CVE-2017-0199CVE-2017-0199CVE-2017-5753CVE-2017-5753CVE-2017-7921CVE-2017-7921CVE-2019-1068CVE-2019-1068CVE-2019-18935CVE-2019-18935CVE-2020-0796CVE-2020-0796CVE-2020-1013CVE-2020-1013CVE-2020-1472CVE-2020-1472CVE-2021-23758CVE-2021-23758CVE-2021-29441CVE-2021-29441CVE-2021-29442CVE-2021-29442CVE-2021-3156CVE-2021-3156CVE-2021-33044CVE-2021-33044CVE-2021-33045CVE-2021-33045CVE-2022-0847CVE-2022-0847CVE-2022-0995CVE-2022-0995CVE-2022-1040CVE-2022-1040CVE-2022-27925CVE-2022-27925CVE-2022-36883CVE-2022-36883CVE-2022-47986CVE-2022-47986CVE-2023-22527CVE-2023-22527CVE-2023-46747CVE-2023-46747CVE-2023-49105CVE-2023-49105CVE-2024-4577CVE-2024-4577CVE-2024-55591CVE-2024-55591CVE-2025-24472CVE-2025-24472CVE-2025-24813CVE-2025-24813CVE-2025-31324CVE-2025-31324CVE-2025-43529CVE-2025-43529CVE-2025-49113CVE-2025-49113CVE-2025-62593In August, Insikt Group created Nuclei templates to detect CVE-2025-62593 (Ray), CVE-2026-72898 (Metabase), and CVE-2026-9198 (IBM Langflow).CVE-2025-68613CVE-2025-68613CVE-2026-0300CVE-2026-0300CVE-2026-12569CVE-2026-12569CVE-2026-15981CVE-2026-15981CVE-2026-18556CVE-2026-18556CVE-2026-18577CVE-2026-18577CVE-2026-19478CVE-2026-19478CVE-2026-20349CVE-2026-20349CVE-2026-21858CVE-2026-21858CVE-2026-21962CVE-2026-21962CVE-2026-25895CVE-2026-25895CVE-2026-3055CVE-2026-3055CVE-2026-33017CVE-2026-33017CVE-2026-33824CVE-2026-33824CVE-2026-3395Additionally, Insikt Group had previously created templates to detect CVE-2026-3395 (MaxSite CMS) and CVE-2026-59800 (decolua 9Router), but their exploitation was reported in July, so they are not listed in the AugustCVE-2026-34486CVE-2026-34486CVE-2026-39987CVE-2026-39987CVE-2026-53362CVE-2026-53362CVE-2026-55040CVE-2026-55040CVE-2026-59310CVE-2026-59310CVE-2026-59800Additionally, Insikt Group had previously created templates to detect CVE-2026-3395 (MaxSite CMS) and CVE-2026-59800 (decolua 9Router), but their exploitation was reported in July, so they are not listed in the AugustCVE-2026-60004CVE-2026-60004CVE-2026-61979CVE-2026-61979CVE-2026-63030CVE-2026-63030CVE-2026-63077CVE-2026-63077CVE-2026-64849CVE-2026-64849CVE-2026-65400CVE-2026-65400CVE-2026-66384CVE-2026-66384CVE-2026-68820CVE-2026-68820CVE-2026-72529CVE-2026-72529CVE-2026-72530CVE-2026-72530CVE-2026-72898In August, Insikt Group created Nuclei templates to detect CVE-2025-62593 (Ray), CVE-2026-72898 (Metabase), and CVE-2026-9198 (IBM Langflow).CVE-2026-73570CVE-2026-73570CVE-2026-8037CVE-2026-8037CVE-2026-81578CVE-2026-81578CVE-2026-82078CVE-2026-82078CVE-2026-8452CVE-2026-8452CVE-2026-9198In August, Insikt Group created Nuclei templates to detect CVE-2025-62593 (Ray), CVE-2026-72898 (Metabase), and CVE-2026-9198 (IBM Langflow).
Threat Actors
Malware
BadIISIts Windows post-compromise activity included the use of EfsPotato, QuasarRAT, BadIIS, ASHX web shells, Defender exclusions for IIS directories, a Google Chrome Start scheduled task, and rogue privileged accounts.NoodleRATOn Linux, the threat actor deployed NoodleRAT, SPECTRE, and Meterpreter after gaining root access.QuasarRATIts Windows post-compromise activity included the use of EfsPotato, QuasarRAT, BadIIS, ASHX web shells, Defender exclusions for IIS directories, a Google Chrome Start scheduled task, and rogue privileged accounts.SPECTREOn Linux, the threat actor deployed NoodleRAT, SPECTRE, and Meterpreter after gaining root access.
Vendors
Alibaba GroupAlibaba NacosApacheAdditionally, Insikt Group created a Nuclei template to detect GitHub Issue #4255 affecting Apache Log4j, a deserialization allowlist bypass that Apache classified as a hardening gap rather than a Log4j vulnerability;AppleApple macOSAtlassianAtlassian Confluence Data Center and ServerBroadcomBroadcom VMware vCenterCiscoCisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD)CitrixCitrix NetScaler ADC and NetScaler GatewayF5F5 BIG-IPFortinetFortinet FortiOS and FortiProxyGitLabGitLab CE and EEHikvisionHikvision camerasIBMIn August, Insikt Group created Nuclei templates to detect CVE-2025-62593 (Ray), CVE-2026-72898 (Metabase), and CVE-2026-9198 (IBM Langflow).JetBrainsJetBrains TeamCityJFrogJFrog ArtifactoryMicrosoftThe 73 vulnerabilities in this blog affected products from 45 vendors, with Microsoft accounting for approximately 11% of the vulnerabilities.N-ableN-able N-centralOracleOracle HTTP Server and Oracle WebLogic Server Proxy Plug-inPalo Alto NetworksPalo Alto Networks PAN-OSProgressProgress Telerik UI for ASP.NET AJAXSAPSAP NetWeaver Visual ComposerSophosSophos FirewallSynacorSynacor Zimbra Collaboration Suite (ZCS)
Products
AjaxProAugust reporting showed two AI-assisted operations: UAT-10147 exploited Zimbra, AjaxPro, Nacos, and Telerik servers before using DeepAudit and PentestGPT after compromise, while a separate Chinese-speaking actorApache TomcatApache TomcatGiteaGiteaIBM LangflowIn August, Insikt Group created Nuclei templates to detect CVE-2025-62593 (Ray), CVE-2026-72898 (Metabase), and CVE-2026-9198 (IBM Langflow).LangflowIn August, Insikt Group created Nuclei templates to detect CVE-2025-62593 (Ray), CVE-2026-72898 (Metabase), and CVE-2026-9198 (IBM Langflow).MarimoMarimoMetabaseIn August, Insikt Group created Nuclei templates to detect CVE-2025-62593 (Ray), CVE-2026-72898 (Metabase), and CVE-2026-9198 (IBM Langflow).MLflowMLflown8nn8nNacosAlibaba NacosNetScalerCitrix NetScaler ADC and NetScaler GatewayNucleiIn August, Insikt Group created Nuclei templates to detect CVE-2025-62593 (Ray), CVE-2026-72898 (Metabase), and CVE-2026-9198 (IBM Langflow).PAN-OSPalo Alto Networks PAN-OSPaperCut NG/MFPaperCut NG/MFRayIn August, Insikt Group created Nuclei templates to detect CVE-2025-62593 (Ray), CVE-2026-72898 (Metabase), and CVE-2026-9198 (IBM Langflow).Telerik UI for ASP.NET AJAXProgress Telerik UI for ASP.NET AJAXWordPressWordPressZimbra Collaboration SuiteSynacor Zimbra Collaboration Suite (ZCS)
Tools
DeepAuditAI-assisted operations: UAT-10147 exploited Zimbra, AjaxPro, Nacos, and Telerik servers before using DeepAudit and PentestGPT after compromise, while a separate Chinese-speaking actor weaponized Hermes Agent andDeepSeekand PentestGPT after compromise, while a separate Chinese-speaking actor weaponized Hermes Agent and DeepSeek in failed attempts against Langflow and n8n.EfsPotatoIts Windows post-compromise activity included the use of EfsPotato, QuasarRAT, BadIIS, ASHX web shells, Defender exclusions for IIS directories, a Google Chrome Start scheduled task, and rogue privileged accounts.Hermes Agentusing DeepAudit and PentestGPT after compromise, while a separate Chinese-speaking actor weaponized Hermes Agent and DeepSeek in failed attempts against Langflow and n8n.MeterpreterOn Linux, the threat actor deployed NoodleRAT, SPECTRE, and Meterpreter after gaining root access.NucleiIn August, Insikt Group created Nuclei templates to detect CVE-2025-62593 (Ray), CVE-2026-72898 (Metabase), and CVE-2026-9198 (IBM Langflow).PentestGPToperations: UAT-10147 exploited Zimbra, AjaxPro, Nacos, and Telerik servers before using DeepAudit and PentestGPT after compromise, while a separate Chinese-speaking actor weaponized Hermes Agent and DeepSeek in