Weekly recap: Week of 3 to 9 August 2026

Most covered

• vulnerabilities3 sources
  CISA Adds Three Known Exploited Vulnerabilities to CatalogSource ↗

  CISA added three vulnerabilities to its Known Exploited Vulnerabilities Catalog based on evidence of active exploitation: CVE-2026-9198 (IBM Langflow code injection), CVE-2026-18556 (N-able N-central authentication bypass), and CVE-2026-34486 (Apache Tomcat…

• vulnerabilities2 sources
  CISA Flags TeamCity CVE-2026-63077 RCE Flaw Under Active Exploitation in the WildSource ↗

  CISA has confirmed that CVE-2026-63077, a critical remote code execution vulnerability in JetBrains TeamCity, is under active exploitation. The flaw, which affects on-premise TeamCity deployments and carries a CVSS score of 9.8, stems from unsafe…

• vulnerabilities2 sources
  N-able Says Attackers Take Over N-central Servers After Initial Fix Proves IncompleteSource ↗

  N-able disclosed that attackers exploited an authentication bypass vulnerability (CVE-2026-18577) in N-central to obtain remote administrative access to the platform and systems managed through it. An initial patch released on August 2, 2026 proved…

• vulnerabilities2 sources
  Attackers exploit N-able N-central flaw to reach managed endpoints (CVE-2026-18577)Source ↗

  Attackers are actively exploiting CVE-2026-18577, an authentication bypass vulnerability in N-able N-central, a remote monitoring and management platform widely deployed by managed service providers. N-able discovered the flaw on July 31, 2026, after…

• ransomware
  Prolific ransomware group behind SonicWall zero-day attacksSource ↗

  The INC ransomware group has become the primary threat actor exploiting two SonicWall zero-day vulnerabilities (CVE-2026-15409 and CVE-2026-15410) disclosed on July 14. The group chained both flaws together to achieve full system access and has claimed…

• vulnerabilities
  July 2026 CVE LandscapeSource ↗

  Insikt Group identified 85 high-impact vulnerabilities in July 2026, representing a 44% increase from the previous month, with 36 carrying a Very Critical Risk Score. The vulnerabilities affected 61 vendors, with Microsoft accounting for approximately 12% of…

• vulnerabilities
  3rd August - Threat Intelligence ReportSource ↗

  A threat intelligence report covering the week of July 27 documents multiple significant incidents including coordinated attacks on 30+ Minnesota water utilities with impact to industrial control systems, a breach at Bank of Baroda exposing internal…

• vulnerabilities
  ABB Ability ZenonSource ↗

  ABB Ability Zenon, an industrial IoT platform with bundled MongoDB, contains multiple vulnerabilities in its MongoDB component that could allow unauthenticated attackers to read uninitialized heap memory or access arbitrary memory through specially crafted…

• vulnerabilities
  Progress Kemp LoadMaster Flaw Hits CISA KEV After 792 Reported Exploit AttemptsSource ↗

  CISA added a critical command injection vulnerability (CVE-2026-8037, CVSS 9.6) in Progress Kemp LoadMaster to its Known Exploited Vulnerabilities catalog after observing active exploitation attempts in the wild. The flaw enables arbitrary code execution on…

• threat intel
  Botnet Hunting for Vulnerabilities in Diagnostic ToolsSource ↗

  A botnet is performing reconnaissance scans targeting diagnostic tool endpoints (ping, traceroute, system management interfaces) across networked devices, probing for known and potentially unpatched vulnerabilities. The activity correlates with several…

Most active ransomware groups (leak-site claims, unverified)

Leak-site claim data is unverified: RansomLook (CC BY 4.0), with ransomware.live as a failover, credited and linked as its terms require (Source: Ransomware.live).

CISA KEV additions

Vulnerabilities on the move, 2026-08-10 to 2026-08-17 (the 7 days before this recap was generated)

Ransomware leak-site claims (20 of 349 shown, unverified)

• claimCONTINENTAL.AEROUnverified claim. Claimed by Clop.
• claimMINDRAY.COMUnverified claim. Claimed by Clop.
• claimnuv*******Unverified claim. Claimed by Clop.
• claimipm*******Unverified claim. Claimed by Clop.
• claimecc*******Unverified claim. Claimed by Clop.
• claimst*******Unverified claim. Claimed by Clop.
• claimqc*******Unverified claim. Claimed by Clop.
• claimflu*******Unverified claim. Claimed by Clop.
• claimSynergy InteractiveUnverified claim. Claimed by Qilin.
• claimEnergetic Development CorpUnverified claim. Claimed by Qilin.
• claimPanda Logistics Taichung BranchUnverified claim. Claimed by Qilin.
• claimEast Field CorporationUnverified claim. Claimed by Qilin.
• claimChun Tai Sing Chemical IndustryUnverified claim. Claimed by Qilin.
• claimpm-energy Die SolarexpertenUnverified claim. Claimed by Qilin.
• claimHarplast SRLUnverified claim. Claimed by Qilin.
• claimPrice ShoesUnverified claim. Claimed by Qilin.
• claimHilliard's Air Conditioning & Heating IncUnverified claim. Claimed by Orova.
• claimGemstone UKUnverified claim. Claimed by Orova.
• claimSt Theresa Catholic ChurchUnverified claim. Claimed by Orova.
• claimStoneybrook West Master Association, IncUnverified claim. Claimed by Orova.

Ransomware claim data is unverified: RansomLook (CC BY 4.0), with ransomware.live as a failover, credited and linked as its terms require (Source: Ransomware.live).

All leak-site claims and confirmed breaches