# The Vulnpocalypse Is Here: August 2026's Most Critical Exploits You Can't Ignore

The so-called "Vulnpocalypse" has arrived in full force, and August 2026 delivered a relentless wave of high-severity vulnerabilities that demand immediate attention from security teams worldwide. From actively exploited zero-days in Microsoft products to a CVSS 10 flaw in Metabase and critical remote code execution chains in enterprise software, this month's threat landscape proves that attackers are weaponizing disclosures faster than ever before. Here's your comprehensive breakdown of the vulnerabilities that matter most and what you need to do about them.

## Microsoft's August Patch Tsunami: 457 CVEs and Counting

Microsoft's August 2026 Patch Tuesday was nothing short of overwhelming, with 457 new CVEs disclosed—36 of which received critical-severity CVSS scores. Even more concerning, 80 of these vulnerabilities scored above the 50th percentile in EPSS (Exploitation Prediction Scoring System), with 16 ranking above the 80th percentile, indicating a high probability of imminent exploitation.

The company designated 34 CVEs as "Exploitation More Likely," signaling that attackers are actively targeting these flaws. Among the most critical additions to CISA's Known Exploited Vulnerabilities (KEV) catalog were CVE-2026-33824, affecting the Windows IKE Extension, and CVE-2026-55040, a SharePoint vulnerability first disclosed in July. Even older vulnerabilities like CVE-2019-1068 in Microsoft SQL Server made their way onto the KEV list, proving that attackers continue to mine historical flaws for unpatched systems.

CISA also added ransomware distinctions to two particularly nasty flaws: CVE-2026-45659, a deserialization vulnerability (CWE-502) in Microsoft SharePoint Server, and CVE-2025-60710, a Windows link-following flaw (CWE-59) enabling privilege escalation. These designations indicate that ransomware operators have incorporated these exploits into their attack playbooks.

## The "Certighost" Flaw and Other High-Risk Microsoft Vulnerabilities

One of the most alarming disclosures was "Certighost," an improper authorization vulnerability (CWE-285) in Active Directory Certificate Services (AD CS). This flaw allows an authenticated attacker to obtain a certificate and elevate privileges via Kerberos, potentially compromising entire Windows domains. The attack surface here is massive, given AD CS's central role in enterprise authentication.

Additionally, an integer overflow vulnerability (CWE-190) in Microsoft Office Outlook enables code execution through malicious Office files delivered via social engineering. Meanwhile, an Outlook Web Access cross-site scripting (XSS) flaw allows attackers to execute JavaScript through a single malicious email, deploying the OWAReaper implant designed to steal credentials and OAuth tokens. These vulnerabilities highlight how email remains one of the most dangerous attack vectors in enterprise environments.

## Cisco's August Vulnerability Clusters: Critical Flaws and Public Exploits

Cisco disclosed several high-risk vulnerability clusters spanning its firewall, network management, endpoint security, and server management products. Notably, the vendor grouped vulnerabilities by Common Weakness Enumeration (CWE) class, releasing multiple flaws under single CVE identifiers—a practice the CVE program has officially discouraged.

### CVE-2026-20349: Actively Exploited DoS in Secure Firewall

This high-severity vulnerability (CVSS 8.6, EPSS 81st percentile) affects the Remote Access SSL VPN service in Cisco Secure Firewall ASA and FTD products. An unauthenticated remote attacker can trigger a denial-of-service condition using a crafted HTTP request. With no workarounds available and active exploitation confirmed, this flaw demands immediate patching.

### CVE-2026-20200: Root-Level RCE in Integrated Management Controller

This argument-injection vulnerability (CVSS 8.8, EPSS 93rd percentile) in Cisco's Integrated Management Controller (IMC) is particularly dangerous because IMC operates below the host OS and can interact with firmware, BIOS, and Secure Boot. A low-privilege attacker can inject additional curl arguments to execute arbitrary commands with root privileges. Public proof-of-concept exploit toolkits are already circulating, supporting arbitrary file upload/download and reverse-shell execution.

### Seven ClamAV Flaws and Catalyst SD-WAN Vulnerabilities

Cisco also patched seven ClamAV parsing flaws affecting Secure Endpoint Connector, with public PoC exploits confirmed for CVE-2026-20337 and CVE-2026-20338. The Catalyst SD-WAN product line received fixes for five CVE groups, including two rated CVSS 9.9 covering improper input validation and access control issues.

## The CVSS 10 Nightmare: CVE-2026-72898 in Metabase

Perhaps the most critical vulnerability of August 2026 is CVE-2026-72898, a perfect CVSS 10 SQL injection flaw in Metabase. This vulnerability allows unauthenticated remote attackers to inject arbitrary SQL commands via the `/reset_password` endpoint, potentially gaining administrator access to connected instances. With an EPSS score in the 100th percentile and active exploitation confirmed, security firm VeraniX identified 15 victims by August 10th—a number that has likely grown significantly.

Public proof-of-concept exploits are widely available, and the vulnerability has been added to CISA's KEV catalog. The vendor advises blocking access to the `/api/session/reset_password` endpoint as a temporary mitigation until patching is possible.

## Gitea, Zimbra, and Apache Tomcat: More Actively Exploited Flaws

CVE-2026-60004 in Gitea (CVSS 9.8, EPSS 100th percentile) allows remote code execution via the diffpatch API during Git hook installation. With public PoCs available and active exploitation confirmed, users should upgrade to version 1.27.1 immediately.

Zimbra Collaboration Suite users face CVE-2026-73570 (CVSS 8.9, EPSS 98th percentile), an improper input sanitization flaw in SNMP notification processing that enables unauthenticated RCE via crafted SMTP requests. The optional zimbra-snmp package must be installed for exploitation, but the risk remains severe.

Apache Tomcat's CVE-2026-34486 (CVSS 7.5, EPSS 100th percentile) bypasses the EncryptInterceptor component of the Tribes clustering subsystem, leaving inter-node communications in plaintext. This flaw was introduced by a flawed patch for CVE-2026-29146 and affects Tomcat versions 11.0.20, 10.1.53, and 9.0.116.

## The Container Security Threat: CopyEscape and Docker

CVE-2026-17106, dubbed "CopyEscape," allows a malicious container to escape isolation and achieve root code execution on a Docker host. The vulnerability combines path traversal (CWE-35) and improper symlink resolution (CWE-59) flaws in the moby/go-archive tar extraction routines. While no active exploitation has been confirmed, multiple technical write-ups and functional public PoCs are available, making this a ticking time bomb for containerized environments.

## Zoom, ownCloud, and the Long Tail of Critical Vulnerabilities

CVE-2026-53413 in Zoom (CVSS 8.3, EPSS 92nd percentile) allows any meeting attendee to achieve RCE on all participants across native clients without user interaction. While not yet actively exploited, the elevated EPSS score and demonstrated exploitability make this a significant concern for organizations relying heavily on video conferencing.

The three-year-old CVE-2023-49105 in ownCloud (CVSS 9.8, EPSS 99th percentile) finally made it to CISA's KEV list in August after a Philippine nuclear naval contractor was identified as a victim. This flaw allows attackers with knowledge of a username to access, modify, or delete any file without authentication.

## Conclusion: The New Normal Demands Vigilance

August 2026 delivered another heavy wave of high-risk vulnerabilities, including actively exploited flaws, public PoCs, CVSS 10 issues, and vulnerabilities tied to ransomware and espionage campaigns. The month's disclosures reinforce a critical reality: internet-facing and privileged enterprise systems must be prioritized for rapid remediation.

For defenders seeking comprehensive protection, vulnerability management platforms like Greenbone's OPENVAS ENTERPRISE FEED provide regular detection checks across Microsoft, Cisco, and countless other products. The free two-week trial of OPENVAS SCAN offers deep insight into where software vulnerabilities exist across your organization's infrastructure. In the age of the Vulnpocalypse, proactive vulnerability detection isn't just recommended—it's essential for survival.