Monthly exploitation report · August 2026
Executive analysis of KEV additions, sensor-observed exploitation activity, CISA visibility gaps, and the vulnerabilities that drove August 2026.
77 were outside CISA KEV when added
Up 204.9% from July
Share of events tied to five vulnerabilities
Across 16 vulnerabilities added by Previdian first
Executive brief
Five vulnerabilities produced 86.3% of August events. Prioritize asset discovery and remediation around ADC, Gateway, PHPUnit, react-server-dom-webpack, react-server-dom-turbopack, react-server-dom-parcel, PHP, and WordPress.
Previdian added 77 exploited vulnerabilities outside CISA KEV during August; 62 were still absent at month-end.
Event volume and source breadth help identify pressure, but observations do not prove that a real-world target was compromised or represent all exploitation activity worldwide.
Exploitation activity
Previdian sensors recorded 160,586 exploitation events in August, up from 52,674 in July. A small set of vulnerabilities drove most of the observed volume.
Observed exploitation events
July versus August 2026
158
Vulnerabilities observed
2,738
Source IPs
21
First observed
For CISOs, this concentration supports a focused exposure-validation and remediation sprint rather than treating every observed CVE as equally urgent.
Early Warning
9 of the KEVs added during August 2026 were already on the autonomous watchlist. The median lead time was 2.8 days; the longest was 15.4 days.
2.8 days
Median lead
9.8%
Share of new KEVs
Visibility before CISA KEV
Sixteen vulnerabilities were added by Previdian before later inclusion in CISA KEV. The median lead time was 4.1 days; the longest was 37.1 days.
4.1 days
Median positive lead
62
Still absent at month-end
Most targeted
Ranked by sensor-observed exploitation events. Event volume shows intensity; unique source IPs help indicate breadth.
33.0% of monthly events
32.8% of monthly events
Meta · react-server-dom-webpack, react-server-dom-turbopack, react-server-dom-parcel
In CISA KEV
11.6% of monthly events
6.0% of monthly events
2.9% of monthly events
2.2% of monthly events
2.0% of monthly events
2.0% of monthly events
Progress Software · LoadMaster, ECS Connections Manager, Object Scale Connection Manager, MOVEit WAF
In CISA KEV
1.3% of monthly events
Microsoft · Microsoft SharePoint Enterprise Server 2016, Microsoft SharePoint Server 2019, Microsoft SharePoint Server Subscription Edition
In CISA KEV
0.8% of monthly events
Vendor exposure
Microsoft
3 outside CISA KEV when added
Flowise
3 outside CISA KEV when added
langflow-ai
3 outside CISA KEV when added
mlflow
3 outside CISA KEV when added
Weaver Network Co., Ltd.
3 outside CISA KEV when added
Weakness patterns
CWE-94 · Improper Control of Generation of Code ('Code Injection')
Most common newly added weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
9 newly added KEVs
CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
9 newly added KEVs
CWE-306 · Missing Authentication for Critical Function
6 newly added KEVs
CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
6 newly added KEVs
57.6%
Critical severity
168
Public PoC references
140
Nuclei references
157
Observed request paths
Methodology and limitations
These notes define the reporting window, what sensor observations mean, and where the dataset should not be generalized.
Full Previdian methodology1 August 2026 00:00 UTC through 31 August 2026 23:59 UTC.
Previdian telemetry represents activity observed by the Previdian sensor network; it does not represent all exploitation activity globally.
An observed exploitation attempt does not by itself demonstrate that a real-world target was successfully compromised.
Month-end status is reconstructed from stored CISA addition dates. Removals are not tracked.
Unique source-IP counts require raw sensor rows. When only daily rollups exist, the metric is unavailable.
Historical or backfilled KEV records cannot be identified reliably from existing fields and are not listed as a separate category.
Public reports do not disclose Previdian sensor network size or per-CVE sensor counts.
Early-warning lead time is the gap from first autonomous-watchlist listing to first Previdian KEV. Only positive gaps are counted. Listings after a KEV already existed are excluded.
Prefer deep links to individual CVE reports and this methodology when citing sensor-observed vulnerabilities.