If you only get to fix five things from August, fix these five.
Four are in CISA KEV. One was exploited for about five weeks before Microsoft knew it existed. One carries the maximum CVSS score of 10.0 and requires nothing from you at all.
Two of them weren’t August patches. CVE-2026-33824 shipped in April. CVE-2026-59310 shipped July 29. Both became urgent in August because that’s when the exploitation evidence arrived, which means a team that closed its August cycle cleanly and never looked back at April is still exposed.
They run in order of exploitation evidence: what was attacked before a fix existed, then the strength and volume of confirmed compromise, then what hasn’t been attacked at all. Each one is tracked on Strobes Vulnerability Intelligence with live EPSS and KEV state.
CVE-2026-68820 is a use-after-free in the Windows Ancillary Function Driver for WinSock (afd.sys), CVSS 7.0, and it was a live Lazarus Group zero-day when the patch shipped. A low-privilege local attacker runs a crafted application, wins a race in the driver, and takes SYSTEM. No user interaction.
The timeline: reported to Microsoft July 28, confirmed July 31, CVE assigned August 5, patched August 11. Public reporting places exploitation from at least early July, in a fake-recruiter campaign against defense and aerospace employees in Europe, India, and Brazil, with the exploit loading an upgraded FudModule rootkit.
CISA added it to KEV on August 11, the same day the fix landed. BOD 26-04 puts publicly exposed systems on a three-day clock and internal systems on fourteen.
Microsoft rated it Important at CVSS 7.0, inside a release of roughly 400 CVEs. Sort that release by score and this bug lands below dozens of Criticals nobody is attacking. Patch by CVSS and you schedule Lazarus’s targets last.
One trap has nothing to do with prioritization. The fix replaces a kernel driver, and the vulnerable driver stays loaded until reboot. A patched-but-not-rebooted endpoint is still fully exploitable, so a dashboard counting “update installed” is reporting a number that isn’t true.
CVE-2026-59310 is a directory traversal flaw in the VMware vCenter Syslog Server component, CVSS 9.8, that a network-adjacent attacker uses to execute arbitrary code. Broadcom patched it July 29. KEV August 18, federal deadline August 21.
Incident response firm QUIRSO caught the exploitation live: an APT actor hitting web-accessible vCenter servers, path traversal for initial access, then a cron job establishing persistence with reverse_ssh. Compromised hosts first contacted attacker domains on August 3, five days after disclosure. QUIRSO counted 361 unique victim IPs across 47 countries and was clear this was confirmed compromise rather than scanning noise.
vCenter is the control plane for your virtual estate. Code execution there reaches every guest, datastore, and snapshot in one hop.
The cron job survives the patch. Applying the July fix in mid-August closes the door on a host that may already have a resident guest.
CVE-2026-33824 is a double free in the Windows IKE Extension (ikeext.dll), CVSS 9.8, exploitable by an unauthenticated attacker sending crafted IKE traffic to UDP port 500 or 4500. Microsoft patched it in April 2026. CISA added it to KEV on August 18, deadline August 21.
The vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Network reachable, low complexity, no privileges, no user interaction. IKEEXT runs with SYSTEM access, and every supported Windows version ships the IKE extensions for VPN.
The mechanism is worth knowing. During IKE_SA_INIT, a Security Realm Vendor ID payload makes IkeHandleSecurityRealmVendorId() allocate a blob and store the pointer in the Main Mode SA structure at offset 0x208. When a fragmented IKE_AUTH message reassembles, IkeReinjectReassembledPacket copies MMSA fields 0x178 through 0x21F, blob pointer included, into a local stack struct that gets shallow-copied into a heap work item. Two owners, one allocation, freed twice. ZDI’s read is a crash of IKEEXT or potentially arbitrary code execution.
When the patch shipped in April, exploitation was assessed as less likely and no public PoC existed. Four months later it’s in KEV.
That’s the same failure the July list documented twice on SharePoint. Vendor exploitability fields are forecasts published before anyone attacks the bug. KEV is a measurement taken afterward. Triage on the forecast and you’re patching against a four-month-old prediction.
Run Always On VPN or any Windows IPsec gateway and this sits at your perimeter, in front of authentication rather than behind it.
CVE-2026-20349 is an improper heap memory clearing flaw (CWE-244) in the Remote Access SSL VPN service of Cisco Secure Firewall ASA and FTD, CVSS 8.6, and one crafted HTTP request from an unauthenticated attacker reloads the device. KEV August 11, federal deadline August 14.
No credentials, no user interaction. Cisco attributes it to insufficient error checking on HTTP requests. The CVSS impact is availability only, which is exactly why it gets deprioritized.
Count what an edge firewall reload costs: remote access for the whole workforce, site-to-site tunnels, VPN concentrator services, and the syslog pipeline your SOC watches. An attacker who can drop your perimeter on demand can blind your detection while doing something else. CISA rates exploitation active and automatable.
CISA’s catalog calls this a “Heap Inspection Vulnerability,” a label derived mechanically from Cisco’s CWE classification. No data was exposed. The remediation doesn’t change, but don’t read disclosure into the name.
Second time in two years Cisco’s flagship firewall line has hit KEV as a zero-day, after ArcaneDoor in 2024.
CVE-2026-69836 is unsafe deserialization (CWE-502) in Microsoft Entra ID, CVSS 10.0, unauthenticated RCE with no user interaction, and it requires no action from you. Microsoft fixed it inside its own infrastructure before the advisory went public.
It scores 10.0 rather than 9.8 because the CVSS scope metric is changed (S:C). Entra ID is the authentication layer for Microsoft 365, Azure, and every federated application riding on it. Microsoft’s own Principal Security Engineer found it internally.
Then the disclosure became the story. The August 20 advisory set “Exploited” to Yes. On August 21, after press inquiry, Microsoft flipped it to No, said the flaw was not exploited in the wild, and called the change informational. For 24 hours the public record showed a maximum-severity flaw under active attack in the service most enterprises authenticate through.
Publishing a CVE for a self-remediated cloud fix is more transparency than most vendors offer, and the correction isn’t the problem. What it does to your queue is.
A 10.0 flagged exploited is the loudest signal a severity-driven process can receive: emergency change request, executive email, Friday war room. Then the flag disappears and there was never anything to patch.
Put it beside CVE-2026-68820 from the same month. The 7.0 was a nation-state zero-day loading a rootkit. The 10.0 needed nothing. Read severity first and exploitation second, and August handed you those two in the wrong order.
The score column and the priority order point in opposite directions. That’s August.
| CVE | Product | CVSS | Type | Exploited | Fix shipped |
|---|---|---|---|---|---|
| CVE-2026-68820 | Windows AFD.sys (WinSock) | 7.0 | Local priv-esc to SYSTEM, zero-day | Lazarus Group since early July, KEV Aug 11 | Aug 11 |
| CVE-2026-59310 | VMware vCenter (Syslog Server) | 9.8 | Path traversal to RCE | 361 victim IPs / 47 countries, KEV Aug 18 | July 29 |
| CVE-2026-33824 | Windows IKE Extension (ikeext.dll) | 9.8 | Unauth double-free RCE | KEV Aug 18, FCEB due Aug 21 | April 2026 |
| CVE-2026-20349 | Cisco Secure Firewall ASA / FTD | 8.6 | Unauth DoS, device reload | KEV Aug 11, FCEB due Aug 14 | Cisco hot fix |
| CVE-2026-69836 | Microsoft Entra ID | 10.0 | Unauth deserialization RCE | Flagged exploited Aug 20, reversed Aug 21 | Service-side, pre-disclosure |
CVSS values as published by the respective vendors and carried on Strobes VI at time of writing. Two of the five carried vendor exploitability assessments that later changed: 33824 was assessed less likely to be exploited before reaching KEV four months on, and 69836 was published as exploited and corrected within a day.
Patch AFD.sys first, then vCenter, then IKE, then the Cisco firewalls, then do nothing for Entra ID. That runs 7.0, 9.8, 9.8, 8.6, 10.0. A CVSS-sorted queue would have inverted it almost exactly.
The order follows what each piece of evidence predicts. AFD.sys leads because it was exploited before a fix existed by a named state actor delivering a rootkit, which is the strongest evidence on this list and something no patch discipline would have covered. vCenter follows because the compromise is confirmed with victim counts and the persistence mechanism survives patching, so it’s an incident response question rather than a patch question. IKE comes third: a wormable-class pre-auth RCE at the perimeter with four months of accumulated patch lag. Cisco is fourth because the impact ceiling is availability, though “availability” here means your perimeter and your SOC visibility. Entra ID is last because there’s nothing to do.
The one rule to take from August: check exploitation status against the fix date, not the release calendar. Two of these five were patched in April and July. A monthly patch cycle that treats each release as a closed batch will keep finding out in August what shipped in April, and the finding will arrive from CISA rather than from you.
Around 400 CVEs a month is the working baseline now. Manual severity triage doesn’t survive that volume, and neither does a process that revisits a patch cycle only when it’s open. What survives is a queue ordered by exploitation evidence, exploit availability, and confirmed reachability in your environment, which is the prioritization stage of a CTEM program and what Strobes RBVM maintains continuously rather than once a month.
Which August 2026 CVE should I patch first?
CVE-2026-68820, the Windows AFD.sys privilege escalation, because it was exploited as a zero-day by the Lazarus Group before Microsoft had a fix. Deploy the August cumulative update and enforce the reboot, since the vulnerable kernel driver stays loaded until the system restarts. Then move to vCenter and the Windows IKE flaw, both of which reached KEV on August 18.
Why is a CVSS 7.0 ranked above a CVSS 10.0?
Because CVSS measures technical severity, not the probability that anyone will attack you. CVE-2026-68820 scores 7.0 and was a live nation-state zero-day loading the FudModule rootkit. CVE-2026-69836 scores 10.0 and was already fixed inside Microsoft’s infrastructure before disclosure, requiring no customer action. Attackers select on reachability and reliability, which is what KEV and EPSS track and CVSS doesn’t.
Why are April and July CVEs on an August list?
Because that’s when the exploitation evidence arrived. CVE-2026-33824 was patched in April 2026 and reached CISA KEV on August 18. CVE-2026-59310 was patched July 29 and reached KEV on August 18 after QUIRSO documented confirmed compromises. A patch cycle you closed months ago can become an active incident without anything about the vulnerability changing.
Was the Entra ID flaw actually exploited?
Microsoft published the advisory on August 20 marked as exploited, then corrected the field to No on August 21 and stated the vulnerability was not exploited in the wild. No independent party has confirmed either version, and no public attack timeline exists. What’s established is that Microsoft asserted exploitation and then retracted the assertion.
Do I still need to act on vCenter if I already applied the July 29 patch?
Check for prior compromise. QUIRSO found attackers installing a malicious cron job using reverse_ssh for persistence, and compromised hosts were contacting attacker infrastructure from August 3. If your vCenter was web-accessible before you patched, review cron jobs and outbound SSH activity, and preserve forensic evidence before rebuilding.
Is the Cisco flaw safe to deprioritize since it’s only a denial of service?
No. It’s unauthenticated, needs no user interaction, CISA rates exploitation as active and automatable, and there’s no workaround. When an ASA or FTD reloads you lose remote access for the whole workforce, site-to-site tunnels, and the syslog feed your SOC monitors. The federal deadline was August 14.
How does Strobes help with a month like August?
Strobes Vulnerability Intelligence tracks exploit availability, EPSS movement, and KEV status per CVE continuously, so a patch that shipped in April surfaces the day its exploitation status changes rather than at your next audit. The platform then validates which findings are actually reachable in your environment instead of theoretically present. See Adversarial Exposure Validation and RBVM.
