What to patch now — 31 August 2026
Source: CISA Known Exploited Vulnerabilities (KEV) catalog — the most recently added entries as of today. Every vulnerability below has been confirmed by CISA as actively exploited in the wild, meaning attackers are already using it, not just researching it. If you (or a supplier) run any of this software, treat it as urgent.
1. Gitea — a malicious code contribution can take over your self-hosted Git server (CVE-2026-60004)
🛠️ Gitea · added 25 Aug 2026 · CISA fix-by date 28 Aug 2026 (3 days overdue)
What it is: "Code injection" means an attacker sneaks their own instructions into something the software processes and has them run as if they were legitimate. Here, someone who already has write access to a repository (a contributor, or a compromised contributor account) can send a crafted change to Gitea's diff/patch feature to plant an executable hook and run shell commands as Gitea's own system account — effectively taking over the server that hosts your code.
Who's affected: Businesses or dev teams self-hosting Gitea as a private alternative to GitHub — common where a company wants its source code kept on its own infrastructure.
What to do: Apply Gitea's fix — the deadline has passed. Review who has write access to your repositories; this flaw needs a contributor account, so tightening who can push code (and requiring review before a merge) reduces the risk alongside the patch itself.
2. Citrix NetScaler ADC/Gateway — a crash bug in the box that fronts your apps and VPN (CVE-2026-8452)
🛠️ Citrix NetScaler ADC and NetScaler Gateway · added 26 Aug 2026 · CISA fix-by date 29 Aug 2026 (2 days overdue)
What it is: A memory-handling bug lets an attacker send NetScaler crafted traffic that crashes the service — a denial-of-service, taking down whatever it's protecting rather than letting the attacker in directly. NetScaler devices commonly sit in front of a company's web applications and handle remote-access VPN connections.
Who's affected: Businesses, or their IT provider, running a Citrix NetScaler appliance for application delivery or VPN access — more common in mid-sized companies than a typical small office, but a frequent choice for anyone with remote staff.
What to do: Apply Citrix's fix — the deadline has passed. If an IT provider manages your remote-access setup, ask specifically whether it's NetScaler and whether the patch is installed; an outage here can take down VPN access for your whole remote workforce at once.
3. ownCloud — files can be read or deleted without logging in, if your username is known (CVE-2023-49105)
🛠️ ownCloud · added 27 Aug 2026 · CISA fix-by date 30 Aug 2026 (1 day overdue)
What it is: "Improper authentication" here means a flaw in how ownCloud checks who's allowed to act on a file. If an attacker knows a user's username and that user hasn't set up a signing key, the attacker can access, change or delete that user's files with no valid login at all.
Who's affected: Businesses running their own ownCloud server for file sync and sharing — often chosen instead of Dropbox or OneDrive specifically for data-sovereignty or compliance reasons, so the files at risk are frequently the ones a business cared most about controlling.
What to do: Apply ownCloud's fix — the deadline has passed. Usernames are often just email addresses or predictable, so treat this as urgent even though no password is involved; ask whoever manages your ownCloud instance to confirm the patch and that signing keys are configured.
4. Microsoft SQL Server — an old remote-code-execution hole is being actively used again (CVE-2019-1068)
🛠️ Microsoft SQL Server · added 26 Aug 2026 · CISA fix-by date 29 Aug 2026 (2 days overdue)
What it is: A years-old flaw lets an attacker who can already reach the SQL Server database engine run their own code with the privileges of the service account — a step from "can query the database" to "can run commands on the server it lives on." Its reappearance on CISA's list this week means it's being exploited again in the wild, not that it's new.
Who's affected: Businesses running their own on-premises SQL Server for a line-of-business app, ecommerce backend or accounting system — not Microsoft's cloud-hosted Azure SQL, which Microsoft patches centrally.
What to do: If you or an IT provider run SQL Server on your own hardware or a VM, confirm this specific patch (it's an old one — check it wasn't missed on a server that's otherwise up to date) and that the database isn't reachable directly from the public internet.
5. Ajax.NET Professional — an unsupported .NET library with a remote-code-execution flaw (CVE-2021-23758)
🛠️ Ajax.NET Professional (AjaxPro) · added 26 Aug 2026 · CISA fix-by date 9 Sep 2026
What it is: "Deserialization of untrusted data" means the software takes data it receives and turns it back into program objects without properly checking it first — letting an attacker smuggle in a malicious object that runs their own code when the software processes it. AjaxPro is an older library some ASP.NET websites use, and CISA notes it may be end-of-life with no fix coming.
Who's affected: Businesses with an older, custom-built ASP.NET website — often one built years ago by a contractor and left largely untouched since — that happens to use this library under the hood.
What to do: Ask whoever built or maintains your website whether it uses AjaxPro. If it's end-of-life, the vendor's advice is to stop using it and move to a supported alternative rather than wait for a patch that may never come — a useful prompt to check whether an old site is quietly running on unsupported components generally.
6. JFrog Artifactory — a permissions flaw in the tool that stores your software builds (CVE-2026-66384)
🛠️ JFrog Artifactory · added 27 Aug 2026 · CISA fix-by date 10 Sep 2026
What it is: "Path traversal" means a flaw lets software be tricked into writing files outside the folder it's supposed to be confined to. Here, a logged-in user can write data outside the intended cache location under certain repository configurations — a narrower flaw than a full takeover, but one that can be used to plant or overwrite files an attacker shouldn't be able to touch.
Who's affected: Software development teams using Artifactory to store and distribute their own builds and dependencies — a supply-chain-adjacent tool, so relevant mainly to businesses that build and ship their own software rather than just running off-the-shelf products.
What to do: If your development team or a contractor runs Artifactory, ask them to apply JFrog's fix and review who has authenticated access to it — this flaw needs a valid account, so tightening access is a useful second line of defence alongside the patch.
7. Older Linux/Red Hat local-privilege bugs added in the same batch — a "check your servers are patched" job, not an open-door alert (CVE-2015-3246, CVE-2015-5287, CVE-2022-0995, CVE-2026-53362)
🛠️ Linux Kernel · Red Hat Libuser · Red Hat Automatic Bug Reporting Tool · added 26–27 Aug 2026 · CISA fix-by dates 30 Aug – 9 Sep 2026 (one overdue)
What it is: Four separate Linux/Red Hat bugs landed on CISA's list together this week. Each is a "local privilege escalation" flaw — meaning an attacker needs an existing low-level foothold on the machine already (a valid but limited account, or another flaw that got them in) before they can use it to become an administrator. None of these let a stranger in from the internet on their own; two involve tools (Libuser, ABRT) that may be end-of-life on older systems.
Who's affected: Businesses running their own Linux servers directly — a self-hosted app, database or file server on a VPS or dedicated box — rather than relying entirely on managed cloud services where the provider patches the underlying operating system.
What to do: Not an urgent standalone alert, but a good prompt to ask your host or IT provider when Linux servers were last patched at the OS level, since these bugs matter as the second step of an attack that starts elsewhere. If they can't answer confidently, that's the real finding.
This is an awareness summary of public CISA KEV data, not professional security advice. CISA "fix-by" dates are US federal deadlines; for everyone else they're a strong urgency signal, not a legal obligation. Always confirm the affected versions and the fix against the vendor's own advisory.