What to patch now — 17 August 2026
Source: CISA Known Exploited Vulnerabilities (KEV) catalog — the most recently added entries as of today. Every vulnerability below has been confirmed by CISA as actively exploited in the wild, meaning attackers are already using it, not just researching it. If you (or a supplier) run any of this software, treat it as urgent.
1. Cisco firewalls — a crash bug that can knock your firewall or VPN offline (CVE-2026-20349)
🛠️ Cisco Secure Firewall (ASA / FTD) · added 11 Aug 2026 · CISA fix-by date 14 Aug 2026 (3 days overdue)
What it is: "Heap inspection" refers to a bug in how the firewall's software checks a part of its own working memory. An outsider with no login at all can send it a crafted request that makes the device crash and restart — a "denial of service": the firewall goes down for a stretch, not a data theft or a takeover. That still matters, because whatever the firewall was protecting or routing (often a business's VPN into its own network) goes down with it.
Who's affected: Businesses running Cisco ASA or Secure Firewall Threat Defense (FTD) appliances — a common choice of firewall and VPN gateway for small and mid-sized companies, whether self-managed or run by an IT provider.
What to do: Apply Cisco's fix — the CISA deadline has already passed. If an IT provider manages your network hardware, ask specifically whether your Cisco firewall or VPN gateway has this patch; an unplanned reboot of a firewall can quietly break remote access rather than announce itself.
2. Windows networking driver — turns a smaller break-in into full control (CVE-2026-68820)
🛠️ Microsoft Windows (Ancillary Function Driver for WinSock) · added 11 Aug 2026 · CISA fix-by date 25 Aug 2026
What it is: A "use-after-free" bug is when a program keeps using a piece of memory after it's already told the system it's finished with it; an attacker can hijack that stale reference to run their own code. This one sits in a core part of Windows networking, and lets someone who already has some foothold on a machine — even a low-privilege login from a phished password or a piece of malware — push themselves up to full administrator control.
Who's affected: Any business running Windows PCs or servers; this ships as part of Windows itself, not a separate add-on product. It isn't how an attacker gets in first — it's what turns a smaller compromise into a complete one.
What to do: Install this month's Windows updates as normal — keep automatic updates on and don't let machines sit unpatched for weeks. It's also a reminder not to shrug off a "minor" incident (a suspicious login, malware caught late): this is exactly the kind of flaw that escalates one.
3. Metabase — a dashboard tool with a hole that hands over your connected databases (CVE-2026-72898)
🛠️ Metabase · added 11 Aug 2026 · CISA fix-by date 14 Aug 2026 (3 days overdue)
What it is: "SQL injection" means an attacker sneaks database commands into a request the software wasn't expecting, and the database behind it runs them as if they were legitimate. Metabase is a business-intelligence tool many companies self-host to build charts and reports over their own data. Here, an attacker with no login at all can use this to gain full administrator access to the Metabase application — then read the stored credentials for every database it's connected to, and pull out whatever data those connections can reach.
Who's affected: Businesses that self-host Metabase, usually set up by a developer or a data-focused staff member to power internal dashboards or reports drawing on a company database — sales, customers, operations.
What to do: Apply the vendor fix now — the deadline has already passed, and because this can expose every database Metabase touches, treat it as urgent even though Metabase itself feels like "just a reporting tool." If someone else set it up, ask directly whether it's patched and whether it's reachable from the open internet at all — it often doesn't need to be.
4. Progress LoadMaster — still-open hole letting anyone run commands on your load balancer (CVE-2026-8037)
🛠️ Progress LoadMaster · added 7 Aug 2026 · CISA fix-by date 10 Aug 2026 (about a week overdue)
What it is: "Command injection" means an attacker can smuggle their own operating-system commands into a request the device processes, and it runs them as if they were legitimate. LoadMaster (formerly Kemp) is a load balancer — the appliance that spreads a website or application's incoming traffic across multiple servers. No login is required to reach that command layer.
Who's affected: Businesses, or the hosting/IT provider running their infrastructure, using a Progress LoadMaster appliance or virtual instance in front of a website or application with more than one server behind it.
What to do: If this hasn't been applied yet, it's now roughly a week past CISA's deadline — chase it down rather than assume it happened. Ask a hosting or infrastructure provider directly whether LoadMaster is in their stack and whether it's patched.
5. JetBrains TeamCity — still open, on the tool that builds and ships your team's code (CVE-2026-63077)
🛠️ JetBrains TeamCity · added 5 Aug 2026 · CISA fix-by date 8 Aug 2026 (over a week overdue)
What it is: "Deserialization of untrusted data" means the software unpacks incoming data as if it were safe, structured content, but a crafted package can make it run as code instead. TeamCity is a continuous-integration server — the system a development team points at their code repository to automatically build, test and package software before it goes live. This flaw triggers that unpacking bug with no login, through the channel TeamCity uses to talk to its build agents.
Who's affected: Businesses with an in-house or contracted development team running their own TeamCity server — common wherever a company ships its own app, website backend, or internal tooling rather than buying it off the shelf.
What to do: Update TeamCity to the version in JetBrains' advisory — this is now well past CISA's deadline. If a development team or agency builds software for you, ask whether they self-host TeamCity and whether it's patched; a compromised build server can slip malicious code into everything it ships afterward.
6–7. N-able N-central — two related bugs bypassing login on the tool your IT provider uses to manage you (CVE-2026-18577, CVE-2026-18556)
🛠️ N-able N-central · added 3–4 Aug 2026 · CISA fix-by dates 6 / 7 Aug 2026 (both now over a week overdue)
What it is: "Authentication bypass using an alternate path or channel" means there's a side door into the system that skips the normal login check entirely. N-central is an RMM ("remote monitoring and management") platform — the console an outsourced IT provider or managed service provider (MSP) uses to remotely watch over and administer their clients' computers and servers. The second flaw is a documented incomplete fix for the first, so patching just one still leaves the door open.
Who's affected: You may never have heard of N-central, but if an external IT company manages your computers, servers or network, there's a real chance they use it. One N-central instance typically controls every client an MSP looks after, so a breach here isn't limited to one business — it's a way in to all of them at once.
What to do: Ask your IT provider, in plain terms, whether they use N-able N-central and whether both fixes are applied. This is exactly the kind of software that's invisible to the business it protects — worth confirming directly rather than assuming it's covered, especially now both deadlines are well past.
8. Apache Tomcat — a fix from last year, still bypassable (CVE-2026-34486)
🛠️ Apache Tomcat · added 4 Aug 2026 · CISA fix-by date 7 Aug 2026 (over a week overdue)
What it is: "Missing encryption of sensitive data" here means a protection Tomcat added called EncryptInterceptor — designed to keep server-to-server traffic encrypted — can be sidestepped, undoing that protection. CISA notes this flaw can be chained with an older, previously fixed Tomcat bug (CVE-2025-24813) to achieve a fuller compromise, meaning last year's patch alone no longer closes the door.
Who's affected: Businesses running their own Apache Tomcat server to host a Java-based website or application — usually set up by a developer or hosting provider rather than something you'd install yourself.
What to do: Update Tomcat to the fixed version if this hasn't happened yet — it's now well past the CISA deadline. If a developer or host manages your Tomcat server, confirm this specific update sits on top of last year's fix; one without the other isn't a complete fix.
9. IBM Langflow — full remote takeover with no login, on an AI workflow tool (CVE-2026-9198)
🛠️ IBM Langflow · added 4 Aug 2026 · CISA fix-by date 7 Aug 2026 (over a week overdue)
What it is: "Code injection" means an attacker can insert their own instructions into data the application processes, and have those instructions run as if they were part of the program. Here it gives an unauthenticated outsider full remote code execution on a default Langflow install — no login, no trickery beyond sending the request. This is a separate CISA advisory (under IBM's distribution) from an unrelated Langflow flaw covered in an earlier briefing — patch each on its own, since one fix does not cover the other.
Who's affected: Businesses that have stood up Langflow (via IBM's distribution) to build internal AI chatbots or automation workflows — increasingly common as small businesses experiment with in-house AI tooling, usually self-hosted by a developer or technical staff member.
What to do: Apply IBM's fix — the deadline has already passed and no login is required to exploit it. If someone on your team or a contractor set up an AI workflow tool, check specifically which Langflow distribution it is and whether it's patched.
This is an awareness summary of public CISA KEV data, not professional security advice. CISA "fix-by" dates are US federal deadlines; for everyone else they're a strong urgency signal, not a legal obligation. Always confirm the affected versions and the fix against the vendor's own advisory.