Notifications
Clear all
Topic starter
04/09/2026 6:35 pm
TL;DR: Attackers are moving from patch to exploitation in about three days, with four of five critical flaws already confirmed in the wild and CISA adding three CVEs to KEV on 11 August 2026, according to FireCompass’s weekly analysis. The operational lesson is that internet reachability and exploit timing now outweigh raw CVSS when patching priorities are set.
NHIMG editorial — based on content published by FireCompass: August 2026 critical CVEs and exploitation timing
By the numbers:
- CISA added 3 vulnerabilities to its Known Exploited Vulnerabilities catalog between 10 and 16 August 2026.
- 5 newly disclosed CVEs reached CVSS 9.0 or above in the window, all of them in SAP’s 11 August Patch Day.
- More than 4,200 internet-exposed SAP Commerce Cloud instances were counted by Shadowserver.
Questions worth separating out
A: Patch the exploited issue first, then verify coverage across every affected build and endpoint that can reach privileged functions.
Q: Why do internet-facing application flaws often become identity risks?
A: Because web application compromise frequently exposes the components attackers need to reach identity controls, including configuration files, session tokens, admin interfaces, or service credentials.
Q: How can security teams tell whether a patch window is too slow for the current threat level?
A: If exploitation appears within days of disclosure, the patch window is already too slow for normal change cycles.
Practitioner guidance
- Prioritise patching by exploitability and reachability Create a triage queue that ranks unauthenticated internet-facing CVEs above local or authenticated issues, even when the latter have similar or higher CVSS scores.
- Validate external exposure before remediation Use continuous external attack surface testing to confirm which SAP, Metabase, VPN, and similar services are reachable from the public internet and exploitable in their current state.
- Revoke and rotate credentials in exposed platforms After patching applications that store database credentials, API keys, or admin sessions, revoke active sessions and rotate any secrets the platform can access or display.
What's in the full analysis
FireCompass' full report covers the operational detail this post intentionally leaves for the source:
- Per-CVE remediation guidance for SAP Commerce Cloud, Metabase, Cisco ASA/FTD, Windows, and Zoom.
- Exploit timing, exposure counts, and prioritisation logic that explain why one flaw ranks ahead of another.
- Patch and mitigation specifics such as SAP Security Note 3771065, endpoint blocking, and edge filtering.
- Advisory-by-advisory context for the CISA KEV additions and federal remediation timelines.
👉 Read FireCompass' analysis of the August 2026 critical CVE week →
Critical CVEs in 72 hours: what should patch teams do first?
Explore further
04/09/2026 6:35 pm
Exposure time, not CVSS alone, is now the governing variable. This week’s evidence shows that a CVSS 10.0 flaw can be less urgent than a slightly lower-scoring issue if the latter is already being exploited on the public edge. That is the practical logic behind modern patch triage, and it aligns with NIST CSF and NIST SP 800-53 control thinking around exposure, monitoring, and remediation. Practitioners should rank by reachability, exploitation evidence, and blast radius, not by score alone.
A few things that frame the scale:
- 85% of organisations lack full visibility into third-party vendors connected via OAuth apps, according to The State of Non-Human Identity Security.
- A separate finding from our research shows only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
A question worth separating out:
A: They should do both, but external attack surface management should come first for internet-facing systems. Scanners tell you what is vulnerable; exposure management tells you what an attacker can actually reach. Without that distinction, teams spend time patching assets that are not exposed while missing the systems most likely to be attacked.
👉 Read our full editorial: Internet-facing critical CVEs are being exploited within 72 hours
