# Newly exploited vulnerabilities: week of 3 to 9 August 2026 (week 32)

Source: https://junglewise.ai/threats/exploited/2026-08-03  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2 October 2026, 19:23 UTC. Final: it does not change.  
Data: https://junglewise.ai/threats/exploited/2026-08-03.json  
License: CC BY 4.0 with a link back

In the week of 3 to 9 August 2026, 6 vulnerabilities were newly recorded as exploited in the wild, 6 of them critical. The technology hit most was N-able N-central (2), followed by Apache Software Foundation Apache Tomcat Tribes (1) and Apache Tomcat (1).

## Newly exploited this week

- [CVE-2026-8037: Progress LoadMaster OS command injection in API](https://junglewise.ai/threats/cve-2026-8037-progress-loadmaster-os-command-injection-in-api) (critical, exploited in the wild, CVSS 9.6, exploited since 7 Aug 2026, published 4 Jun 2026)
- [CVE-2026-63077: JetBrains TeamCity remote code execution in agent polling protocol](https://junglewise.ai/threats/cve-2026-63077-jetbrains-teamcity-remote-code-execution-in-agent-polling) (critical, exploited in the wild, CVSS 9.8, exploited since 5 Aug 2026, published 27 Jul 2026)
- [CVE-2026-18556: Authentication bypass using an alternate path or channel vulnerability in N-able N-central allows Authentication Bypass…](https://junglewise.ai/threats/cve-2026-18556-n-able-n-central-authentication-bypass-via-alternate-path) (critical, exploited in the wild, CVSS 7.4, exploited since 4 Aug 2026, published 1 Aug 2026)
- [CVE-2026-9198: IBM Langflow OSS remote code execution via auto-login bypass](https://junglewise.ai/threats/cve-2026-9198-ibm-langflow-oss-remote-code-execution-via-auto-login-bypass) (critical, exploited in the wild, CVSS 9.8, exploited since 4 Aug 2026, published 17 Jul 2026)
- [CVE-2026-34486: Apache Tomcat encryption bypass in EncryptInterceptor](https://junglewise.ai/threats/cve-2026-34486-apache-tomcat-encryption-bypass-in-encryptinterceptor) (critical, exploited in the wild, CVSS 7.5, exploited since 4 Aug 2026, published 9 Apr 2026)
- [CVE-2026-18577: An incomplete patch for allows for authentication bypass and account takeover in N-central Versions through 2026.3.1](https://junglewise.ai/threats/cve-2026-18577-n-able-n-central-authentication-bypass-and-account-takeover) (critical, exploited in the wild, CVSS 8.1, exploited since 3 Aug 2026, published 2 Aug 2026)

## Technologies hit most

1. [N-able N-central](https://junglewise.ai/threats/technologies/n-central): 2 vulnerabilities
2. Apache Software Foundation Apache Tomcat Tribes: 1 vulnerability
3. [Apache Tomcat](https://junglewise.ai/threats/technologies/tomcat): 1 vulnerability
4. [IBM Langflow](https://junglewise.ai/threats/technologies/langflow-oss): 1 vulnerability
5. [Jetbrains TeamCity](https://junglewise.ai/threats/technologies/teamcity): 1 vulnerability
6. [Progress ADC](https://junglewise.ai/threats/technologies/adc): 1 vulnerability
7. Progress Connection Manager for ObjectScale: 1 vulnerability
8. Progress ECS Connection Manager: 1 vulnerability
9. Progress LoadMaster: 1 vulnerability

## Sources

NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Newly exploited vulnerabilities: week of 3 to 9 August 2026 (week 32)", https://junglewise.ai/threats/exploited/2026-08-03, 2 October 2026.