2026-W32 vulnerability status roll-up — seven CVEs and one unnumbered zero-day stood at confirmed exploitation, five of them newly catalogued this week, against a critical tail concentrated on management planes and on products whose vendors have stopped shipping fixes

This roll-up carries only each vulnerability's trajectory across ISO week 2026-W32; the mechanics, exploitation detail and defender guidance live in the referenced operational entries.

Crossed into confirmed exploitation this week. CISA added three flaws to its Known Exploited Vulnerabilities catalogue on 4 August — the N-able N-central authentication bypass CVE-2026-18556, the Apache Tomcat EncryptInterceptor bypass CVE-2026-34486 and the IBM Langflow code-injection path CVE-2026-9198 (CISA, 2026-08-04) — followed by the JetBrains TeamCity deserialization flaw CVE-2026-63077 on 5 August (CISA, 2026-08-05) and the Progress Kemp LoadMaster command injection CVE-2026-8037 on 7 August (CISA, 2026-08-07). Three of those five are status changes on ground this pipeline had already covered as unexploited: TeamCity was patch-available on 29 July with JetBrains recording no known exploitation, LoadMaster's only observed activity on 2 July was attempts eSentire reported as unsuccessful, and the Tomcat listing arrived months after the exploitation itself. Each of the three therefore converts an upgrade task into a compromise-assessment task for any instance that was internet-reachable during its window. The Langflow listing is the third confirmed-exploited pre-authentication path in that one product inside three weeks, which turns the question from patching a CVE into removing the product's internet exposure.

Exploited without a catalogue entry. Two of the week's confirmed-exploited flaws are invisible to a KEV-driven process. Coinspect traced an active wallet-drain campaign to a weak pseudo-random generator, stating that "attackers were already exploiting it while our investigation was underway" (Coinspect Security, 2026-08-05); the advisory record identifies the affected code as crypto-js before 4.0.0 under CVE-2026-71851 (GitHub Advisory Database, 2026-08-07). The identifier exists but the flaw is not catalogued as exploited, and the scope rule is what makes it broad — any application that used the function to produce a key, token, session identifier or reset code inherits the weakness, and no upgrade repairs a secret already generated. The Metabase SQL-injection zero-day has no CVE identifier at all, and two customers — the laptop maker Framework and the form builder Tally — have confirmed data was taken from their instances on 3 August (BleepingComputer, 2026-08-07).

The critical tail: management planes, and vendors who have stopped. The unexploited-but-severe set concentrates on the planes that administer everything else — Cisco Secure Firewall Management Center at CVSS 10.0, unpatched for five months before per-train hot fixes arrived, with an accompanying compromise check the vendor has repeatedly revised — the advisory stood at version 2.4, last updated 5 August, when checked at the close of the week (Cisco PSIRT, 2026-08-05); Check Point Security Management, taking its fourth CVE on that surface in roughly two weeks and its second authentication bypass, with seven end-of-support trains listed as affected and no fix on offer; WALLIX Bastion, whose REST API hands full product-administrator control of a privileged-access vault to an unauthenticated caller at CVSS 4.0 base 10.0, with the reporting researchers stating they intend to publish full technical details in September 2026; and Veeam ONE's CVE-2026-64633, an unauthenticated CVSS 10.0 remote code execution on the agent host, sitting over the backup estate ransomware operators attack before they encrypt. Alongside them, five products have no fix to apply and will not get one: the Zbtlink routers shipping a factory-installed root backdoor whose remedy is replacement, the CPDLC air-traffic data link whose flaws are properties of the standard, Flowise's three new CVEs landing days after its vendor announced a wind-down, Tobit TeamDavid's 22 CVEs naming no fixed release against roughly 12,000 internet-facing instances, and Check Point's end-of-support trains.

Status table

Trajectory only — affected and fixed versions, CVSS and exploitation mechanics live in each referenced entry.

Corrected this week. The Thermo Fisher genetic-analyzer integrity flaw CVE-2026-17583 was reported here on 5 August as having no vendor fix; the cited advisory in fact names patched software for five product lines, with only three end-of-life instrument families left without an update. Separately, a July weekly's claim that ten CVEs across four product classes were all KEV-listed was wrong for two of them — the Progress ShareFile chain CVE-2026-2699 and CVE-2026-2701 have never been added. Both corrections shipped as their own entries and are reflected in the records above.