Zero-Day Tracker 2026
Last updated: August 9, 2026 | Update cadence: Weekly (every Sunday); within 24 hours of any CISA KEV addition flagged as exploited before a patch existed, and within 48 hours of a vendor advisory confirming in-the-wild exploitation. | Maintained by: Axis Intelligence Research & Marcus Chen
Quick Answer: What Is Currently Being Exploited as a Zero-Day?
Five confirmed zero-day exploitations are logged in this tracker as of August 9, 2026, each verified against the vendor’s own advisory. The most recent is CVE-2026-20316, a static-credential flaw in Cisco Secure Firewall Management Center, which Cisco confirmed was under active exploitation in July 2026. Axis Intelligence Research finds a baseline Score–Deadline Divergence of −1.45 across the four entries governed by CISA’s BOD 26-04.
Key Findings
According to Axis Intelligence Research, four of the five logged zero-days carry a federal remediation deadline shorter than the vendor’s own CVSS score would suggest.
CISA assigned a three-day remediation window to CVE-2026-20316, CVE-2026-56164 and CVE-2026-35616, against the twenty-one-day window it assigned to CVE-2026-2441 in February 2026.
Microsoft scored CVE-2026-56164 at 5.3 as CVE Numbering Authority, while NIST’s National Vulnerability Database scored the same flaw at 9.8 — a 4.5-point divergence on a single record.
Cisco stated in advisory cisco-sa-fmc-static-cred-BET3Cjh that it assigned CVE-2026-20316 a Security Impact Rating of High rather than Medium because the score understates how the flaw chains with other Secure FMC vulnerabilities.
Google patched CVE-2026-2441 two days after Shaheen Fazim reported it, shipping a Stable channel update on February 13, 2026 that contained one security fix and nothing else.
How We Curate This List
The inclusion test is narrow on purpose, because “zero-day” is the most abused word in this sector.
What counts. A vulnerability enters this tracker when the vendor or a government catalog states that exploitation occurred in the wild before a fix was generally available, and when that statement appears in a document we fetched and read. Every row carries the advisory URL and the date we retrieved it.
What does not count. A critical CVSS score with no exploitation evidence. A proof-of-concept published after the patch. A vendor saying it is “aware of reports.” An n-day exploited weeks after a patch shipped — that is a patching failure, not a zero-day, and conflating the two is how vendor marketing inflates the category. CVE-2026-2441 sits in this tracker because Google wrote that an exploit existed in the wild; the public proof-of-concept that NVD referenced a week later is recorded but is not what qualified it.
Source hierarchy. Vendor PSIRT advisories first — Cisco Security Advisories, FortiGuard PSIRT, MSRC, Chrome Releases. NIST’s NVD record second, used for CVSS provenance, CWE assignment and CISA KEV dates. Security-vendor blogs and trade press are used only to locate those documents, never to supply a figure.
One documented exclusion. CVE-2026-21509, the Microsoft Office security-feature bypass patched out-of-band in January 2026, meets the editorial test but is not logged. Every figure available to us for it — the 7.8 score, the February 16 deadline — sits in secondary reporting, and the primary record did not resolve during this build. It will be added once the MSRC or NVD record is read directly. A tracker that publishes what it could not open is not a dataset.
One correction we are already carrying. Several outlets reported the Linux fix for CVE-2026-2441 as Chrome 144.0.7559.75. Google’s own release note gives 145.0.7632.75 for Linux. Anyone building patch-compliance thresholds from the secondary reporting set the wrong floor.
The Axis Score–Deadline Divergence (SDD)
CVSS tells you how bad a flaw is in the abstract. A CISA remediation deadline tells you how fast the U.S. government thinks you need to fix it. SDD measures the gap between the two, and the gap turns out to be large and pointed in a consistent direction.
Formula. For each entry, SDD = (vendor CNA CVSS v3.1 base score) − (Axis Deadline-Implied Severity).
Deadline-Implied Severity is an Axis construction, disclosed here in full so anyone can recompute it: a KEV remediation window of 3 days or fewer maps to 9.0; 4–7 days to 8.0; 8–14 days to 7.0; 15–21 days to 6.0. A negative SDD means the vendor scored the flaw lower than the federal deadline implies.
| CVE | Vendor CNA base score | KEV window (days) | Deadline-implied severity | SDD |
|---|---|---|---|---|
| CVE-2026-20316 | 5.3 | 3 | 9.0 | −3.7 |
| CVE-2026-56164 | 5.3 | 3 | 9.0 | −3.7 |
| CVE-2026-56155 | 7.8 | 14 | 7.0 | +0.8 |
| CVE-2026-35616 | 9.8 | 3 | 9.0 | +0.8 |
| Baseline mean (n=4) | 5.75 | −1.45 |
Source: Axis Intelligence Research, computed from vendor advisories and NVD records retrieved August 9, 2026.
This is the inaugural reading and the baseline; there is no prior history, because the metric did not exist before this page.
Read the table by rank rather than by row and the finding sharpens. The two lowest-scored entries drew the shortest deadline. Microsoft called the SharePoint flaw a 5.3 and CISA gave federal agencies until July 17 — three days. Microsoft called the AD FS flaw a 7.8 and CISA gave until July 28 — fourteen. The score and the deadline moved in opposite directions, which is what you would expect if the deadline is being set by exploitation reality and the score by an impact model that never sees an attacker.
What SDD does not capture. It ignores installed base, internet exposure, and whether an exploit is automatable. It uses the CNA score, not NVD’s, because the CNA score is the one the vendor chose to publish and therefore the one being tested. It says nothing about vulnerabilities never added to KEV.
Why CVE-2026-2441 is excluded. Its KEV entry predates BOD 26-04 and carries the legacy twenty-one-day window, so folding it in would average two different regulatory regimes into one number. Publishing it separately is more honest than merging it: the Chrome entry’s twenty-one days against the later cohort’s mean of 5.75 days is the regime change, and averaging would hide it.
Tracker Entries
CVE-2026-20316 — Cisco Secure Firewall Management Center · July 29, 2026
Cisco published advisory cisco-sa-fmc-static-cred-BET3Cjh on July 29, disclosing static user credentials for a low-privileged account in the Secure FMC web interface. An unauthenticated remote attacker can simply log in with them. Cisco stated that its PSIRT became aware of active exploitation in July 2026, and that no workarounds exist — only per-train hot fixes for 7.0, 7.2, 7.4, 7.6, 7.7 and 10.0.
The score says 5.3, Medium. Cisco overrode its own score and rated the advisory High, writing that the flaw can be combined with other Secure FMC vulnerabilities to elevate privileges. That is a vendor telling you, in the advisory, that CVSS is measuring the wrong thing — a firewall management plane is not a place where “low-privileged read access” stays low-privileged.
Unusually, Cisco shipped indicators of compromise: a zgrep against /var/log/messages* for a package_info invocation referencing /var/tmp/license.tmp. Cisco also warns that the hot fixes prevent future exploitation and may not address an existing compromise. Credited to Jimi Sebree of Horizon3.ai.
KEV added July 29, due August 1. Primary source: Cisco Security Advisory cisco-sa-fmc-static-cred-BET3Cjh · NVD record
CVE-2026-56164 — Microsoft SharePoint Server · July 14, 2026
A missing-authentication flaw (CWE-306) in on-premises SharePoint Server, exploited before the July Patch Tuesday shipped. Unauthenticated, network-reachable, no user interaction. Affected builds: SharePoint Enterprise Server 2016 below 16.0.5561.1001, Server 2019 below 16.0.10417.20175, and Subscription Edition below 16.0.19725.20434.
The scoring split on this record is the sharpest in the tracker. Microsoft, as CNA, published 5.3 with a vector claiming no confidentiality impact and only low integrity impact. NIST’s analysts scored it 9.8, with High across confidentiality, integrity and availability. Same flaw, same day, two national-scale data sources, a 4.5-point gap. CISA’s SSVC assessment recorded exploitation as active and automatable. A defender pulling severity from the vendor feed and a defender pulling from NVD triaged this vulnerability into completely different queues.
CISA gave three days — added July 14, due July 17.
Primary source: MSRC Security Update Guide, CVE-2026-56164 · NVD record
CVE-2026-56155 — Microsoft Active Directory Federation Services · July 14, 2026
Insufficient granularity of access control (CWE-1220) in AD FS, allowing an already-authorized attacker to elevate privileges locally. Microsoft scored it 7.8 with a local attack vector and low privileges required. Affected builds span Windows Server 2012 through Server 2025.
Local privilege escalation on an identity provider is not a second-tier problem. AD FS mints the tokens the rest of the estate trusts; an attacker who reaches it does not need another remote exploit, because everything downstream already believes what it says. CISA’s SSVC assessment marked technical impact as total but automatable as no — which is the likeliest explanation for the fourteen-day window here against three days for the SharePoint flaw scored 2.5 points lower.
KEV added July 14, due July 28.
Primary source: MSRC Security Update Guide, CVE-2026-56155 · NVD record
CVE-2026-35616 — Fortinet FortiClient EMS · April 4, 2026
An improper access control flaw (CWE-284) in the FortiClient EMS API. Crafted requests bypass authentication and authorization entirely. Fortinet’s advisory FG-IR-26-099 states plainly that it observed exploitation in the wild, and shipped a hotfix for 7.4.5 and 7.4.6 ahead of the permanent fix in 7.4.7. Versions 7.2 and 8.0 are unaffected; FortiClient Cloud and FortiSASE were remediated vendor-side. Credited to Simo Kohonen of Defused and Nguyen Duc Anh.
A note on the score, because the published figures do not agree and the reason is methodological. FG-IR-26-099 displays 9.1. NVD shows Fortinet’s CNA submission as 9.8. Both are correct: the advisory’s own vector string is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C, so 9.1 is the temporal score — discounted for the fact that an official fix now exists — while 9.8 is the base score of the identical vector. Reporting that treated this as NVD disagreeing with Fortinet described a dispute that is not there. This tracker records the base score, because temporal scores drift as remediation status changes and are not comparable across entries.
KEV added April 6, due April 9.
Primary source: FortiGuard PSIRT FG-IR-26-099 · NVD record
CVE-2026-2441 — Google Chrome · February 13, 2026
A use-after-free in Chrome’s CSS handling (CWE-416), reachable through a crafted HTML page and exploitable for arbitrary code execution inside the renderer sandbox. Google’s release note carried one line that matters: it was aware an exploit existed in the wild. Shaheen Fazim reported it on February 11; the Stable channel update shipped on February 13. Two days, and the release contained a single security fix — Google emptied the queue for this one bug.
Fixed builds are 145.0.7632.75/76 for Windows and Mac and 145.0.7632.75 for Linux. NVD scored it 8.8; Google, as CNA, published no CVSS score at all, which is standard Chrome practice and means every severity number attached to this CVE in the wild originates with NIST or CISA rather than the vendor.
A public proof-of-concept appeared on GitHub and was added to the NVD record on February 20 — seven days after the patch, and eighteen days before the federal deadline of March 10.
KEV added February 17, due March 10 — twenty-one days, under the pre-BOD 26-04 regime.
Primary source: Chrome Releases, Stable Channel Update for Desktop, February 13, 2026 · NVD record
<details> <summary><strong>Archive: entries older than the current calendar year</strong></summary>
No archived entries. This tracker was established August 9, 2026 and its earliest logged entry is CVE-2026-2441 (February 13, 2026). Entries will move here on January 1, 2027. </details>
Methodology
Axis Intelligence Research builds each row from the vendor’s own security advisory, fetched and read during the production session, with the retrieval date logged in the dataset. The NVD record supplies CVSS provenance (which body assigned which score), CWE assignment, and CISA KEV addition and due dates.
Two access constraints are worth stating, because they shape the dataset. First, cisa.gov blocks automated retrieval, so KEV dates are taken from the NVD record’s KEV section — NIST republishes CISA’s fields verbatim, and both are U.S. government sources. Second, the MSRC Security Update Guide is a JavaScript application that returns no content to a fetcher; Microsoft CNA scores and vectors in this dataset are therefore read from the NVD record, which logs them as received from Microsoft Corporation with a timestamp.
The remediation window is calculated as (KEV due date − KEV date added) in calendar days. Deadline-Implied Severity and SDD are Axis calculations, flagged axis_calculated = yes in the dataset with a method_note pointing back to this section. Every SDD value in this article was recomputed from the CSV during the verification pass.
Limitations. Five entries is a small cohort, and the baseline SDD of −1.45 should be read as a starting point rather than a trend. The tracker covers vulnerabilities with a public CVE and a vendor advisory; exploitation that never reaches disclosure is invisible to it, as it is to every public dataset. KEV inclusion reflects CISA’s prioritisation of federal risk, which is not identical to enterprise risk.
About This Dataset
zero-day-tracker-august–9-2026.csv contains all five entries with full provenance columns: source_org, source_document, source_url, nvd_record_url, retrieved_date, is_primary, axis_calculated, method_note and verification_flag.
Released under CC BY 4.0.
Temporal coverage: February 13, 2026 to August 9, 2026.
Spatial coverage: global.
Citation: Axis Intelligence Research, Zero-Day Tracker: Actively Exploited Vulnerabilities, 2026.
- APA: Axis Intelligence Research. (2026). Zero-day tracker: Actively exploited vulnerabilities. https://axis-intelligence.com/zero-day-tracker/
- MLA: Axis Intelligence Research. “Zero-Day Tracker: Actively Exploited Vulnerabilities.” Axis Intelligence Research, 2026.
- Chicago: Axis Intelligence Research. “Zero-Day Tracker: Actively Exploited Vulnerabilities.” 2026. https://axis-intelligence.com/zero-day-tracker/
Frequently Asked Questions
What is a zero-day vulnerability?
A zero-day is a vulnerability exploited by attackers before the vendor has a fix generally available — the defender has zero days to patch. Once a patch exists and attacks continue, the correct term is n-day exploitation.
How many zero-days have been exploited in 2026?
This tracker logs five confirmed cases as of August 9, 2026, each verified against the vendor’s advisory. It records vulnerabilities with a public CVE, a vendor advisory, and a vendor or government statement of pre-patch exploitation, so it is a floor rather than a total.
How fast does CISA require federal agencies to patch a zero-day?
Under BOD 26-04, the four most recent entries here carry a mean remediation window of 5.75 days, with three of the four set at three days. CVE-2026-2441, added under the earlier BOD 22-01 regime in February 2026, carried twenty-one days.
Why do vendor and NVD severity scores disagree?
The CVE Numbering Authority — usually the vendor — assigns a score first, and NIST analysts may assign their own during enrichment. On CVE-2026-56164, Microsoft published 5.3 and NIST published 9.8 for the same flaw. Check which source your vulnerability feed uses before treating a score as authoritative.
Is CVSS a reliable way to prioritise zero-day patching?
Not on its own. Two entries scored 5.3 by their vendors drew three-day federal deadlines, while an entry scored 7.8 drew fourteen days. Exploitation status and exposure predicted urgency better than the base score did.