cve recordexploit reported

CVE-2026-21858

CVSS—

Severitynone

Weakness—

EPSS78.2%99.6th percentile

Exploited1 KEV source

patch window

Called exploited 1 day after disclosure.

Measured from the CVE publication date to the earliest of 1 KEV catalogue that list it.

The life of this vulnerability

CVE publishedJan 8, 2026
First KEV listingJan 9, 20261d
Last sightingSep 4, 20268mo

Gaps are compressed to equal steps. The elapsed time is printed under each.

Which catalogues call it exploited

CISA KEVUS federaldoes not list it
EUVDENISA, European Uniondoes not list it
VulnCheck KEVcommercial researchlisted Jan 9, 2026
CIRCLaggregator, mirrors the abovelisted Jan 27, 2026, not counted

Sources1 of 3

Listings differ by—

Strongest claimconfirmed

This rests on a single catalogue. No second catalogue corroborates the claim that it is being exploited. CIRCL is an aggregator and is not counted.

Public exploitation evidence

reported exploitationSep 4, 2026dashboard.shadowserver.org/statistics/honeypot/vulnerability
reported exploitationSep 2, 2026dashboard.shadowserver.org/statistics/honeypot/vulnerability
reported exploitationSep 1, 2026dashboard.shadowserver.org/statistics/honeypot/vulnerability
reported exploitationAug 29, 2026dashboard.shadowserver.org/statistics/honeypot/vulnerability
reported exploitationAug 23, 2026dashboard.shadowserver.org/statistics/honeypot/vulnerability
reported exploitationAug 21, 2026dashboard.shadowserver.org/statistics/honeypot/vulnerability

136 public reports collected from VulnCheck and CIRCL, first on Jan 9, 2026. Each links to its original source. We have not verified them.

Description

References

← Back to the CVE Tracker

Our coverage of CVE-2026-21858

CVE-2025-3248Aug 15, 2026

The Agentic AI threat cluster: Seven incidents, three actors, and what they mean for your exposure

Since late July 2026, a cluster of seven incidents involving autonomous or semi-autonomous AI systems deployed for offensive cyber operations has been tracked, indicating a shift from theoretical risk to operational reality. The most prominent of these, confirmed by Taiwan’s Ministry of Digital Affairs on August 13, 2026, involved a near-autonomous AI cyberattack against government infrastructure.

CVE-2026-33017Jul 31, 2026high

Chinese Hacker Uses DeepSeek AI to Orchestrate Vulnerability Exploits

A Chinese threat actor has reportedly leveraged large language models (LLMs), including DeepSeek AI's Hermes Agent, to automate and accelerate vulnerability exploitation campaigns against internet-exposed infrastructure in Asia. The actor, known by the aliases 'knaithe' and 'KnYuan' and believed to be based in Zhuhai, China, is described as an opportunistic exploit operator and binary security…