What official US actions just put on the lookback list
OFAC · CISA KEV · 4 sources
What's on the official record
12 August — an enforcement settlement. OFAC announced a $60,764 settlement with Rice Lake Weighing Systems, Inc. (Wisconsin). OFAC says Rice Lake’s Italian subsidiary, Dini Argeo S.r.l., exported weighing equipment to a UAE distributor between July 2019 and November 2021 knowing the goods were destined for Iran. OFAC treated the case as voluntarily self-disclosed and non-egregious.
7 August — Iran commercial + CT exchange names. OFAC added individuals and entities under Iran secondary-sanctions and counter-terrorism authorities. The commercial set includes UAE general-trading companies, Hong Kong traders in Kwun Tong industrial buildings, a Singapore PTE, and Iran-linked exchange names (including Aban Tether and Titan Exchange). The CT set includes UAE DMCC crypto names, a Georgia-registered Shelbit vehicle, and a Polish Shelbit company in liquidation, with published digital-currency addresses.
6 August — Cuba technical import and military industry. OFAC designated Cuban state technical-import companies (including Tecnotex and Tecnoimport), military-industry names (UIM, EMI Yuri Gagarin), Duna SA, and several individuals, with a State Department release on enablers of Cuban arms imports and foreign military cooperation. Two existing GLOMAG listings were updated onto the Cuba EO program.
11 August — KEV, internet-facing. CISA added actively exploited vulnerabilities in Metabase (unauthenticated SQL injection, CVE-2026-72898), Cisco ASA/FTD VPN (remote DoS, CVE-2026-20349), and a local Windows WinSock elevation (CVE-2026-68820). LoadMaster command injection (CVE-2026-8037) landed 7 August. Federal civilian due dates on the unauthenticated pair were 14 August.
Assessment
For a sanctions committee, the 6–12 August window added names and a diversion pattern. Rice Lake is the path (EU subsidiary → UAE distributor → Iranian end-user). The 7 August Iran/CT set is a vehicle-class refresh — published legal names and digital-currency addresses go on the next list pull. The 6 August Cuba adds are specific SOEs (Tecnotex, Tecnoimport, UIM, EMI Yuri Gagarin, Duna SA).
For a country GM/CFO, the 11 August KEV cluster is the estate question. Metabase and Cisco ASA/FTD change a remote-access and analytics posture. That is a facilities question sitting next to the sanctions lookback.
For a vendor/platform, run the new OFAC names and addresses through the next list refresh, and ask whether Metabase or Cisco ASA/FTD sit on the estate. A clean SDN pull does not close the KEV item.
What would change this call
| Forecast | Hit if | Miss if |
|---|---|---|
| The 6–12 August OFAC titles and the 11 August KEV cluster remain the live lookback window | Those notices stay the latest titles on this book through the next pull | OFAC or CISA posts a newer title that adds, removes, or replaces names or CVEs on this book |
What to check next
| Open question | What it takes | Where that comes from |
|---|---|---|
| Does a counterparty look like the Rice Lake fact pattern (EU manufacturing subsidiary, UAE distributor, Iranian end-user)? | Re-screen against the 12 August settlement | https://ofac.treasury.gov/recent-actions/20260812 |
| Did the 7 August legal names and digital-currency addresses hit this book? | The next list refresh | https://ofac.treasury.gov/recent-actions/20260807 |
| Does the book touch Cuban spare parts, dual-use equipment, or military-adjacent procurement? | The next SDN file against Tecnotex, Tecnoimport, UIM, EMI Yuri Gagarin, and Duna SA | https://ofac.treasury.gov/recent-actions/20260806 |
| Do Metabase or Cisco ASA/FTD sit on the estate? | Inventory + network path | CISA KEV catalog |
| Did this payment or shipment hit a new name or address? | Customer file + current list / wallet screen | Operator file; then a known institutional firm once the committee needs the name |
| Who owns the UAE distributor or HK trader? | Corporate records, possibly field work | An investigations or corporate-integrity firm |
| Is a discrete dated policy event hedgeable (license drop, corridor close)? | Event definition + notional | A priced-event specialist, privately |
Confidence
High on what OFAC and CISA published. Medium on how widely the new Iran/CT vehicles already sit in correspondent books — that needs a file. A local sanctions snapshot last built 11 July 2026 is not the source for the names above. Those names come from the August notices.
Sources
[1] OFAC, Settlement Agreement with Rice Lake Weighing Systems, Inc., 12 Aug 2026. https://ofac.treasury.gov/recent-actions/20260812
[2] OFAC, Counter Terrorism and Iran-related Designations; Counter Narcotics Designations Removals, 7 Aug 2026. https://ofac.treasury.gov/recent-actions/20260807
[3] OFAC, Cuba-related Designations, 6 Aug 2026. https://ofac.treasury.gov/recent-actions/20260806
[4] CISA, Known Exploited Vulnerabilities Catalog (entries dated 7–11 Aug 2026). https://www.cisa.gov/known-exploited-vulnerabilities-catalog