September 2026 CVE Landscape
In September 2026, Insikt Group® identified 94 high-impact vulnerabilities to prioritize for remediation, 59 of which had a Very Critical Recorded Future Risk Score. This represents a 29% increase from last month. 43 of these vulnerabilities were surfaced through the US Cybersecurity and Infrastructure Security Agency (CISA)’s Known Exploited Vulnerabilities (KEV) catalog, 37 were reported in open sources and validated by Insikt Group, and 14 were exclusively surfaced through honeypot data.
The 94 vulnerabilities identified affected products from 58 vendors, with Linux and Microsoft together accounting for approximately 13% of the vulnerabilities. The remaining exposures spanned network edge and security management appliances; operating systems (OS) and mobile devices; collaboration, content management, and enterprise platforms; artificial intelligence (AI), developer, and automation tools; and operational technology and industrial systems.
September reporting also highlighted zero-day exploitation of CVE-2026-88771 and CVE-2026-88772 (NetScaler), as well as renewed exploitation of CVE-2026-35273 (PeopleSoft) against unpatched systems.
Quick reference: September 2026 vulnerability table
All 80 vulnerabilities below were actively exploited or operationally weaponized in September 2026. This table does not include the 14 CVEs that were exclusively surfaced through honeypot data, which are available to Recorded Future Intelligence Platform customers via the CVE Monthly report. The table below also provides examples of public PoCs identified by Insikt Group. These PoCs were not tested for accuracy or efficacy. Vulnerability management teams should exercise caution and verify the validity of PoCs before testing.
Score
Table 1: List of vulnerabilities that were actively exploited in September 2026 based on Recorded Future data (excluding honeypot-sourced CVEs).
Key trends: September 2026
- September reporting linked NightEagle and UNC3569 to GhostContainer and GRAYRABBIT deployments, while Cisco FMC exploitation by three threat clusters led to credential theft, Cyclops Blink deployment, and Qilin ransomware.
- A suspected Chinese-speaking actor used a SecFlow-based environment with Claude-, Qwen-, and DeepSeek-backed workers, and a suspected Russian-speaking actor used hundreds of AI agents to compromise at least 440 PaperCut NG/MF instances associated with 395 organizations.
- 47 of the 94 vulnerabilities enabled remote code execution (RCE). Network-edge and security-management products were the most affected product type. Apache and Google represented the largest share of vendors, with three RCE vulnerabilities each.
- Insikt Group identified public proof-of-concept (PoC) exploits or scanners for 75 of the 94 vulnerabilities identified in September.
- The most common weakness class was CWE-306 (Missing Authentication for Critical Function), with seven vulnerabilities, followed by CWE-22 (Path Traversal), with six. CWE-78 (OS Command Injection), CWE-89 (SQL Injection), and CWE-94 (Code Injection) each affected five vulnerabilities.
- Eight of the 94 vulnerabilities were at least five years old, and the oldest was approximately 12 years old.
Trend analysis
AI-assisted campaigns combine older flaws with post-compromise tooling
Insikt Group detailed a suspected Chinese-speaking actor using a SecFlow-based operations environment with Claude-, Qwen-, and DeepSeek-backed workers to support reconnaissance, exploitation, post-exploitation, and collection across Asian targets. The threat actor tested or staged workflows for CVE-2014-6271, CVE-2020-1938, CVE-2022-22965, CVE-2016-4437, CVE-2021-43798, CVE-2024-4956, CVE-2021-29441, and CVE-2021-44228. The workflow routed candidate findings to vulnerability-specific playbooks, but not every attempt produced confirmed access.
A separate September report described a suspected Russian-speaking threat actor using hundreds of AI agents in a campaign targeting PaperCut NG/MF. The campaign exploited CVE-2026-81578 and CVE-2026-82078, compromising at least 440 instances associated with 395 organizations.
Ransomware, backdoors, and data theft follow initial access
A Validated Intelligence Event detailed the exploitation of CVE-2026-20079 and CVE-2026-20316 affecting Cisco Secure Firewall Management Center (FMC) by three groups. UAT-12197 exploited CVE-2026-20079 to gain root access, deploy a JavaServer Pages (JSP) web shell and Java Archive (JAR)-based command executor, and steal authentication data. UAT-11823 exploited both flaws to establish reverse shells, exfiltrate managed-device configurations, and deploy Cyclops Blink. UAT-11988 exploited CVE-2026-20316 to deploy Qilin ransomware.
A Validated Intelligence Event linked a suspected Chinese-speaking actor to broad exploitation and targeting of internet-facing technologies beginning in May 2026. It assessed the actor as being the same as or related to Red Heron based on overlapping infrastructure, malware, and tactics, techniques, and procedures. The campaign exploited WordPress CVE-2026-63030 and CVE-2026-60137 against 49 organizations, targeted the Linux kernel through CVE-2022-0847, exploited Gitea through CVE-2026-60004, and targeted Proxmox VE CVE-2023-54391. A separate Validated Intelligence Event covered Acronis's September 13 report that Red Heron exploited CVE-2026-60004 against eleven critical-infrastructure organizations and used the resulting access for persistence, repository and database theft, credential collection, and lateral movement.
A separate Validated Intelligence Event reported that NightEagle deployed the GhostContainer backdoor on Microsoft Exchange servers associated with Russian companies. Kaspersky reported that the group used compromised virtual private network credentials, extracted Exchange cryptographic keys, modified VIEWSTATE, and executed GhostContainer in memory. In one incident, NightEagle exploited CVE-2019-0708 (BlueKeep) to create a local account with administrative and remote-access privileges, then used tunneling tools, Remote Desktop Protocol, and Impacket to enable lateral movement and maintain access.
Another Validated Intelligence Event described UNC3569's active exploitation of CVE-2026-51990 affecting Tencent Sogou Input Method. The one-click chain used a crafted custom-protocol link and an outdated embedded Chromium engine, including CVE-2021-38003, to execute shellcode and deploy the GRAYRABBIT backdoor. GRAYRABBIT supports process execution, reverse shell access, file transfer, system reconnaissance, and the reflective loading of additional modules.
Public exploit research highlights edge and management platform exposure
A TTP Instance detailed CVE-2026-88771, an improper input validation vulnerability in NetScaler ADC and NetScaler Gateway that can enable unauthenticated root command execution. GreyNoise observed attempts to install a web shell and establish privileged access, although the threat actor did not gain a foothold on its monitored sensor. A separate TTP Instance detailed CVE-2026-88772, a separate NetScaler memory-corruption vulnerability affecting appliances with Datagram Transport Layer Security (DTLS) enabled. Citrix confirmed exploitation, while watchTowr shared a script to detect the vulnerability.
A TTP Instance also detailed an alleged PoC for CVE-2026-86218, a static code injection vulnerability in N-able N-central. A Metasploit pull request by Rapid7 reported unauthenticated command execution with the affected service account’s privileges and disruption of an application feature until restart.
Another TTP Instance detailed CVE-2026-94127, a heap-based buffer overflow in F5 BIG-IP Access Policy Manager (APM) that can enable unauthenticated RCE when the product is configured as an OAuth Authorization Server with the relevant access policy and OAuth profile; watchTowr shared a script to detect the vulnerability.
A TTP Instance detailed CVE-2026-35273, a missing authentication vulnerability in Oracle PeopleSoft Enterprise PeopleTools. Mandiant and Google Threat Intelligence Group reported that UNC6240, also known as ShinyHunters, exploited exposed PeopleSoft environments to execute commands, deploy web shells, install the SIDEEYE backdoor and MeshAgent, and establish tunnels for internal discovery and lateral movement. An alleged public PoC separately claimed server-side request forgery (SSRF) and cloud execution capabilities that Insikt Group had not tested.
Additional trends and analyses from September are available to Recorded Future customers.
Take action
Timely and relevant information on vulnerabilities in your environment and that of your vendors and suppliers is critical for reducing risk. Find out how Recorded Future can support your team by increasing visibility, improving efficiency, and enabling confident decisions.
Vulnerability Prioritization – Prioritize vulnerabilities based on the likelihood of exploitation – not just the severity. Easily understand the risk of exploitation alongside severity, and real-time contextualized intelligence to help you quickly make confident decisions, patch what matters, and prevent attacks.
Attack Surface Intelligence – Identify internet-facing assets vulnerable to a specific CVE. Attack Surface Intelligence provides an outside-in view of your organization to help you actively discover, prioritize, and respond to unknown, vulnerable, or misconfigured assets.
Third-Party Risk – Gain an external view of the security posture of your vendors and partners. Eliminate time-consuming research and vendor communication cycles with the ability to promptly assess vulnerabilities in their internet-facing systems.
Insikt Group® – Receive access to exclusive reports on new vulnerabilities and trends from Recorded Future’s team of experts, the Insikt Group®. Download Nuclei templates created by Insikt Group® for select CVEs to detect actively exploited vulnerabilities.
Recorded Future Professional Services – Work with our Professional Services team on a Vulnerability Analysis Engagement. Designed to equip your team with advanced strategies for identifying, prioritizing, and mitigating threats effectively, this program delves into technologies and operations essential for a successful vulnerability management program. (Learn more about how our Professional Services team can help elevate your team by watching our recent Vulnerability Prioritization Workshop.)
About Insikt Group®
Recorded Future’s Insikt Group, the company’s threat research division, comprises analysts and security researchers with deep government, law enforcement, military, and intelligence agency experience. Their mission is to produce intelligence that reduces risk for customers, enables tangible outcomes, and prevents business disruption.
Related Resources
Explore expert insights, reports, and tools to strengthen your cybersecurity strategy.