September 2026 CVE Landscape
In September 2026, Insikt Group® identified 94 high-impact vulnerabilities to prioritize for remediation, 59 of which had a Very Critical Recorded Future Risk Score. This represents a 29% increase from last month. 43 of these vulnerabilities were surfaced through the US Cybersecurity and Infrastructure Security Agency (CISA)’s Known Exploited Vulnerabilities (KEV) catalog, 37 were reported in open sources and validated by Insikt Group, and 14 were exclusively surfaced through honeypot data.
The 94 vulnerabilities identified affected products from 58 vendors, with Linux and Microsoft together accounting for approximately 13% of the vulnerabilities. The remaining exposures spanned network edge and security management appliances; operating systems (OS) and mobile devices; collaboration, content management, and enterprise platforms; artificial intelligence (AI), developer, and automation tools; and operational technology and industrial systems.
September reporting also highlighted zero-day exploitation of CVE-2026-88771 and CVE-2026-88772 (NetScaler), as well as renewed exploitation of CVE-2026-35273 (PeopleSoft) against unpatched systems.
Quick reference: September 2026 vulnerability table
All 80 vulnerabilities below were actively exploited or operationally weaponized in September 2026. This table does not include the 14 CVEs that were exclusively surfaced through honeypot data, which are available to Recorded Future Intelligence Platform customers via the CVE Monthly report. 以下の表には、Insikt Groupが特定した公開PoC（概念実証）の例も示されています。これらの概念実証（PoC）は、正確性や有効性について検証されていません。脆弱性管理チームは、テストを実施する前に、PoC（概念実証）の妥当性を慎重に検証する必要があります。
スコア
表1: List of vulnerabilities that were actively exploited in September 2026 based on Recorded Future data (excluding honeypot-sourced CVEs).
Key trends: September 2026
- September reporting linked NightEagle and UNC3569 to GhostContainer and GRAYRABBIT deployments, while Cisco FMC exploitation by three threat clusters led to credential theft, Cyclops Blink deployment, and Qilin ransomware.
- A suspected Chinese-speaking actor used a SecFlow-based environment with Claude-, Qwen-, and DeepSeek-backed workers, and a suspected Russian-speaking actor used hundreds of AI agents to compromise at least 440 PaperCut NG/MF instances associated with 395 organizations.
- 47 of the 94 vulnerabilities enabled remote code execution (RCE). Network-edge and security-management products were the most affected product type. Apache and Google represented the largest share of vendors, with three RCE vulnerabilities each.
- Insikt Group identified public proof-of-concept (PoC) exploits or scanners for 75 of the 94 vulnerabilities identified in September.
- The most common weakness class was CWE-306 (Missing Authentication for Critical Function), with seven vulnerabilities, followed by CWE-22 (Path Traversal), with six. CWE-78 (OS Command Injection), CWE-89 (SQL Injection), and CWE-94 (Code Injection) each affected five vulnerabilities.
- Eight of the 94 vulnerabilities were at least five years old, and the oldest was approximately 12 years old.
Trend analysis
AI-assisted campaigns combine older flaws with post-compromise tooling
Insikt Group detailed a suspected Chinese-speaking actor using a SecFlow-based operations environment with Claude-, Qwen-, and DeepSeek-backed workers to support reconnaissance, exploitation, post-exploitation, and collection across Asian targets. The threat actor tested or staged workflows for CVE-2014-6271, CVE-2020-1938, CVE-2022-22965, CVE-2016-4437, CVE-2021-43798, CVE-2024-4956, CVE-2021-29441, and CVE-2021-44228. The workflow routed candidate findings to vulnerability-specific playbooks, but not every attempt produced confirmed access.
A separate September report described a suspected Russian-speaking threat actor using hundreds of AI agents in a campaign targeting PaperCut NG/MF. The campaign exploited CVE-2026-81578 and CVE-2026-82078, compromising at least 440 instances associated with 395 organizations.
Ransomware, backdoors, and data theft follow initial access
A Validated Intelligence Event detailed the exploitation of CVE-2026-20079 and CVE-2026-20316 affecting Cisco Secure Firewall Management Center (FMC) by three groups. UAT-12197 exploited CVE-2026-20079 to gain root access, deploy a JavaServer Pages (JSP) web shell and Java Archive (JAR)-based command executor, and steal authentication data. UAT-11823 exploited both flaws to establish reverse shells, exfiltrate managed-device configurations, and deploy Cyclops Blink. UAT-11988 exploited CVE-2026-20316 to deploy Qilin ransomware.
A Validated Intelligence Event linked a suspected Chinese-speaking actor to broad exploitation and targeting of internet-facing technologies beginning in May 2026. It assessed the actor as being the same as or related to Red Heron based on overlapping infrastructure, malware, and tactics, techniques, and procedures. The campaign exploited WordPress CVE-2026-63030 and CVE-2026-60137 against 49 organizations, targeted the Linux kernel through CVE-2022-0847, exploited Gitea through CVE-2026-60004, and targeted Proxmox VE CVE-2023-54391. A separate Validated Intelligence Event covered Acronis's September 13 report that Red Heron exploited CVE-2026-60004 against eleven critical-infrastructure organizations and used the resulting access for persistence, repository and database theft, credential collection, and lateral movement.
A separate Validated Intelligence Event reported that NightEagle deployed the GhostContainer backdoor on Microsoft Exchange servers associated with Russian companies. Kaspersky reported that the group used compromised virtual private network credentials, extracted Exchange cryptographic keys, modified VIEWSTATE, and executed GhostContainer in memory. In one incident, NightEagle exploited CVE-2019-0708 (BlueKeep) to create a local account with administrative and remote-access privileges, then used tunneling tools, Remote Desktop Protocol, and Impacket to enable lateral movement and maintain access.
Another Validated Intelligence Event described UNC3569's active exploitation of CVE-2026-51990 affecting Tencent Sogou Input Method. The one-click chain used a crafted custom-protocol link and an outdated embedded Chromium engine, including CVE-2021-38003, to execute shellcode and deploy the GRAYRABBIT backdoor. GRAYRABBIT supports process execution, reverse shell access, file transfer, system reconnaissance, and the reflective loading of additional modules.
Public exploit research highlights edge and management platform exposure
A TTP Instance detailed CVE-2026-88771, an improper input validation vulnerability in NetScaler ADC and NetScaler Gateway that can enable unauthenticated root command execution. GreyNoise observed attempts to install a web shell and establish privileged access, although the threat actor did not gain a foothold on its monitored sensor. A separate TTP Instance detailed CVE-2026-88772, a separate NetScaler memory-corruption vulnerability affecting appliances with Datagram Transport Layer Security (DTLS) enabled. Citrix confirmed exploitation, while watchTowr shared a script to detect the vulnerability.
A TTP Instance also detailed an alleged PoC for CVE-2026-86218, a static code injection vulnerability in N-able N-central. A Metasploit pull request by Rapid7 reported unauthenticated command execution with the affected service account’s privileges and disruption of an application feature until restart.
Another TTP Instance detailed CVE-2026-94127, a heap-based buffer overflow in F5 BIG-IP Access Policy Manager (APM) that can enable unauthenticated RCE when the product is configured as an OAuth Authorization Server with the relevant access policy and OAuth profile; watchTowr shared a script to detect the vulnerability.
A TTP Instance detailed CVE-2026-35273, a missing authentication vulnerability in Oracle PeopleSoft Enterprise PeopleTools. Mandiant and Google Threat Intelligence Group reported that UNC6240, also known as ShinyHunters, exploited exposed PeopleSoft environments to execute commands, deploy web shells, install the SIDEEYE backdoor and MeshAgent, and establish tunnels for internal discovery and lateral movement. An alleged public PoC separately claimed server-side request forgery (SSRF) and cloud execution capabilities that Insikt Group had not tested.
Additional trends and analyses from September are available to Recorded Future customers.
行動を起こす
環境やベンダー、サプライヤーの脆弱性に関するタイムリーかつ関連性の高い情報は、リスク軽減に不可欠です。Recorded Futureがチームの可視性向上、効率向上、自信に満ちた意思決定を可能にすることで、どのようにサポートできるかをご覧ください。
脆弱性 優先順位付け – 脆弱性は悪用の可能性に基づく 脆弱性 – 単なる深刻さではなく、 悪用されるリスクとその深刻度を容易に把握でき、リアルタイムの状況に応じたインテリジェンスを活用することで、迅速かつ自信を持って意思決定を行い、重要な箇所にパッチを適用し、攻撃を未然に防ぐことができます。
Attack Surface Intelligence – 特定のCVEに対して脆弱なインターネット関連資産を特定します。Attack Surface Intelligence 組織の外部から視点を提供し、未知の資産、脆弱性、または誤った設定の資産を積極的に発見し、優先順位を付ける、対応するのに役立ちます。
サードパーティリスク – ベンダーやパートナーのセキュリティポスチャーを外部から把握しましょう。 インターネット対応システムの脆弱性を迅速に評価できる能力により、時間のかかる調査やベンダーとの連絡サイクルを排除しましょう。
Insikt Group® – Recorded Futureの専門家チームであるInsiktグループ®による新たな脆弱性やトレンドに関する独占レポートにアクセスできます。Insikt Group®が作成した、特定のCVEに対応したNucleiテンプレートをダウンロードして、実際に悪用されている脆弱性を検出してください。
Recorded Future Professional Services – Work with our Professional Services team on a Vulnerability Analysis Engagement. Designed to equip your team with advanced strategies for identifying, prioritizing, and mitigating threats effectively, this program delves into technologies and operations essential for a successful vulnerability management program. (Learn more about how our Professional Services team can help elevate your team by watching our recent Vulnerability Prioritization Workshop.)
Insikt Group®について
Recorded Future の脅威リサーチ部門である Insikt Group は、政府、法執行機関、軍、諜報機関に深い経験を持つアナリストとセキュリティ研究者で構成されています。彼らの使命は、お客様のリスクを軽減し、具体的な成果を実現し、ビジネスの中断を防ぐインテリジェンスを生み出すことです。
関連リソース
サイバーセキュリティ戦略を強化するための専門家の洞察、レポート、ツールをご覧ください。