Vulnerability Report - September 2026

Introduction

This vulnerability report has been generated with the help of AI, using the VulnMCP tooling on top of Vulnerability-Lookup, with contributions from the platform’s community.

It highlights the most frequently sighted vulnerabilities for September 2026, based on data aggregated from Vulnerability-Lookup, the CISA Known Exploited Vulnerabilities catalog, the CIRCL KEV catalog, the ENISA EUVD / EU CSIRTs Network feed, honeypot observations from The Shadowserver Foundation, the Previdian catalog (formerly known as KEVIntel – same catalog, new name), and contributor comments and bundles. These five KEV catalogs are federated through the GCVE initiative: each one is identified by the UUID of the Global Naming Authority (GNA) that publishes it, and exchanged between instances following the GCVE-BCP-07 specification – which is what makes the catalog coverage comparison further down possible. Sightings come from MISP, Exploit-DB, Bluesky, Mastodon, Telegram, GitHub Gists, Nuclei, SPLOITUS, Metasploit, and more. For further details, please visit this page.

September was the month of the network edge. Citrix NetScaler, Check Point, F5 BIG-IP, Cisco (four different products), Fortinet, SonicWall, MikroTik, Zyxel and Arista all had exploited vulnerabilities enter the CISA catalog, and the four vulnerabilities that every European catalog agreed on – two NetScaler issues, the Check Point VPN certificate flaw and the F5 BIG-IP APM heap overflow – are all unauthenticated remote code execution on security appliances. The second thread is exploitation reports arriving from more directions than before: CERT.PL’s “MikroTrick” research reached the ENISA feed five days before CISA listed it, NCSC-NL flagged WordPress core and two Zammad zero-days, and CIRCL confirmed seven exploitations including a ransomware case. The CVE Program set another monthly record at nearly 15,000 CVEs, and the KEV catalogs collectively flagged 166 vulnerabilities, up from 102 in August.

The Month at a Glance

14,959 CVEs were published in September 2026 (from the CVE List v5 source alone), up from 12,315 in August – a 21.5% month-over-month increase and, once again, the highest monthly volume ever recorded. Vulnerability-Lookup also ingested 14,128 GitHub security advisories and 186 PySec advisories over the same period.

Vulnerability-Lookup collected 43,109 sightings across 15,296 distinct vulnerabilities during September 2026, up from 33,732 in August (+27.8%). The breakdown:

The August figures used for comparison are those returned by the API today (the August report quoted higher totals at the time of publication, before the sighting data was consolidated). On that basis every category except one grew: “seen” mentions rose from 25,643 to 32,981 (+29%), published proof-of-concept sightings from 4,819 to 6,482 (+35%), and exploitation-typed sightings from 3,204 to 3,589 (+12%), spread over 930 distinct vulnerabilities against 883 in August. The exception is confirmed sightings, which fell from 66 to 57 – each one on a different vulnerability, so the confirmed set is 57 distinct issues, among them the F5 BIG-IP APM RCE, the WordPress core file inclusion and the GitLab path traversal. No “patched” sightings were recorded.

The daily breakdown is dominated by 1 September, the busiest day of the month with 5,114 sightings, of which 4,979 are “seen”: a bulk batch of Telegram-sourced mentions covering 3,039 distinct vulnerabilities, led by Log4Shell, the MSHTML CVE-2021-40444, PrintNightmare and Confluence CVE-2022-26134 – a catalogue of 2021-era classics rather than new activity. The proof-of-concept peak comes two days later, on 3 September (911), spread thinly over 595 vulnerabilities. After that the “seen” band follows the disclosure calendar: 8–9 September (Patch Tuesday, the Windows ALPC and Update Stack privilege escalations, both Chrome V8 issues, N-central and Adobe Commerce), 15 September (the Cisco Secure Email Gateway SQL injection), 23 September (F5 BIG-IP APM, WordPress core and the two Check Point issues) and 29 September (the NetScaler pair and the Apple CoreGraphics zero-day). Exploitation-typed sightings peak on 10 and 19 September (222 and 212). The quietest stretch is the weekend of 20–21 September, under 600 per day.

In the exploitation-typed sightings, Log4Shell (CVE-2021-44228, 74 exploitation reports) remains the single most reported vulnerability for yet another month. It is followed by a relative newcomer, the NetScaler SAML IdP memory overread CVE-2026-3055 (44), listed by CISA at the end of March and still being actively reported, then by the Cisco IOS XE web UI privilege escalation CVE-2023-20198 (37), the cPanel/WHM authentication bypass CVE-2026-41940 (37) and Confluence CVE-2022-26134 (35). Proof-of-concept activity again concentrated on the Linux kernel rtmutex flaw CVE-2026-43499 (59, second month at the top), the WordPress core page-template file inclusion CVE-2026-87902 (45), the cPanel bypass (34) and an Android Contacts Provider SQL injection, CVE-2026-28576 (33), which no tracked catalog lists.

Top 10 Vendors of the Month

Linux keeps the top of the vendor ranking for a second month, now with close to 40% of the month’s attributed CVEs – the kernel CVE flood shows no sign of slowing – ahead of Microsoft, Google and Oracle. Dell enters the top ten, and the “unknown” slice (records without a usable vendor field) is large enough to rank fifth.

Top 10 Assigners of the Month

The kernel CNA leads the assigners, followed by VulnCheck and GitHub’s CNA, with Microsoft, VulDB, Oracle and WPScan behind them.

Top 10 Credits of the Month

WPScan stays first with around 550 credited vulnerabilities, but the VulDB CNA Team has closed most of the gap at roughly 510. A single researcher, George Chen, takes third place with more than 200 credits, well ahead of Mozilla, Patchstack’s bug bounty program, HPE Networking’s internal research team, VulnCheck and Wordfence PRISM.

The complete list of credits is available on Vulnerability-Lookup.

Top 10 Vulnerabilities of the Month

Two vulnerabilities share the top of the list, one sighting apart. The WordPress core remote file inclusion CVE-2026-87902, disclosed on 22 September, lets an unauthenticated attacker point page-template resolution at any readable .php file on the server; NCSC-NL reported active abuse the next day and CISA listed it on 25 September. It is followed by the GitLab repository commits API path traversal CVE-2026-85706, an unauthenticated arbitrary file read disclosed in mid-September and listed by CISA on the 11th – a second GitLab entry in as many months after August’s GraphQL code injection. The two NetScaler issues of 27 September take third and fifth place in just four days of sightings: the improper input validation RCE CVE-2026-88771 and the memory overflow CVE-2026-88772, both exploited before the bulletin was out and both entered into four catalogs within 24 hours. Log4Shell, in fourth place, is the only pre-2026 entry. The rest of the list is a tour of September’s CISA additions: the Chrome V8 type confusion CVE-2026-85046 (the first of two V8 entries this month), the F5 BIG-IP APM OAuth heap overflow CVE-2026-94127, the cPanel bypass that has sat in the top ten since May, the Cisco Secure Email Gateway SQL injection CVE-2026-76461 – root command execution through a crafted e-mail – and the Linux kernel rtmutex issue, which ties for tenth place with the Adobe Commerce template injection CVE-2026-75650 and the JFrog Artifactory authentication bypass CVE-2026-82329, all at 113 sightings.

Known Exploited Vulnerabilities

New entries were added to the tracked Known Exploited Vulnerabilities catalogs during September. The five catalogs are complementary rather than redundant: CISA is the reference set, CIRCL and the ENISA / EU CSIRTs Network feed add European confirmations, Shadowserver’s honeypots show what is actually being attacked on the wire, and Previdian aggregates public exploitation reports at higher volume and often earlier – each of the last two surfacing vulnerabilities no other catalog lists.

A total of 166 distinct vulnerabilities entered at least one tracked catalog this month, against 102 in August: 43 were added by CISA, 7 by CIRCL, 19 were reported through the ENISA / EU CSIRTs Network feed, 16 were observed for the first time by Shadowserver’s honeypots and 156 were added by Previdian. Every catalog grew except Shadowserver, whose feed stopped delivering new observations after 7 September (see below), so its figure only covers the first week.

The month’s story is the security appliance. Citrix NetScaler entered the CISA catalog three times: the authentication bypass CVE-2026-19490 on 9 September (the companion of the bulletin a contributor bundled in August, and flagged by Previdian six days earlier), then CVE-2026-88771 and CVE-2026-88772 on Saturday 27 September, the same day Citrix published its bulletin and the ENISA feed, Previdian and – the next day – CIRCL picked them up. Check Point contributed a pair on 22 September: the VPN certificate validation RCE CVE-2026-85102, which reaches any Quantum gateway with site-to-site or remote-access VPN, and the management server path traversal CVE-2026-93616. F5 BIG-IP APM followed the same day with the OAuth authorization-server heap overflow CVE-2026-94127, which CIRCL confirmed on 23 September. Cisco had four distinct products listed: the Secure Firewall Management Center authentication bypass CVE-2026-20079, tagged as ransomware-exploited with confirmed EU victims in the ENISA feed, the Secure Email Gateway SQL injection, the ISE API authentication bypass CVE-2026-76460 and, on the last day of the month, the Catalyst SD-WAN Manager admin-session bypass CVE-2026-76504. Fortinet (FortiOS heap overflow CVE-2025-25249), SonicWall (two SMA1000 issues), Arista VeloCloud Orchestrator, Zyxel GS1900 switches and Palo Alto (the GlobalProtect bypass CVE-2026-0257, which CIRCL tied to a ransomware incident on 1 September) complete the picture. Across the month, more than a third of CISA’s additions concern a firewall, VPN, load balancer or network-management product.

MikroTik RouterOS deserves its own paragraph. CERT.PL’s “MikroTrick” research produced four SSH-related CVEs, three of which the Polish CSIRT reported to the ENISA feed on 5 September: the policy-mask privilege escalation CVE-2026-86060, the btest kernel memory disclosure CVE-2026-67277 and the RSA exponent-one user impersonation CVE-2026-67276. CISA listed the first two on 10 September – five days after the ENISA feed – and added the pre-authentication rekey bypass CVE-2026-67279 on 25 September, noting that it chains with the privilege escalation for a fully unauthenticated compromise. The impersonation flaw remains visible only through ENISA and Previdian.

On the developer and operations tooling side, JFrog Artifactory had three CISA entries (the default-configuration administrative bypass CVE-2026-82329 on 2 September, then a token-scope and an anonymous-token issue on the 11th), N-able N-central returned for a third month with the pre-authentication RCE CVE-2026-86218, and ConnectWise ScreenConnect, Acronis’s cPanel backup plugin, WSO2 (a JWT algorithm-mismatch account takeover rated CVSS 10.0) and Kestra joined them. The AI stack is quieter than in August but not absent: CISA listed the LiteLLM MCP authentication bypass CVE-2026-59822 and the Starlette host-header path confusion it chains with, Previdian added Langflow (CVE-2026-0769, 38.6% EPSS), two Flowise issues, Dify, Nuclio, Red Hat OpenShift AI’s Feast component and two agent frameworks (OmniRoute, Flyto2) that expose command execution over MCP.

Client-side entries were few but notable: two Chrome V8 issues (CVE-2026-85046 on 4 September, CVE-2026-87491 on the 9th), the Apple CoreGraphics out-of-bounds write CVE-2026-86950, which Apple says was used “in an extremely sophisticated attack against specific targeted individuals”, a Google Pixel modem permission bypass, the two Windows local privilege escalations of Patch Tuesday, and three Linux kernel entries on 18 September (the AF_ALG race, the TLS zero-length record issue and the ebtables SNAT out-of-bounds write) – continuing the kernel-exploit pattern noticed in August. The ENISA feed also brought two issues no other reference catalog lists: the GeoNetwork unauthenticated RCE chain (CVE-2026-58400, CVE-2026-63219) affecting government geoportal back-ends, and two Zammad zero-days reported by NCSC-NL on 30 September.

Across the month’s KEV additions, the dominant weakness patterns were missing or improper authentication (CWE-287/288/306/863: NetScaler, Cisco FMC, ISE and SD-WAN Manager, Artifactory, WSO2, Kestra, LiteLLM, Adobe Commerce, SonicWall), memory corruption in appliances and clients (CWE-119/122/787: NetScaler, F5, Fortinet, Zyxel, Chrome, Apple, Windows ALPC), path traversal and file inclusion (CWE-22/98: Check Point, GitLab, WordPress, WSO2) and, for the Previdian-only set, SQL injection in older web applications.

Catalog coverage

166 distinct vulnerabilities entered at least one of the tracked KEV catalogs during September. The matrix below shows, for each of them, which catalogs cover it (as of publication) – built with the KEV catalog coverage feature of Vulnerability-Lookup. Previdian is by far the widest net with 163 of the 166, ahead of CISA (49, including entries it had listed before September), ENISA (19), Shadowserver (18) and CIRCL (7). Five vulnerabilities of the month are present in four catalogs at once: the two NetScaler issues (CVE-2026-88771, CVE-2026-88772), the Check Point VPN RCE CVE-2026-85102 and the F5 BIG-IP APM overflow CVE-2026-94127 – all in CISA, CIRCL, ENISA and Previdian – plus Log4Shell CVE-2021-44228, which CIRCL added on 3 September and which was already in CISA, Shadowserver and Previdian. Thirteen more are in three catalogs, among them the WordPress core file inclusion, the SharePoint code injection, the three MikroTik entries, both Cisco FMC issues and the Sangoma Switchvox SQL injection CVE-2026-9586 – the only entry of the month that CISA, Previdian and Shadowserver’s honeypots all saw.

At the other end, 99 entries are visible through a single catalog: 96 only via Previdian (the AI-tooling cluster, a large batch of Chinese enterprise software and WordPress plugin issues, XWiki, Ghost, OpenCTI and a long tail of high-EPSS legacy flaws), 2 only via ENISA (the GeoNetwork pair) and 1 only via CIRCL – GCVE-1-2026-20026, an unauthenticated remote code execution in older firmware, discovered by CIRCL and published under its own GCVE numbering. For the first time, no entry is unique to CISA: every one of its 43 additions is also in Previdian.

CISA

The CISA KEV catalog added 43 entries in September, well above August’s 31 and the busiest month of the year by a wide margin. None of them carries a known ransomware campaign use flag, even though the ENISA feed tags the Cisco FMC pair as ransomware-exploited and CIRCL tied the PAN-OS GlobalProtect bypass to a ransomware case.

More KEV entries from the CISA Catalog.

CIRCL

The CIRCL KEV catalog added 7 entries during September, up from two in August and all marked as confirmed exploitation. The month opened with the Palo Alto GlobalProtect authentication bypass CVE-2026-0257, confirmed through CIRCL’s own incident response as a ransomware case (CISA had listed it in May), and with Log4Shell, still being confirmed in the wild almost five years on. On 9 September CIRCL published GCVE-1-2026-20026, a pre-authentication remote code execution in older firmware that has no CVE and is only identifiable through its GCVE number. The month closed with four entries that corroborate CISA: the F5 BIG-IP APM overflow on 23 September, the day after its CISA listing, then on 28 September the Check Point VPN RCE and both NetScaler issues, the latter one day after CISA.

More KEV entries from the CIRCL Catalog.

ENISA (EUVD)

Nineteen entries were reported through the ENISA / EU CSIRTs Network (CNW) KEV feed during September, nearly three times August’s seven and the feed’s busiest month so far. Seven came from ENISA itself (both Check Point issues, F5, the two WordPress core issues of July (SQL injection and REST route confusion) re-reported with “EU victimology”, and the two Cisco FMC issues, tagged as ransomware with confirmed EU victims), four from CERT.PL (the MikroTrick research), four through the CNW channel (GeoNetwork and NetScaler), three from NCSC-NL (WordPress core on 23 September, two days before CISA, and the two Zammad zero-days) and one from CSIRT-IE (the SharePoint code injection). Five entries – the GeoNetwork pair, the MikroTik impersonation flaw and both Zammad issues – are not in the CISA catalog.

More KEV entries from the ENISA Catalog.

The Shadowserver Foundation

The Shadowserver KEV catalog is fed by honeypot-observed exploitation attempts. 16 vulnerabilities were observed for the first time during September, all between 1 and 7 September: the catalog’s most recent observation date is 7 September, so no honeypot data reached Vulnerability-Lookup for the last three weeks of the month and this section is necessarily partial. Two of the sixteen are in the CISA KEV catalog – the Sangoma Switchvox SQL injection CVE-2026-9586, hit on 4 September, two days after its CISA listing, and the MeteoBridge command injection CVE-2025-4008 from October 2025. The rest is the usual honeypot fare: consumer routers (four Totolink models, two Tenda CH22 issues, two D-Link models and a Shenzhen Aitemi Wi-Fi repeater), a Grandstream VoIP phone, PaperCut NG, ESDS Emagic, Weaver E-cology and a WordPress analytics plugin, each at one to three connections a day. Severity values are reproduced as published by Shadowserver (CVSS).

More KEV entries from the Shadowserver Catalog.

Previdian (formerly KEVIntel)

The Previdian catalog – the catalog reported as KEVIntel in previous editions, renamed but otherwise unchanged – aggregates public exploitation reports and added 156 entries in September, up from 91 in August and by far the highest volume of the tracked feeds. It covers all 43 of CISA’s additions for the month, a first since this report started comparing the two.

Eighteen of those it flagged before CISA did: the Adobe Commerce authorization bypass CVE-2026-71362 on 10 September, a full 14 days ahead; the WSO2 JWT account takeover CVE-2026-5430 by 8 days; the NetScaler authentication bypass CVE-2026-19490 by 6 days; the Adobe Commerce template injection CVE-2026-75650 by 3 days; the WordPress core file inclusion, the MikroTik rekey bypass, ScreenConnect and N-central by 2 days each; and ten more by one day, among them the Apple CoreGraphics zero-day, the SharePoint code injection, all three Artifactory issues and both SonicWall SMA1000 entries. The remaining 25 were listed on the same day as CISA, and none came later.

96 entries are unique to Previdian this month, 36 of them 2026 CVEs. The largest block is Chinese enterprise software added in two batches (14–18 and 29–30 September): Yonyou U8 CRM, U8 Cloud and A6 OA, Inspur HCM Cloud, Hongjing e-HR, Weaver E-cology, Chanjet CRM, Fumeng Cloud, iDocView, DedeCMS and Mingsoft MCMS – a cluster that only Shadowserver’s honeypots used to surface. The second block is WordPress plugins and small PHP applications with unauthenticated SQL injection or file upload (LearnPress, TI WooCommerce Wishlist, Modern Events Calendar, Elementor Pro, Super Forms, JetEngine and a dozen others). The AI cluster is again visible – Langflow CVE-2026-0769, two Flowise issues (CVE-2026-56271, CVE-2026-69255), Dify, Nuclio, OmniRoute, Flyto2 and Red Hat OpenShift AI – alongside XWiki (three entries, two above 77% EPSS), Ghost (CVE-2026-26980, 70.2% EPSS), OpenCTI (CVE-2026-27960, default admin account), Roundcube, Grav, Dolibarr, Veeam, two further N-central issues and the KGUARD DVR command execution CVE-2026-87827, the only entry of the month Previdian marks as used in malware. The legacy tail is as high-EPSS as ever: Drupalgeddon CVE-2014-3704 (99.97%), Joomla CVE-2017-8917 (99.8%), the Jenkins Script Security sandbox bypass CVE-2019-1003000 (98.4%), XWiki CVE-2023-37462 (91.5%) and FileCatalyst Workflow CVE-2024-5276 (90.1%).

Vendor, product, CVSS and EPSS values below are reproduced as published by Previdian.

More KEV entries from the Previdian Catalog.

Top 10 Weaknesses of the Month

Memory safety keeps the top three places for the third month running, and the gap is widening: heap-based buffer overflow (CWE-122) approaches 10,000 occurrences, almost double August’s figure, ahead of use-after-free (CWE-416, about 5,900) and out-of-bounds read (CWE-125, about 5,200). Cross-site scripting (CWE-79) stays fourth, missing authorization (CWE-862) fifth, and integer overflow (CWE-190) and stack-based buffer overflow (CWE-121) both enter the top ten – which makes five memory-corruption classes out of ten.

Insights from Contributors

Two community comments were published this month:

• A contradictory timeline – a contributor revisits the Microsoft Entra ID deserialization RCE CVE-2026-69836 (CVSS 10.0), reported in August as a CISA entry visible in no other catalog. The comment documents the back-and-forth around its “exploited” flag, which Microsoft withdrew, and the resulting absence from the CISA KEV – the entry no longer appears in any tracked catalog today. Its wider point is about server-side patches on multi-tenant cloud services: with no binary to download and no version to check, defenders can only trust the vendor and shift from patching to detection.
• LG TV discovery traffic and CVE-2026-13230 – a possible interaction with CVE-2026-9770? – an annotation on the TP-Link Kasa EC70/EC71 hard-coded private key CVE-2026-9770, noting that LG TVs broadcast discovery packets on UDP/9999 every 25 seconds, the same port used by the Kasa discovery mechanism of CVE-2026-13230, which leaks the camera’s GPS coordinates without authentication. The suggested interaction is tagged vulnerability:exploitability=theoretical.

Contributors also curated advisories and research into five bundles during September:

• Ubuntu 24.04 LTS NVIDIA Kernel Update USN-8760-1 Security Issues (550 CVEs) – the month’s largest bundle by far, grouping every kernel CVE fixed in a single Ubuntu update for NVIDIA systems; a reminder of what the kernel’s CVE volume looks like once it reaches a distribution.
• Citrix NetScaler ADC and Citrix NetScaler Gateway Security Bulletin for CVE-2026-88771 to CVE-2026-88778 (8 CVEs) – the 27 September bulletin, bundled the day it came out, covering the two KEV-listed RCEs and six further issues in the same releases.
• GeoNetwork Fixes Unauthenticated RCE Chain Affecting Government Geoportal Backends (6 CVEs and advisories) – the unauthenticated formatter upload CVE-2026-63219 chained with the unsafe Saxon XSLT configuration CVE-2026-58400, bundled on 3 September alongside two earlier related CVEs; both GeoNetwork CVEs reached the ENISA feed the day before.
• Active exploitation of Cisco Secure Firewall Management Center vulnerabilities (2 CVEs) – Cisco Talos’s report on the FMC authentication bypass CVE-2026-20079 and the static-credential issue CVE-2026-20316, bundled on 10 September, the day after CISA listed the former.
• Critical vulnerabilities in Checkpoint VPN Firewall (2 CVEs) – the VPN certificate validation RCE CVE-2026-85102 together with the ASN.1 decoding heap overflow CVE-2026-85103, bundled twelve days before the former entered the CISA catalog.

Thank you

Thank you to all the contributors and our diverse sources!

If you want to contribute to the next report, you can create your account.

Feedback and Support

If you have suggestions, please feel free to open a ticket on our GitHub repository. Your feedback is invaluable to us!
https://github.com/vulnerability-lookup/vulnerability-lookup/issues/

Funding

The main objective of Federated European Team for Threat Analysis (FETTA) is improvement of Cyber Threat Intelligence (CTI) products available to the public and private sector in Poland, Luxembourg, and the European Union as a whole.
Developing actionable CTI products (reports, indicators, etc) is a complex task and requires an in-depth understanding of the threat landscape and the ability to analyse and interpret large amounts of data. Many SOCs and CSIRTs build their capabilities in this area independently, leading to a fragmented approach and duplication of work.

The Computer Incident Response Center Luxembourg (CIRCL) is a government-driven initiative designed to provide a systematic response facility to computer security threats and incidents. The organization brings to the table its extensive experience in cybersecurity incident management, threat intelligence, and proactive response strategies. With a strong background in developing innovative open source cybersecurity tools and solutions, CIRCL’s contribution to the FETTA project is instrumental in achieving enhanced collaboration and intelligence sharing across Europe.

Press release

AIPITCH (AI-Powered Innovative Toolkit for Cybersecurity Hubs) is a co-funded EU project supported by the European Cybersecurity Competence Centre (ECCC) under the DIGITAL-ECCC-2024-DEPLOY-CYBER-06-ENABLINGTECH program and CIRCL.
The VLAI severity levels used throughout this report are produced by models developed as part of AIPITCH.