Reported by 8 outlets
[CISA-2026:0908] CISA Adds 4 Known Exploited Vulnerabilities to Catalog ( https:// secdb.nttzen.cloud/security-ad visory/detail/CISA-2026:
Why this score
- Breadth
- 2.00 / 2.0 · 8 sources
- Authority
- 1.80 / 2.0 · best outlet weight
- Severity
- 5.00 / 5.0 · CVSS + KEV signals
- Velocity
- 0.00 / 2.0 · updates in 48h
- Pickup speed
- 0.60 / 0.6 · time to second source
- Recency
- × 0.00 temporal multiplier
- Community
- + 0.00 / 1.5 · reddit signal
- Score
- 0.0 / 10 = base × recency + community
Desk analysis
CISA added four vulnerabilities to its Known Exploited Vulnerabilities catalog on September 8, 2026, each with evidence of active exploitation: CVE-2026-75650, an improper neutralization flaw in the Adobe Commerce and Magento template engine; CVE-2026-81963, a link following bug in the Windows Update Stack; CVE-2026-85880, a heap-based buffer overflow in Windows ALPC; and CVE-2026-86218, a static code injection leading to pre-authentication remote code execution in N-able N-central. All four had public fixes before or on the day of the listing. The story's later updates track the next batch, CISA-2026:0922 on September 22, which added two Check Point management plane bugs, CVE-2026-85102 and CVE-2026-93616, the Arista VeloCloud Orchestrator flaw CVE-2026-93952, and the F5 BIG-IP APM overflow CVE-2026-94127.
The pre-KEV history shows exploitation ran ahead of or alongside patching. Sansec published StyleSmuggler on September 5 after finding stores compromised from September 4; Adobe's APSB26-146 hotfix followed on September 7, scoring the bug CVSS 10.0 across Commerce and Magento 2.4.4 through 2.4.9. N-able shipped HF4, build 2026.3.1.14, for the N-central zero-day on September 5, and Huntress confirmed in-the-wild exploitation, one compromised customer environment, and a working proof of concept for two related N-central bugs, CVE-2026-86206 and CVE-2026-86207. Microsoft fixed both Windows bugs in a record 964-CVE September Patch Tuesday and marked each as exploited as a zero-day, the first Windows Update Stack EoP exploited that way since 2022 and the first ALPC entry in the monthly release since April 2023.
BOD 26-04 puts federal civilian agencies on a remediation clock for these entries and requires checks for pre-patch compromise, and the pattern in this catalog deserves attention: an RMM console, a management plane, an e-commerce platform, and two local Windows escalations that chain well with any remote foothold. Later updates in this story show the cadence continuing, with the September 22 batch due Friday for feds and a Zyxel GS1900 order, CVE-2026-7273, due Thursday. Treat KEV additions as the triage layer over the September patch volume, verify versions on internet-facing N-central, Check Point management, VeloCloud Orchestrator and BIG-IP APM systems, and scan Magento estates for StyleSmuggler persistence, since patching does not clean stores hit before September 7.
Timeline
-
original reporting
🚨 [CISA-2026:0908] CISA Adds 4 Known Exploited Vulnerabilities to Catalog ( https:// secdb.nttzen.cloud/security-ad visory/detail/CISA-2026:
secdb.nttzen.cloud · 34d ago · September 9th, 2026
🚨 [CISA-2026:0908] CISA Adds 4 Known Exploited Vulnerabilities to Catalog ( https:// secdb.nttzen.cloud/security-ad visory/detail/CISA-2026:
via Mastodon https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:0908
-
update from sansec.io
StyleSmuggler: Magento and Adobe Commerce 0-day RCE (CVE-2026-75650) under active attack
sansec.io · 39d ago · September 5th, 2026
Sansec disclosed StyleSmuggler, an unauthenticated remote code execution chain in Magento and Adobe Commerce, and reproduced it on clean 2.4.7, 2.4.8 and 2.4.9 installs. Confirmed exploitation started September 4, 2026, three days before Adobe's emergency hotfix. Adobe published bulletin APSB26-146 with hotfix VULN-39341 on September 7 at 20:20 UTC, rating CVE-2026-75650 CVSS 10.0 and covering versions 2.4.4 through 2.4.9.
-
update from n-able.com
N-central 2026.3 HF4 Release Notes (CVE-2026-86218)
n-able.com · 39d ago · September 5th, 2026
N-able shipped hotfix 2026.3.1.14 for CVE-2026-86218, a critical pre-authenticated remote code execution vulnerability in on-premises N-central, last updated September 5, 2026. The vendor says the flaw was responsibly disclosed by a third party and states it had no confirmations of production exploitation at release. Hosted N-central instances were already patched.
-
update from huntress.com
Rapid Response: Critical N-able N-central Vulnerability and Active Exploitation
huntress.com · 37d ago · September 6th, 2026
Huntress reported CVE-2026-86218 as an actively exploited pre-auth RCE zero-day in N-central with a 10.0 CVSS score, fixed in hotfix 2026.3 HF4, in its September 6, 7:30 AM ET update. The same post documents a Huntress proof of concept for a separate N-central access bypass chain, CVE-2026-86206 and CVE-2026-86207, and one confirmed customer compromise of a fully patched N-central server. N-able's own incident page described the vulnerability as exploited in the wild while its release notes did not.
-
update from cisa.gov
CISA Adds Four Known Exploited Vulnerabilities to Catalog
cisa.gov · 36d ago · September 8th, 2026
CISA announced the KEV additions of CVE-2026-75650 (Adobe Commerce and Magento template engine flaw), CVE-2026-81963 (Microsoft Windows link following), CVE-2026-85880 (Microsoft Windows heap-based buffer overflow) and CVE-2026-86218 (N-able N-central static code injection), each based on evidence of active exploitation. The alert ties remediation to Binding Operational Directive 26-04, which requires federal civilian agencies to prioritize updates and check for pre-patch compromise. Release date September 8, 2026.
-
update from tenable.com
Microsoft's September 2026 Patch Tuesday addresses 964 CVEs (CVE-2026-81963, CVE-2026-85880)
tenable.com · 36d ago · September 8th, 2026
Tenable counts a record 964 Microsoft CVEs in the September 2026 Patch Tuesday release, 104 critical and 860 important, including both Windows elevation of privilege bugs CVE-2026-81963 and CVE-2026-85880, each CVSSv3 7.8 and granting SYSTEM privileges.
-
update from www.yazoul.net
🟠 New security advisory: CVE-2026-81963 affects Microsoft Windows 11 23H2. • Impact: Significant security breach potential • Risk: Unauthori
www.yazoul.net · 34d ago · September 9th, 2026
• Impact: Significant security breach potential • Risk: Unauthori
via Mastodon https://www.yazoul.net/advisory/cve/cve-2026-81963-windows-update-stack-local-privilege-escalation
-
mentioned by www.yazoul.net
⚠️ New security advisory: CVE-2026-85880 affects Microsoft Windows 10 1607. • Impact: Significant security breach potential • Risk: Unauthor
www.yazoul.net · 34d ago · September 9th, 2026
-
update from www.bleepingcomputer.com
CISA orders feds to patch Zyxel flaw exploited for data theft https:// bleepingcomputer.com/news/security/ cisa-orders-feds-to-patch-activel
www.bleepingcomputer.com · 21d ago · September 22nd, 2026
CISA orders feds to patch Zyxel flaw exploited for data theft https:// bleepingcomputer.com/news/security/ cisa-orders-feds-to-patch-activel
via X https://www.bleepingcomputer.com/news/security/cisa-orders-feds-to-patch-actively-exploited-zyxel-flaw-by-thursday/
-
mentioned by secdb.nttzen.cloud
🚨 [CISA-2026:0922] CISA Adds 4 Known Exploited Vulnerabilities to Catalog ( https:// secdb.nttzen.cloud/security-ad visory/detail/CISA-2026:
secdb.nttzen.cloud · 21d ago · September 22nd, 2026
-
update from www.cisa.gov
CISA added four exploited vulnerabilities to its catalogue yesterday. Check Point twice, F5 BIG-IP, Arista VeloCloud. All due Friday. The pe
www.cisa.gov · 20d ago · September 23rd, 2026
CISA added four exploited vulnerabilities to its catalogue yesterday. Check Point twice, F5 BIG-IP, Arista VeloCloud. All due Friday.