Reported by 2 outlets
September 2026 CVE Landscape
Why this score
- Breadth
- 1.00 / 2.0 · 2 sources
- Authority
- 1.50 / 2.0 · best outlet weight
- Severity
- 5.00 / 5.0 · CVSS + KEV signals
- Velocity
- 1.50 / 2.0 · updates in 48h
- Pickup speed
- 0.21 / 0.6 · time to second source
- Recency
- × 0.81 temporal multiplier
- Community
- + 0.00 / 1.5 · reddit signal
- Score
- 7.4 / 10 = base × recency + community
Desk analysis
Recorded Future's Insikt Group counted 94 high-impact vulnerabilities for September 2026, 59 of them Very Critical on its risk scale, a 29% rise over August, with public PoCs or scanners already available for 75 of the 94. The sourcing split is the mechanism: 43 arrived through CISA's KEV catalog, 37 through open-source validation, and 14 only through honeypot data, so a majority of the month entered the record as observed exploitation rather than advisory text. Citrix confirmed exploitation of the NetScaler pair CVE-2026-88771 and CVE-2026-88772, the former an improper input validation flaw allowing unauthenticated root command execution, the latter a memory corruption bug affecting appliances with DTLS enabled. Mandiant and Google Threat Intelligence Group tie renewed PeopleSoft exploitation, CVE-2026-35273, to UNC6240, also known as ShinyHunters, which executed commands, deployed web shells, installed the SIDEEYE backdoor and MeshAgent, and built tunnels for internal discovery and lateral movement.
The timing, not the count, carries the argument. CISA added both NetScaler flaws to KEV on 2026-09-27 with a federal remediation deadline of 2026-09-30, sixteen days before this landscape report carried them, which means a patch queue driven by monthly digests starts roughly half a month behind on exactly the bugs in active use. Dispersion is the second claim: 58 vendors with Linux and Microsoft together at only about 13% means the gravest outcomes landed on appliances and enterprise platforms, where UAT-11988 pushed Qilin ransomware through Cisco Secure FMC CVE-2026-20316 after UAT-12197 and UAT-11823 had taken root, exfiltrated managed-device configurations, and installed Cyclops Blink on the same platform. Exposure this month is an appliance and middleware problem, the class of asset that endpoint-centric inventories systematically undercount.
For NetScaler, apply the fixes in Citrix bulletin CTX697096, which spans CVE-2026-88771 through CVE-2026-88778, run CISA's published IOCs in the NetScaler console, and follow the suspected-compromise procedure in CTX694799, since BOD 26-04 makes forensic triage mandatory and watchTowr has shipped a detection script for CVE-2026-88772. GreyNoise observed attempts to install a web shell and establish privileged access against CVE-2026-88771, so hunt for unexpected shell artifacts and new privileged sessions on appliance management interfaces. For PeopleSoft, Oracle's alert of 2026-06-10 covers PeopleTools 8.61 and 8.62 and KEV flagged known ransomware use on 2026-06-12, making any unpatched internet-facing instance a standing web shell and ransomware staging risk more than three months after disclosure; hunt specifically for SIDEEYE, MeshAgent, and unexplained tunneling.
Two developments would move this assessment. Confirmation of the alleged public PoC's claims of SSRF and cloud execution for CVE-2026-35273, which Insikt has not tested, would widen PeopleSoft exposure from on-premises takeover to cloud credential theft. The October landscape, due within weeks, decides whether 94 exploited or weaponized CVEs in one month is a spike or the operating baseline, and whether AI-assisted workflows like the SecFlow-based campaign that staged CVE-2014-6271 and CVE-2021-44228 are reweaponizing the decade-old backlog at scale.
Timeline
-
original reporting
September 2026 CVE Landscape
recordedfuture.com · 1d ago · October 13th, 2026
In September 2026, Insikt Group® identified 94 high-impact vulnerabilities to prioritize for remediation , 59 of which had a Very Critical Recorded Future Risk Score. This represents a 29% increase from last month. 43 of these vulnerabilities were surfaced through the US Cybersecurity and Infrastructure Security Agency (CISA)’s Known Exploited Vulnerabilities (KEV) catalog, 37 were reported in open sources and validated by Insikt Group, and 14 were exclusively surfaced through honeypot data. The 94 vulnerabilities identified affected products from 58 vendors, with Linux and Microsoft together accounting for approximately 13% of the vulnerabilities. The remaining exposures spanned network edge and security management appliances; operating systems (OS) and mobile devices; collaboration, content management, and enterprise platforms; artificial intelligence (AI), developer, and automation tools; and operational technology and industrial systems. September reporting also highlighted zero-day exploitation of CVE-2026-88771 and CVE-2026-88772 (NetScaler), as well as renewed exploitation of CVE-2026-35273 (PeopleSoft) against unpatched systems. Quick reference: September 2026 vulnerability table All 80 vulnerabilities below were actively exploited or operationally weaponized in September 2026. This table does not include the 14 CVEs that were exclusively surfaced through honeypot data, which are available to Recorded Future Intelligence Platform customers via the CVE Monthly report.
-
update from oracle.com
Oracle Security Alert Advisory - CVE-2026-35273
oracle.com · 125d ago · June 10th, 2026
Oracle's standalone security alert, showing a page updated date of 2026-06-10T22:45:49Z in its metadata, addresses CVE-2026-35273 in PeopleSoft Enterprise PeopleTools versions 8.61 and 8.62. Oracle states the vulnerability is remotely exploitable without authentication and may result in remote code execution if successfully exploited, calling implementation of the recommended mitigations a high-priority risk reduction measure.
-
update from cisa.gov
CISA KEV: CVE-2026-35273 (Oracle PeopleSoft)
cisa.gov · 124d ago · June 12th, 2026
CISA added CVE-2026-35273 to the Known Exploited Vulnerabilities catalog on June 12, 2026, a missing authentication for critical function flaw (CWE-306) in Oracle PeopleSoft Enterprise PeopleTools that could allow an unauthenticated attacker to obtain takeover. The entry flags known ransomware campaign use, sets a remediation due date of 2026-06-15, and links Oracle's security alert advisory.
-
update from cisa.gov
CISA KEV: CVE-2026-88772 (Citrix NetScaler)
cisa.gov · 17d ago · September 27th, 2026
CISA added CVE-2026-88772 to the Known Exploited Vulnerabilities catalog on September 27, 2026, an improper restriction of operations within the bounds of a memory buffer (CWE-119) in Citrix NetScaler ADC and NetScaler Gateway that could allow remote code execution or denial of service. The entry carries the same 2026-09-30 federal due date and mandatory forensic triage under BOD 26-04, referencing the same Citrix bulletin CTX697096 and the suspected-compromise guidance in CTX694799.
-
mentioned by malware.news
September 2026 CVE Landscape
malware.news · 8h ago · October 13th, 2026
-
update from www.recordedfuture.com
(recordedfuture.com) September 2026 CVE Landscape: Surge in High-Impact Vulnerabilities and AI-Driven Exploitation Campaigns In brief - This
www.recordedfuture.com · 7h ago · October 13th, 2026
(recordedfuture.com) September 2026 CVE Landscape: Surge in High-Impact Vulnerabilities and AI-Driven Exploitation Campaigns In brief - This
via Mastodon https://www.recordedfuture.com/blog/september-2026-cve-landscape