Week 39, 2026

21–27 September 2026

New CVEs: 2,857
Critical: 227
High: 1,029
Newly exploited: 14
Advisories: 811
Malicious pkgs: 899

Newly exploited 14

Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.

High 8.8
CVE-2026-96951 KEV Oct 13, 2026 Windows Shell Security Feature Bypass Vulnerability
Microsoft · Windows Server 2019 · Windows Server 2019 (Server Core installation) · Windows 10 Version 1809

EPSS 9.8%
Critical 9.5
CVE-2026-88771 KEV Sep 27, 2026 A remote code execution vulnerability exists due to improper input validation, which can allow an unauthenticated attacker to execute arbitrary commands
Citrix NetScaler · Gateway · ADC

EPSS 82%
Critical 9.5
CVE-2026-88772 KEV Sep 27, 2026 Memory overflow vulnerability leading to Remote Code Execution or Denial of Service
Citrix NetScaler · ADC · Gateway

EPSS 77%
Critical 9.8
CVE-2026-85103 ENISA Sep 25, 2026 Heap-based Buffer Overflow in VPN Certificate ASN.1 Decoding
checkpoint · Quantum Security Gateway · Quantum Security Management

EPSS 4.3%
High 8.8
CVE-2026-65660 KEV Sep 25, 2026 Microsoft SharePoint Server Remote Code Execution Vulnerability
Microsoft · Microsoft SharePoint Server 2019 · Microsoft SharePoint Enterprise Server 2016 · Microsoft SharePoint Server Subscription Edition

EPSS 8.2%
High 8.1
CVE-2026-87902 KEV Sep 25, 2026 An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.php` file outside the active theme direct…
WordPress · WordPress

EPSS 96%
Medium 6.9
CVE-2026-67279 KEV Sep 25, 2026 SSH Pre-Authentication Rekey State Bypass in MikroTik RouterOS
MikroTik · RouterOS

EPSS 2.3%
Critical 10.0
CVE-2026-5430 KEV Sep 24, 2026 Authentication Bypass via JWT Algorithm Mismatch in Multiple WSO2 Products Allows Account Takeover
WSO2 · WSO2 API Manager · WSO2 API Control Plane · WSO2 Universal Gateway

EPSS 22%
Critical 9.1
CVE-2026-71362 KEV Sep 24, 2026 Adobe Commerce | Incorrect Authorization (CWE-863)
Adobe · Adobe Commerce · Adobe Commerce B2B · Magento Open Source

EPSS 90%
Critical 10.0
CVE-2026-93952 KEV Sep 22, 2026 Security Advisory 0183
Arista Networks · VeloCloud Orchestrator (VCO) On-Prem

EPSS 1.4%
Critical 9.8
CVE-2026-94127 KEV Sep 22, 2026 BIG-IP APM OAuth vulnerability
F5 · BIG-IP

EPSS 27%
Critical 9.8
CVE-2026-93616 KEV Sep 22, 2026 Directory Traversal and File upload allows execution of arbitrary script on the Management Server
checkpoint · Quantum Security Management

EPSS 92%
Critical 9.8
CVE-2026-85102 KEV Sep 22, 2026 Improper Certificate Validation in Quantum Security Gateway
checkpoint · Quantum Security Gateway

EPSS 54%
High 8.8
CVE-2026-7273 KEV Sep 21, 2026 A stack-based buffer overflow vulnerability in the CGI program of Zyxel GS1900-48HPv2 firmware versions through 2.90(ABTQ.1)C0 could allow a LAN-based, unauthe…
Zyxel · GS1900-8 firmware · GS1900-48 firmware · GS1900-10HP firmware

EPSS 2.8%

Critical new vulnerabilities

Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.

Critical 9.8
CVE-2026-93616 Directory Traversal and File upload allows execution of arbitrary script on the Management Server
checkpoint · Quantum Security Management

EPSS 92%
Critical 9.5
CVE-2026-88771 A remote code execution vulnerability exists due to improper input validation, which can allow an unauthenticated attacker to execute arbitrary commands
Citrix NetScaler · Gateway · ADC

EPSS 82%
Critical 9.5
CVE-2026-88772 Memory overflow vulnerability leading to Remote Code Execution or Denial of Service
Citrix NetScaler · Gateway · ADC

EPSS 77%
Critical 9.8
CVE-2026-94127 BIG-IP APM OAuth vulnerability
F5 · BIG-IP

EPSS 27%
Critical 10.0
CVE-2026-97359 HFS2 2.4.0 RCE via Multipart Upload Filename Template Injection
rejetto · hfs2

EPSS 5.5%
Critical 9.9
CVE-2026-19599 Remote Code Execution vulnerability
Zohocorp · ManageEngine OpManager

EPSS 5.1%
Critical 9.8
CVE-2026-74849 Remote code execution vulnerability
Zohocorp · ManageEngine ADSelfService Plus

EPSS 4.6%
Critical 9.8
CVE-2026-82901 Ultra Addons for Contact Form 7 <= 3.5.50 - Unauthenticated Arbitrary File Upload via Signature Form Field
themefic · Ultra Addons for Contact Form 7

EPSS 4.3%
Critical 9.3
CVE-2026-88773 HTTP Request Smuggling
Citrix NetScaler · Gateway · ADC

EPSS 3.1%
Critical 9.8
CVE-2026-43641 Softaculous Virtualizor OS Command Injection via Billing Module Handler
Softaculous · Virtualizor

EPSS 3%
Critical 9.8
CVE-2026-12227 Visual Composer Website Builder <= 45.16.0 - Unauthenticated Local File Inclusion via 'vcv-template' Parameter
visualcomposer · Visual Composer Website Builder

EPSS 2.8%
Critical 10.0
CVE-2026-86708 Sensitive data exposure
Zohocorp · ManageEngine Applications Manager

EPSS 2.7%
Critical 9.1
CVE-2026-94098 Netcore NBR200V2 Firmware Upgrade CGI Endpoint upgrade command injection
Netcore · NBR200V2

EPSS 2.4%
Critical 9.8
CVE-2026-18143 Request a Quote for WooCommerce <= 2.9.2 - Unauthenticated Arbitrary File Upload via AJAX Popup Handler
Addify · Request a Quote for WooCommerce

EPSS 2.1%
Critical 9.8
CVE-2026-95675 D-Link DAP-1360 6.14 Unauthenticated RCE via Web Management Interface
D-Link · DAP-1360

EPSS 2.1%

All 227 critical vulnerabilities of the week, day by day →

Not critical, but likely targeted

New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.

High 8.1
CVE-2026-87902 An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.php` file outside the active theme direct…
WordPress · WordPress

EPSS 96%
Medium 4.3
CVE-2026-96652 Plex Media Server SSRF
Plex · Media Server

EPSS 12%
Medium 4.3
CVE-2026-96655 Plex Media Server arbitrary-host SSRF
Plex · Media Server

EPSS 11%
High 8.8
CVE-2026-76978 Command Injection vulnerability
Zohocorp · ManageEngine OpManager · ManageEngine Firewall Analyzer

EPSS 8.1%
High 8.8
CVE-2026-86677 Broken Authentication vulnerability
Zohocorp · ManageEngine Applications Manager

EPSS 5.1%
High 8.8
CVE-2026-100852 AzuraCast before 0.23.8 Command Injection via Streamer Username
AzuraCast · AzuraCast

EPSS 4.6%
High 8.8
CVE-2026-15027 Changing｜CGServiSign - OS Command Injection
Changing · CGServiSign

EPSS 3.2%
High 8.8
CVE-2026-85542 IBM Guardium Data Protection is affected by multiple vulnerabilities.
IBM · Guardium Data Protection

EPSS 3%

Advisories

USN-8728-2 linux-azure-7.0 vulnerabilities 1417 CVEs
openSUSE-SU-2026:11880-1 kernel-devel-7.2.7-1.1 on GA media 904 CVEs
openSUSE-SU-2026:21910-1 Security update for the Linux Kernel 885 CVEs
SUSE-SU-2026:23887-1 Security update for the Linux Kernel 885 CVEs
SUSE-SU-2026:23902-1 Security update for the Linux Kernel 885 CVEs
SUSE-SU-2026:23897-1 Security update for the Linux Kernel 885 CVEs
SUSE-SU-2026:23881-1 Security update for the Linux Kernel 885 CVEs
USN-8668-2 linux-raspi vulnerabilities 763 CVEs
USN-8800-1 linux-nvidia-bos vulnerabilities 552 CVEs
USN-8726-4 linux-azure, linux-oracle vulnerabilities 551 CVEs