As cited
Copy frozen at (site build).
vulnerabilities
September 2026 CVE Landscape
In September 2026, Insikt Group identified 94 high-impact vulnerabilities for remediation, a 29% increase from August, with 59 rated Very Critical. Forty-three were tracked in the CISA Known Exploited Vulnerabilities catalog, 37 surfaced through open sources, and 14 through honeypot data. The vulnerabilities affected 58 vendors across network edge and security appliances, operating systems, collaboration platforms, artificial intelligence (AI) tools, and operational technology systems, with zero-day exploitation of CVE-2026-88771 and CVE-2026-88772 in Citrix NetScaler and renewed attacks on CVE-2026-35273 in unpatched PeopleSoft systems. Threat actors deployed AI-assisted campaigns combining older vulnerabilities with post-compromise tooling, including a Chinese-speaking actor leveraging Claude, Qwen, and DeepSeek-backed workers and a Russian-speaking actor using hundreds of AI agents to compromise 440 PaperCut NG/MF instances across 395 organizations.
Why it matters: Vulnerability managers must prioritize the 47 CVEs enabling remote code execution (RCE) and track the 75 vulnerabilities with public proof-of-concept (PoC) exploits, particularly Citrix NetScaler, PeopleSoft, network edge, and security appliance products that are actively exploited. Organizations running unpatched instances of affected products, especially PaperCut, MikroTik RouterOS, and Cisco systems, face immediate compromise risk from AI-augmented threat actors.
- Source published
- First seen by Cybersecurity Tracker