Recorded Future Reports 215 Actively Exploited CVEs and Expanding Supply-Chain Threats in H1 2026

Sep 3, 2026 · Original article ↗

Summary

Recorded Future’s H1 2026 review identifies 215 actively exploited CVEs, persistent RAT and ransomware activity, growing supply-chain compromises, and AI-assisted attacks that mostly augment established tradecraft.

Key points

The report identified 215 actively exploited CVEs, up 34% year over year; 142 were both network-accessible and exploitable without authentication, and 60 of those enabled remote code execution.
Attackers continued to exploit both recent and older vulnerabilities, often reusing post-exploitation tools and procedures across different initial access flaws.
RATs remained prominent, with AsyncRAT leading malware submissions; ransomware operators continued to use social engineering, legitimate administration tools, and techniques that hinder recovery.
AI-enabled malware mostly used AI for discrete tasks, such as interpreting mobile interfaces or improving persistence, rather than autonomous operations.
Supply-chain attacks abused package managers, developer credentials, CI/CD systems, and AI-enabled developer tooling to steal secrets and propagate compromise.
Android NFC malware enabled payment-card theft, unauthorized contactless transactions, and ATM cash-outs; Magecart campaigns hid skimming activity in trusted e-commerce services and checkout workflows.
Recommended defenses include prioritizing exposed, remotely exploitable vulnerabilities; correlating suspicious behavior; protecting developer credentials and backups; and monitoring mobile and payment environments.

Article Details

Publisher: Recorded Future
Report Period: 2026-01-01 to 2026-06-30
Scope: Actively exploited vulnerabilities, malware submissions, reported intrusion activity, mobile fraud, supply-chain compromises, and web skimming.
Sample Size: 215 actively exploited CVEs; detailed MITRE ATT&CK mappings for 114. Total malware submission sample size not disclosed.
Key Statistics: Insikt Group identified 215 actively exploited CVEs in H1 2026, up 34% from 161 in H1 2025.
Of 215 exploited CVEs, 142 were network-accessible and exploitable without prior authentication; 60 of these also enabled remote code execution.
Exploitation was reported or detected a median of 31 days after disclosure, versus an average of 564 days; 81 of 215 CVEs were exploited before, on, or within seven days of NVD disclosure.
H1 2026 Malware Intelligence submissions contained 59,507 unique AsyncRAT hashes and 43,549 unique C2 configurations; submissions exclude selected polymorphic, defunct, or seized families.
Public reporting identified a 188% increase in NFC-based Android attacks between January and April 2026.
Recommendations: Inventory internet-exposed assets and prioritize patching actively exploited, unauthenticated, remotely reachable code-execution vulnerabilities; apply access restrictions, segmentation, WAF rules, or IPS signatures when patching is delayed.
Correlate endpoint and network telemetry across execution, discovery, payload transfer, credential access, C2, and lateral movement rather than treating individual alerts in isolation.
Protect developer and CI/CD credentials with least privilege, review package lifecycle scripts, and monitor unauthorized repository creation, dependency changes, and AI-tool configuration hooks.
Restrict unapproved remote access software, monitor backup-service termination and endpoint-security disabling, and maintain isolated, regularly tested recovery systems.
Enforce mobile application and device-management controls, and monitor payment pages and third-party integrations for unauthorized scripts, fake payment forms, NFC relay activity, and transaction manipulation.