Recorded Future Reports 94 High-Impact Vulnerabilities in September 2026, Including 80 Actively Exploited
Summary
Recorded Future identified 94 high-impact vulnerabilities in September 2026; 80 were actively exploited or weaponized. The report highlights zero-days, AI-assisted campaigns, and exploitation leading to credential theft, backdoors, data theft, and ransomware.
Key points
- Of the 94 vulnerabilities, 59 received a Very Critical risk score; 43 were identified through CISA’s KEV catalog, 37 through open sources, and 14 through honeypot data.
- The report lists 80 vulnerabilities as actively exploited or operationally weaponized; 47 of the 94 enabled remote code execution.
- September reporting highlighted zero-day exploitation of CVE-2026-88771 and CVE-2026-88772 in NetScaler, and renewed exploitation of CVE-2026-35273 in PeopleSoft.
- A suspected Russian-speaking actor used hundreds of AI agents to exploit PaperCut NG/MF flaws, compromising at least 440 instances associated with 395 organizations.
- Three threat clusters exploited Cisco Secure FMC vulnerabilities, with reported outcomes including authentication-data theft, configuration exfiltration, Cyclops Blink deployment, and Qilin ransomware.
- The report describes campaigns using vulnerabilities across internet-facing products to deploy backdoors, establish persistence, steal credentials or data, and move laterally.
Article Details
- Publisher
- Recorded Future (Insikt Group)
- Report Period
- September 2026
- Scope
- High-impact vulnerabilities prioritized for remediation and threat activity reported during September 2026.
- Sample Size
- 94 high-impact vulnerabilities; the actively exploited table lists 80 and excludes 14 surfaced exclusively through honeypot data.
- Key Statistics
- 94 high-impact vulnerabilities were identified; 59 had a Very Critical Recorded Future Risk Score.
- The total was 29% higher than the previous month.
- 43 vulnerabilities were surfaced through CISA's KEV catalog, 37 through open sources and validated by Insikt Group, and 14 exclusively through honeypot data.
- 47 of the 94 vulnerabilities enabled remote code execution; public PoC exploits or scanners were identified for 75.
- At least 440 PaperCut NG/MF instances associated with 395 organizations were reportedly compromised by a suspected Russian-speaking actor.
- Recommendations
- Prioritize vulnerabilities based on likelihood of exploitation as well as severity, and patch the vulnerabilities that matter most.
- Identify internet-facing assets vulnerable to specific CVEs and discover, prioritize, and respond to vulnerable or misconfigured assets.
- Assess vulnerabilities in vendors' and partners' internet-facing systems.
- Verify the validity and efficacy of public PoCs before testing them.
CVE
CVE-2014-6271CVE-2014-6271CVE-2016-4437CVE-2016-4437CVE-2019-0708CVE-2019-0708CVE-2020-1938CVE-2020-1938CVE-2021-29441CVE-2021-29441CVE-2021-38003CVE-2021-38003CVE-2021-43798CVE-2021-43798CVE-2021-44228CVE-2021-44228CVE-2022-0847CVE-2022-0847CVE-2022-22965CVE-2022-22965CVE-2023-54391CVE-2023-54391CVE-2024-21762CVE-2024-21762CVE-2024-4956CVE-2024-4956CVE-2025-25249CVE-2025-25249CVE-2025-39682CVE-2025-39682CVE-2025-39964CVE-2025-39964CVE-2026-19490CVE-2026-19490CVE-2026-20079CVE-2026-20079CVE-2026-20316CVE-2026-20316CVE-2026-34908CVE-2026-34908CVE-2026-34909CVE-2026-34909CVE-2026-34910CVE-2026-34910CVE-2026-35273September reporting also highlighted zero-day exploitation of CVE-2026-88771 and CVE-2026-88772 (NetScaler), as well as renewed exploitation of CVE-2026-35273 (PeopleSoft) against unpatched systems.CVE-2026-39987CVE-2026-39987CVE-2026-42016CVE-2026-42016CVE-2026-42018CVE-2026-42018CVE-2026-48710CVE-2026-48710CVE-2026-49869CVE-2026-49869CVE-2026-51990CVE-2026-51990CVE-2026-53266CVE-2026-53266CVE-2026-5430CVE-2026-5430CVE-2026-54569CVE-2026-54569CVE-2026-56271CVE-2026-56271CVE-2026-58046CVE-2026-58046CVE-2026-58704CVE-2026-58704CVE-2026-59822CVE-2026-59822CVE-2026-60004CVE-2026-60004CVE-2026-60137CVE-2026-60137CVE-2026-63030CVE-2026-63030CVE-2026-64637CVE-2026-64637CVE-2026-65660CVE-2026-65660CVE-2026-67276CVE-2026-67276CVE-2026-67277CVE-2026-67277CVE-2026-67279CVE-2026-67279CVE-2026-67394CVE-2026-67394CVE-2026-71362CVE-2026-71362CVE-2026-7273CVE-2026-7273CVE-2026-75650CVE-2026-75650CVE-2026-76460CVE-2026-76460CVE-2026-76461CVE-2026-76461CVE-2026-76504CVE-2026-76504CVE-2026-79756CVE-2026-79756CVE-2026-81578CVE-2026-81578CVE-2026-81963CVE-2026-81963CVE-2026-82078CVE-2026-82078CVE-2026-82329CVE-2026-82329CVE-2026-83548CVE-2026-83548CVE-2026-83549CVE-2026-83549CVE-2026-84869CVE-2026-84869CVE-2026-85046CVE-2026-85046CVE-2026-85102CVE-2026-85102CVE-2026-85706CVE-2026-85706CVE-2026-85880CVE-2026-85880CVE-2026-86060CVE-2026-86060CVE-2026-86124CVE-2026-86124CVE-2026-86218CVE-2026-86218CVE-2026-86950CVE-2026-86950CVE-2026-87491CVE-2026-87491CVE-2026-87886CVE-2026-87886CVE-2026-87902CVE-2026-87902CVE-2026-88771September reporting also highlighted zero-day exploitation of CVE-2026-88771 and CVE-2026-88772 (NetScaler), as well as renewed exploitation of CVE-2026-35273 (PeopleSoft) against unpatched systems.CVE-2026-88772September reporting also highlighted zero-day exploitation of CVE-2026-88771 and CVE-2026-88772 (NetScaler), as well as renewed exploitation of CVE-2026-35273 (PeopleSoft) against unpatched systems.CVE-2026-89026CVE-2026-89026CVE-2026-93616CVE-2026-93616CVE-2026-93952CVE-2026-93952CVE-2026-94127CVE-2026-94127CVE-2026-9586CVE-2026-9586
Threat Actors
NightEagleLinked to GhostContainer deployments and reported exploitation of vulnerabilities, including CVE-2019-0708.Red HeronLinked by a Recorded Future assessment to broad exploitation and targeting; the report says a suspected Chinese-speaking actor was the same as or related to Red Heron.ShinyHuntersIdentified in the source as another name for UNC6240, which reportedly exploited exposed PeopleSoft environments using CVE-2026-35273.UAT-11823Exploited CVE-2026-20079 and CVE-2026-20316 against Cisco Secure Firewall Management Center, reportedly exfiltrating configurations and deploying Cyclops Blink.UAT-11988Exploited CVE-2026-20316 against Cisco Secure Firewall Management Center and deployed Qilin ransomware.UAT-12197Exploited CVE-2026-20079 against Cisco Secure Firewall Management Center, gaining root access and deploying a web shell and command executor.UNC3569Reportedly exploited CVE-2026-51990 and deployed the GRAYRABBIT backdoor.UNC6240Reportedly exploited exposed PeopleSoft environments using CVE-2026-35273; also identified in the source as ShinyHunters.
Malware
Cyclops Blinkdeployments, while Cisco FMC exploitation by three threat clusters led to credential theft, Cyclops Blink deployment, and Qilin ransomware.GhostContainerSeptember reporting linked NightEagle and UNC3569 to GhostContainer and GRAYRABBIT deployments, while Cisco FMC exploitation by three threat clusters led to credential theft, Cyclops Blink deployment, and QilinGRAYRABBITSeptember reporting linked NightEagle and UNC3569 to GhostContainer and GRAYRABBIT deployments, while Cisco FMC exploitation by three threat clusters led to credential theft, Cyclops Blink deployment, and QilinMeshAgentPeopleSoft environments to execute commands, deploy web shells, install the SIDEEYE backdoor and MeshAgent, and establish tunnels for internal discovery and lateral movement.QilinCisco FMC exploitation by three threat clusters led to credential theft, Cyclops Blink deployment, and Qilin ransomware.SIDEEYEexploited exposed PeopleSoft environments to execute commands, deploy web shells, install the SIDEEYE backdoor and MeshAgent, and establish tunnels for internal discovery and lateral movement.
Vendors
AcronisAcronis Backup integrations for cPanel & WHM, Plesk, and DirectAdminCitrixCitrix NetScaler ADC and GatewayGoogleGoogle ChromeGreyNoiseGreyNoise observed attempts to install a web shell and establish privileged access, although the threat actor did not gain a foothold on its monitored sensor.KasperskyKaspersky reported that the group used compromised virtual private network credentials, extracted Exchange cryptographic keys, modified VIEWSTATE, and executed GhostContainer in memory.MandiantMandiant and Google Threat Intelligence Group reported that UNC6240, also known as ShinyHunters, exploited exposed PeopleSoft environments to execute commands, deploy web shells, install the SIDEEYE backdoor andMicrosoftThe 94 vulnerabilities identified affected products from 58 vendors, with Linux and Microsoft together accounting for approximately 13% of the vulnerabilities.Rapid7A Metasploit pull request by Rapid7 reported unauthenticated command execution with the affected service account’s privileges and disruption of an application feature until restart.Recorded FutureIn September 2026, Insikt Group® identified 94 high-impact vulnerabilities to prioritize for remediation, 59 of which had a Very Critical Recorded Future Risk Score.watchTowRCitrix confirmed exploitation, while watchTowr shared a script to detect the vulnerability.
Products
Acronis Backup integrations for cPanel & WHM, Plesk, and DirectAdminAcronis Backup integrations for cPanel & WHM, Plesk, and DirectAdminAdobe CommerceAdobe Commerce and Magento Open SourceAlibaba NacosAlibaba NacosApache Log4j2Apache Log4j2Apache ShiroApache ShiroApache TomcatApache TomcatAPI Control PlaneWSO2 Universal Gateway, Traffic Manager, and API Control PlaneApple iOSApple iOS, iPadOS, and macOSArista VeloCloud OrchestratorArista VeloCloud OrchestratorCheck Point Management ServerCheck Point Management ServerCheck Point Security GatewayCheck Point Security Gateway and Spark FirewallCisco Catalyst SD-WAN ManagerCisco Catalyst SD-WAN ManagerCisco ISECisco ISE and ISE-PICCisco ISE-PICCisco Secure Email GatewayCisco Secure Email GatewayCisco Secure Firewall Management CenterCisco Secure Firewall Management Center (FMC)Cisco Secure FMCCisco Secure FMC and SCC Firewall ManagementConnectWise ScreenConnectConnectWise ScreenConnectElementor Pro for WordPressElementor Pro for WordPressF5 BIG-IP APMF5 BIG-IP APMFlowiseFlowiseFortiOSFortinet FortiOS and FortiSwitchManagerFortiProxyFortinet FortiProxy and FortiOSFortiSwitchManagerFortinet FortiOS and FortiSwitchManagerGiteaGiteaGitLab CE/EEGitLab CE/EEGNU BashGNU BashGoogle ChromeGoogle ChromeGoogle PixelGoogle Pixel (modem)GrafanaGrafanaHKUDS AutoAgentHKUDS AutoAgentiPadOSApple iOS, iPadOS, and macOSJFrog ArtifactoryJFrog ArtifactoryKestra OSSKestra OSSLinux kernelLinux kernelLiteLLMLiteLLMmacOSApple iOS, iPadOS, and macOSMagento Open SourceAdobe Commerce and Magento Open SourceMarimoMarimoMicrosoft ExchangeA separate Validated Intelligence Event reported that NightEagle deployed the GhostContainer backdoor on Microsoft Exchange servers associated with Russian companies.Microsoft SharePoint ServerMicrosoft SharePoint ServerMicrosoft Windows ALPCMicrosoft Windows ALPCMicrosoft Windows Update StackMicrosoft Windows Update StackMikroTik RouterOSMikroTik RouterOSN-able N-centralN-able N-centralNetScaler ADCCitrix NetScaler ADC and GatewayNetScaler GatewayA TTP Instance detailed CVE-2026-88771, an improper input validation vulnerability in NetScaler ADC and NetScaler Gateway that can enable unauthenticated root command execution.NuclioNuclioPaperCut NG/MFPaperCut NG/MFPeopleSoft Enterprise PeopleToolsOracle PeopleSoft Enterprise PeopleToolsProxmox Virtual Environment (VE)Proxmox Virtual Environment (VE)SenaiteSenaiteSogou Input MethodSogou Input MethodSonatype Nexus RepositorySonatype Nexus RepositorySonicWall SMA1000SonicWall SMA1000Spark FirewallCheck Point Security Gateway and Spark FirewallSpring FrameworkSpring FrameworkStarletteStarlette and affected Red Hat productsSuper Forms for WordPressSuper Forms for WordPressTencent Sogou Input MethodAnother Validated Intelligence Event described UNC3569's active exploitation of CVE-2026-51990 affecting Tencent Sogou Input Method.Traffic ManagerWSO2 Universal Gateway, Traffic Manager, and API Control PlaneUbiquiti UniFi OSUbiquiti UniFi OSWebPros PleskWebPros PleskWooCommerce Wholesale Lead Capture for WordPressWooCommerce Wholesale Lead Capture for WordPressWordPress CoreWordPress CoreWSO2 Universal GatewayWSO2 Universal Gateway, Traffic Manager, and API Control PlaneZyxel GS1900 series switchesZyxel GS1900 series switches
Tools
ClaudeA suspected Chinese-speaking actor used a SecFlow-based environment with Claude-, Qwen-, and DeepSeek-backed workers, and a suspected Russian-speaking actor used hundreds of AI agents to compromise at least 440 PaperCutDeepSeekA suspected Chinese-speaking actor used a SecFlow-based environment with Claude-, Qwen-, and DeepSeek-backed workers, and a suspected Russian-speaking actor used hundreds of AI agents to compromise at least 440 PaperCutImpacketadministrative and remote-access privileges, then used tunneling tools, Remote Desktop Protocol, and Impacket to enable lateral movement and maintain access.Metasploit FrameworkA Metasploit pull request by Rapid7 reported unauthenticated command execution with the affected service account’s privileges and disruption of an application feature until restart.NucleiDownload Nuclei templates created by Insikt Group® for select CVEs to detect actively exploited vulnerabilities.QwenA suspected Chinese-speaking actor used a SecFlow-based environment with Claude-, Qwen-, and DeepSeek-backed workers, and a suspected Russian-speaking actor used hundreds of AI agents to compromise at least 440 PaperCutSecFlowA suspected Chinese-speaking actor used a SecFlow-based environment with Claude-, Qwen-, and DeepSeek-backed workers, and a suspected Russian-speaking actor used hundreds of AI agents to compromise at least 440 PaperCut