10 RCE Vulnerabilities Defenders Should Prioritize, Including Exploited Zero-Days
Summary
A roundup ranks 10 RCE vulnerabilities across products including Citrix, Cisco, WordPress, and Splunk, detailing exploitation, KEV status, fixes, and mitigation guidance. Several were exploited before fixes were available.
Key points
- Nine of the 10 vulnerabilities are listed in CISA’s Known Exploited Vulnerabilities catalog; five were exploited as zero-days, before fixes existed.
- The roundup covers network-facing products and services including Citrix NetScaler, Cisco Secure Email Gateway, F5 BIG-IP APM, FortiMail, WordPress, Splunk, and Windows IKE.
- Public exploit code is reported for WordPress CVE-2026-87902, Splunk CVE-2026-20253, and Gitea CVE-2026-60004.
- WordPress attacks began within hours of the fix; Splunk exploitation was acknowledged on the day it entered KEV.
- Fortinet’s FortiMail fixes were still listed as upcoming as of October 6, 2026; interim guidance was to disable IBE support or block internet access to the management interface.
- Prioritize exposed systems with confirmed exploitation, then public exploits and unauthenticated flaws; assess potentially compromised appliances as well as patching them.
Article Details
- Vulnerability Types
- Improper input validation
- Memory overflow
- SQL injection
- Heap-based buffer overflow
- Improper certificate validation
- Path traversal
- NULL byte handling
- Local file inclusion
- Double free
- Missing authentication
- Arbitrary file write
- Code injection
- Deserialization of untrusted data
- Severity
- CVSS scores range from 9.2 to 10.0 across the listed vulnerabilities.
- Affected Versions
- WordPress Core 4.7.0 and later
- Windows 10
- Windows 11
- Windows Server
- Gitea versions before 1.27.1
- FortiMail 7.4 versions before 7.4.9
- FortiMail 7.6 versions before 7.6.7
- FortiMail 8.0 versions before 8.0.2
- Exploitation Status
- active
- Exploit Availability
- public_exploit
- Patch Status
- partial
- Workarounds
- For FortiMail CVE-2026-104286, disable Identity-Based Encryption (IBE) support or block internet access to the management interface.
MITRE ATT&CK
CVE
CVE-2026-1042865. FortiMail Zero-Day RCE (CVE-2026-104286)CVE-2026-202538. Splunk Enterprise RCE (CVE-2026-20253)CVE-2026-338247. Windows IKE Extension RCE (CVE-2026-33824)CVE-2026-600049. Gitea Git Hook RCE (CVE-2026-60004)CVE-2026-6983610. Microsoft Entra ID RCE (CVE-2026-69836)CVE-2026-764612. Cisco Secure Email Gateway RCE (CVE-2026-76461)CVE-2026-851024. Check Point RCE Flaws (CVE-2026-85102, CVE-2026-93616)CVE-2026-879026. WordPress Core RCE (CVE-2026-87902)CVE-2026-887711. Citrix NetScaler RCE Zero-Days (CVE-2026-88771, CVE-2026-88772)CVE-2026-887721. Citrix NetScaler RCE Zero-Days (CVE-2026-88771, CVE-2026-88772)CVE-2026-88779Citrix later disclosed a third zero-day, CVE-2026-88779 (8.7 CVSS v4.0), affecting SAML-enabled appliances.CVE-2026-936164. Check Point RCE Flaws (CVE-2026-85102, CVE-2026-93616)CVE-2026-941273. F5 BIG-IP APM RCE (CVE-2026-94127)
People
Vendors
Check PointSecurity Appliances Are Prime Targets: Five of the 10 entries are gateways, email security appliances, or access proxies from Citrix, Cisco, F5, Check Point, and Fortinet.CiscoSecurity Appliances Are Prime Targets: Five of the 10 entries are gateways, email security appliances, or access proxies from Citrix, Cisco, F5, Check Point, and Fortinet.CitrixSecurity Appliances Are Prime Targets: Five of the 10 entries are gateways, email security appliances, or access proxies from Citrix, Cisco, F5, Check Point, and Fortinet.F5Security Appliances Are Prime Targets: Five of the 10 entries are gateways, email security appliances, or access proxies from Citrix, Cisco, F5, Check Point, and Fortinet.FortinetSecurity Appliances Are Prime Targets: Five of the 10 entries are gateways, email security appliances, or access proxies from Citrix, Cisco, F5, Check Point, and Fortinet.MicrosoftCVSS Needs Context: A CVSS 10.0 Microsoft Entra ID flaw required no customer action, while a 9.2 WordPress flaw was under attack on the day it was fixed.SplunkPublic Exploits Shrink the Window: Splunk’s flaw reached the KEV catalog eight days after disclosure, six days after a public proof-of-concept (PoC) appeared, and WordPress sites were attacked on the day the fix shipped.WordPressPublic Exploits Shrink the Window: Splunk’s flaw reached the KEV catalog eight days after disclosure, six days after a public proof-of-concept (PoC) appeared, and WordPress sites were attacked on the day the fix shipped.
Products
BIG-IP APM3. F5 BIG-IP APM RCE (CVE-2026-94127)Cisco AsyncOS SoftwareCisco disclosed CVE-2026-76461 (9.8 CVSS) on September 14, 2026, a SQL injection flaw in the email parsing logic of Cisco AsyncOS Software for Cisco Secure Email Gateway.Cisco Secure Email Gateway2. Cisco Secure Email Gateway RCE (CVE-2026-76461)FortiMailFortinet FortiMailGitea9. Gitea Git Hook RCE (CVE-2026-60004)Microsoft Entra IDCVSS Needs Context: A CVSS 10.0 Microsoft Entra ID flaw required no customer action, while a 9.2 WordPress flaw was under attack on the day it was fixed.NetScaler ADCCitrix NetScaler ADC and GatewaySecurity GatewayCheck Point Security Gateway and Security ManagementSpark Firewallbug in VPN negotiation that lets an unauthenticated attacker run code on Security Gateway and Spark Firewall appliances that use Site-to-Site or Remote Access VPN.Splunk Enterprise8. Splunk Enterprise RCE (CVE-2026-20253)WordPress Core6. WordPress Core RCE (CVE-2026-87902)