H1 2026 Threat Report Finds Rising CVE Exploitation and Continued Abuse of Trusted Tools

Sep 3, 2026 · Original article ↗

Summary

Insikt Group identified 215 actively exploited CVEs in H1 2026, up 34% year over year. Its report highlights abuse of trusted tools, persistent RAT activity, supply-chain compromises and NFC fraud, while AI mostly augmented existing tradecraft.

Key points

Insikt Group identified 215 actively exploited CVEs, including 60 that combined network reachability, unauthenticated exploitation and remote code execution.
Exploitation was reported or detected before, on or within seven days of NVD disclosure for 81 CVEs; 53 exploited vulnerabilities predated 2025.
AsyncRAT led Recorded Future Malware Intelligence submissions with 59,507 unique hashes and 43,549 unique C2 configurations; submission volume alone did not establish operational diversity.
Observed AI-enabled malware mostly aligned with AIM3 Levels 1–3, supporting tasks such as persistence, UI interpretation and delivery rather than fully autonomous operations.
Supply-chain activity abused package installation scripts, maintainer accounts and developer integrations to harvest credentials and propagate malicious packages into downstream environments.
Android malware including NFCShare and NGate used NFC data theft or relay capabilities to support unauthorized payments and ATM cash-outs.
Magecart campaigns abused trusted services including Google Tag Manager and Stripe; the report recommends exposure prioritization, behavioral correlation, developer-secret protection and payment-page integrity monitoring.

Article Details

Publisher: Recorded Future
Report Period: H1 2026
Scope: Vulnerability exploitation, malware submissions and reporting, AI-enabled threats, ransomware, mobile fraud, software supply-chain compromises, and Magecart activity.
Sample Size: 215 actively exploited CVEs; malware submission and TTP datasets have no total sample size disclosed.
Key Statistics: Insikt Group identified 215 actively exploited CVEs in H1 2026, up 34% from 161 in H1 2025.
Of the 215 exploited CVEs, 142 were network-accessible and exploitable without authentication; 60 also enabled remote code execution.
Public PoC exploits were available for 66 of the 215 exploited CVEs (31%); availability did not establish independent testing or reliable weaponization.
Exploitation was reported or detected before, on, or within seven days of NVD disclosure for 81 of 215 CVEs (38%); the overall median disclosure-to-exploitation interval was 31 days.
AsyncRAT led H1 2026 Malware Intelligence submissions with 59,507 unique hashes and 43,549 unique C2 configurations; submission counts do not establish victim counts.
Recommendations: Inventory internet-facing assets and prioritize patching actively exploited, network-reachable, unauthenticated code-execution vulnerabilities; apply access restrictions and other interim mitigations when patching is delayed.
Correlate exploitation alerts with subsequent command execution, discovery, payload transfer, credential access, outbound C2, and lateral movement.
Protect developer and CI/CD secrets, restrict package-publishing privileges, review package lifecycle scripts, and monitor unauthorized repository creation and dependency changes.
Restrict unapproved remote access tools, monitor backup-service termination and unusual exfiltration, and maintain isolated, regularly tested recovery systems.
Control mobile app sideloading and monitor NFC relay abuse; inventory payment-page scripts and monitor checkout integrity and third-party integration changes.