CISA Known Exploited Vulnerability Catalog September 2026

CISA KEV
Download Now
CISA KEV Catalog September 2026: 43 Known Exploited Vulnerabilities | Hive Pro Threat Advisory
Threat Digest/CISA KEV/September 2026

CISA Known Exploited Vulnerability Catalog: September 2026

43 vulnerabilities met the criteria for inclusion in CISA's KEV catalog in September 2026, including 16 zero-days and 7 exploited by threat actors in attacks.

43 KEV additions16 zero-days7 actor-linkedBOD 26-04
Published
October 05, 2026
Period
September 2026
KEV additions
43
Zero-days
16
Actor-linked
7
Report type
Digest
Source
CISA KEV
Latest due date
October 03, 2026
Earliest due date
September 05, 2026
01 / Overview

Summary

The Known Exploited Vulnerability (KEV) catalog, maintained by CISA, is the authoritative source of vulnerabilities that have been exploited in the wild. It is recommended that all organizations review and monitor the KEV catalog, prioritize remediation of listed vulnerabilities, and reduce the likelihood of compromise by threat actors. In September 2026, 43 vulnerabilities met the criteria for inclusion in CISA's KEV catalog. Of these, 16 are zero-day vulnerabilities; 7 have been exploited by a threat actor and employed in attacks.

02 / Catalog

Vulnerability Details

CVE IDNameAffected products / versionsCVSSDueCWE / TTPsPatch
CVE-2026-76504Cisco Catalyst SD-WAN Manager Hex EncodingCisco Catalyst SD-WAN Manager: before 20.9.10.1, 20.12.8.2, 20.15.6.1, 20.18.4.1, 26.1.2.1; and 26.29.8Oct 03 2026CWE-177 T1190 T1068Patch
CVE-2026-86950Apple Multiple Products Out-of-Bounds WriteApple Multiple Products: iOS and iPadOS before 26.7.1; macOS Sequoia before 15.8.1; macOS Tahoe before 26.7.18.8Oct 02 2026CWE-787 T1203 T1204.002Patch 1 Patch 2 Patch 3
CVE-2026-88772Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory BufferCitrix NetScaler: ADC before 14.1-73.37 and 13.1-64.23; ADC FIPS before 14.1-73.37; ADC FIPS and NDcPP before 13.1-37.279; Gateway before 14.1-73.37 and 13.1-64.238.1Sep 30 2026CWE-119 T1190 T1499.004Patch
CVE-2026-88771Citrix NetScaler Improper Input ValidationCitrix NetScaler: Same builds as CVE-2026-887729.8Sep 30 2026CWE-20 T1190 T1059Patch
CVE-2026-67279MikroTik RouterOS Improper Enforcement of Behavioral WorkflowMikroTik RouterOS: before 6.49.21 (long-term), 7.23.4 (long-term), 7.24.2 (stable)6.5Sep 28 2026CWE-841 T1190 T1136.001 T1602.002Patch
CVE-2026-65660Microsoft SharePoint Code InjectionMicrosoft SharePoint: Subscription Edition before 16.0.19725.20522; Enterprise Server 2016; Server 20198.8Sep 28 2026CWE-94 T1190 T1059Patch
CVE-2026-87902WordPress Core Remote File InclusionWordPress Core: before 7.1.2, 7.0.6, 6.9.9 and earlier branches back to 4.7.378.1Sep 28 2026CWE-98 T1190 T1059Patch
CVE-2026-5430WSO2 Multiple Products Path TraversalWSO2 Multiple Products: API Manager before 4.6.0.21, 4.5.0.57, 4.4.0.72, 4.3.0.108, 4.2.0.197, 4.1.0.257; API Control Plane, Traffic Manager, Universal Gateway (4.5/4.6 branches)10Sep 27 2026CWE-347 T1190 T1606Patch
CVE-2026-71362Adobe Commerce and Magento Incorrect AuthorizationAdobe Commerce and Magento: Commerce 2.4.9, 2.4.8p5, 2.4.7-p10 and earlier; Commerce B2B 1.5.3 and earlier; Magento Open Source 2.4.9, 2.4.8-p5, 2.4.7-p10 and earlier9.1Sep 27 2026CWE-863 T1190 T1068Patch
CVE-2026-93952Arista VeloCloud Orchestrator Improper Input ValidationArista VeloCloud Orchestrator: on-premises 5.2.0 before 5.2.3.16, 6.1.0 through 6.1.3.7, 6.4.0 before 6.4.2.8, 7.0.0 through 7.0.0.210Sep 25 2026CWE-20 T1190 T1059Patch
CVE-2026-94127F5 BIG-IP APM Heap-based Buffer OverflowF5 BIG-IP APM: 17.0.0 through 17.1.3, 17.5.0 through 17.5.1, 21.1.09.8Sep 25 2026CWE-122 T1190 T1059Patch
CVE-2026-93616Check Point Multiple Products Path TraversalCheck Point Multiple Products: Quantum Security Management and Multi-Domain Security Management R80 through R82.209.8Sep 25 2026CWE-22 T1190Patch
CVE-2026-85102Check Point Multiple Products Improper Certificate ValidationCheck Point Multiple Products: Quantum Security Gateway on Gaia OS R80 through R82.10; Gaia Embedded R81.10.00 through R81.10.17 and R82.00.00 through R82.00.109.8Sep 25 2026CWE-295 T1190 T1059Patch
CVE-2026-7273Zyxel GS1900 Series Switches Stack-Based Buffer OverflowZyxel GS1900 Series Switches: GS1900-8, 8HP, 10HP, 16, 24, 24E, 24EP, 24HPv2, 48, 48HPv2 firmware before 2.90(xxxx.2)C08.8Sep 24 2026CWE-121 T1210 T1059Patch
CVE-2025-39964Linux Kernel Race ConditionLinux Kernel: from 2.6.38 before 5.10.245, 5.15.194, 6.1.154, 6.6.108, 6.12.49, 6.16.9; 6.17 release candidates5.5Sep 21 2026CWE-362 T1068Patch 1 Patch 2 Patch 3 Patch 4
CVE-2026-53266Linux Kernel Out-of-Bounds WriteLinux Kernel: before 5.10.259, 5.15.210, 6.1.176, 6.6.143, 6.12.94, 6.18.36, 7.0.13 (from 5.4.73, 5.8.17, 5.9.2); 7.1 release candidates8.8Sep 21 2026CWE-787 T1068Patch 1 Patch 2 Patch 3 Patch 4
CVE-2025-39682Linux Kernel Improper Check for Unusual or Exceptional ConditionsLinux Kernel: from 6.0 before 6.1.149, 6.6.103, 6.12.44, 6.16.4; 6.17 release candidates9.8Sep 21 2026CWE-754 T1068Patch 1 Patch 2 Patch 3 Patch 4 Patch 5
CVE-2026-58704Google Pixel Improper AuthorizationGoogle Pixel: Google Android (Cellular Modem component; NVD lists no specific versions)8.8Sep 19 2026CWE-285 T1404Patch
CVE-2026-76460Cisco Identity Services Engine Incorrect Use of Privileged APIsCisco Identity Services Engine: ISE 3.1, 3.2, 3.3, 3.4, 3.5; ISE-PIC 3.1, 3.2, 3.3, 3.410Sep 19 2026CWE-648 T1190 T1059Patch
CVE-2026-87886Acronis Backup Incorrect Default PermissionsAcronis Backup: cPanel & WHM plugin before build 1.9.3.1021; Plesk extension before 1.8.11.638; DirectAdmin plugin before 1.2.3.238 (Linux)7.8Sep 19 2026CWE-276 T1068Patch
CVE-2026-76461Cisco Secure Email Gateway SQL InjectionCisco Secure Email Gateway: AsyncOS before 15.5.5-014, 16.0.4-302, 16.5.0-7809.8Sep 17 2026CWE-89 T1190 T1059Patch
CVE-2026-84869ConnectWise ScreenConnect Improper Privilege Management and Missing AuthorizationConnectWise ScreenConnect: client before 26.6.5.97429.9Sep 14 2026CWE-269 T1219 T1059.005 T1570Patch
CVE-2026-42016JFrog Artifactory Incorrect AuthorizationJFrog Artifactory: Self-Hosted before 7.133.118.8Sep 25 2026CWE-863 T1190 T1068Patch
CVE-2026-42018JFrog Artifactory Improper AuthenticationJFrog Artifactory: before 7.111.20, 7.117.27, 7.125.19, 7.133.28, 7.146.87.5Sep 25 2026CWE-287 T1190Patch
CVE-2026-85706GitLab Community and Enterprise Edition Path TraversalGitLab CE/EE: from 18.7 before 18.11.12, 19.0.9, 19.1.8, 19.2.6, 19.3.210Sep 14 2026CWE-22 T1190 T1005Patch
CVE-2026-86060MikroTik RouterOS Improper Neutralization of Argument Delimiters in a CommandMikroTik RouterOS: before 6.49.21 (long-term), 7.23.4 (long-term), 7.24.2 (stable)9.8Sep 13 2026CWE-88 T1190 T1068 T1136.001Patch
CVE-2026-67277MikroTik RouterOS Missing Authentication for Critical FunctionMikroTik RouterOS: before 6.49.21 (long-term), 7.23.4 (long-term), 7.24.2 (stable)8.2Sep 13 2026CWE-306 T1190 T1499.004Patch
CVE-2026-19490Citrix NetScaler Authentication Bypass Using an Alternate Path or ChannelCitrix NetScaler: ADC and Gateway 14.1 through 14.1-73.32 and 13.1 through 13.1-63.21; ADC FIPS and NDcPP before 13.1-37.2779.8Sep 12 2026CWE-288 T1190 T1133Patch
CVE-2025-25249Fortinet Multiple Products Heap-based Buffer OverflowFortinet Multiple Products: FortiOS 6.4 all, 7.0.0-7.0.17, 7.2.0-7.2.11, 7.4.0-7.4.8, 7.6.0-7.6.3; FortiSwitchManager 7.0.0-7.0.5, 7.2.0-7.2.6; FortiSASE 25.1.39, 25.1.519.8Sep 12 2026CWE-122 T1190 T1552.001 T1090Patch
CVE-2026-87491Google Chromium V8 Out of Bounds WriteGoogle Chromium V8: Google Chrome before 153.0.8010.36
Linked: APT31 group set (see below)		8.8Sep 23 2026CWE-787 T1566.002 T1203 T1211Patch
CVE-2026-20079Cisco Firewall Management Center Authentication Bypass Using an Alternate Path or ChannelCisco Secure Firewall Management Center (FMC) and Security Cloud Control (SCC) Firewall Management: FMC Software 7.0, 7.1, 7.2, 7.3, 7.4, 7.6, 7.7, 10.0
Actors: UAT-11823, UAT-12197; malware: Cyclops Blink, JSP web shell, cmd.jar		10Sep 12 2026CWE-288 T1190 T1505.003 T1059.004Patch
CVE-2026-75650Adobe Commerce and Magento Improper Neutralization of Special Elements Used in a Template EngineAdobe Commerce and Magento: Commerce 2.4.9, 2.4.8p5, 2.4.7-p10 and earlier; B2B 1.5.3 and earlier; Magento Open Source 2.4.9, 2.4.8-p5, 2.4.7-p10 and earlier
Malware: StyleSmuggler		10Sep 11 2026CWE-1336 T1190 T1059Patch
CVE-2026-81963Microsoft Windows Link FollowingMicrosoft Windows: Windows 11 23H2 before 10.0.22631.7582, 24H2 before 10.0.26100.9445, 25H2 before 10.0.26200.9445, 26H1 before 10.0.28000.2954; Windows Server 2025 before 10.0.26100.334387.8Sep 22 2026CWE-59 T1068Patch
CVE-2026-86218N-able N-central Static Code InjectionN-able N-central: N-central before 2026.3.1.148.8Sep 11 2026CWE-96 T1190 T1059Patch
CVE-2026-85880Microsoft Windows Heap-Based Buffer OverflowMicrosoft Windows: Windows 10 1607 before 10.0.14393.9512, 1809 before 10.0.17763.9245, 21H2 before 10.0.19044.7725, 22H2 before 10.0.19045.7725; Windows Server 2012 and 2012 R2; Server 2016 before 10.0.14393.9512, 2019 before 10.0.17763.9245, 2022 before 10.0.20348.5622
Linked: APT31 group set (see below)		8.2Sep 22 2026CWE-122 T1068 T1055 T1176.001Patch
CVE-2026-85046Google Chromium V8 Type ConfusionGoogle Chromium V8: Google Chrome before 152.0.7977.82
Linked: APT31 group set (see below)		10Sep 18 2026CWE-843 T1566.002 T1203 T1059.007Patch
CVE-2026-59822BerriAI LiteLLM Improper AuthenticationBerriAI LiteLLM: LiteLLM before 1.84.09.8Sep 16 2026CWE-287 T1190Patch
CVE-2026-48710Kludex Starlette HTTP Request/Response SmugglingKludex Starlette: Starlette from 0.8.3 before 1.0.1
Malware: XMRig; BadHost		6.5Sep 16 2026CWE-444 T1190 T1496.001 T1098.004Patch
CVE-2026-49869Kestra OSS OS Command InjectionKestra OSS: before 1.0.45 and 1.3.21
Malware: XMRig		7.8Sep 05 2026CWE-78 T1190 T1613 T1496.001Patch
CVE-2026-82329JFrog Artifactory Improper AuthenticationJFrog Artifactory: from 7.111.4 before 7.111.21, 7.117.28, 7.125.20, 7.133.29, 7.146.38, 7.161.209.8Sep 05 2026CWE-287 T1190Patch
CVE-2026-9586Sangoma Switchvox SQL InjectionSangoma Switchvox: from 8.2.2.1 before 8.4.0.29.8Sep 05 2026CWE-89 T1190 T1059Patch
CVE-2026-83548SonicWall SMA1000 Appliances Server-Side Request ForgerySonicWall SMA1000 Appliances: SMA 6210, 7210, 8200v before 12.4.3-03526 and 12.5.0-0295210Sep 05 2026CWE-441 T1190 T1090Patch
CVE-2026-83549SonicWall SMA1000 Appliances OS Command InjectionSonicWall SMA1000 Appliances: SMA 6210, 7210, 8200v before 12.4.3-03526 and 12.5.0-029527.8Sep 05 2026CWE-78 T1190 T1059Patch
Actor linkage: Chromium V8 and Windows zero-days

CVE-2026-87491, CVE-2026-85880 and CVE-2026-85046 are linked to APT31 (TA412 / JungleBamboo), UTA0560, UTA0565, UNK_LateNight, UNK_DoubleCheck and UNK_QuietRacket, using the malware GemStone (LONGTALE), SUPERSTOMP, GRIMWEDGE, CLEANGULP and ShadowPad.

03 / Actions

Recommendations

  1. 01
    Patch Before the Due Date
    Prioritize the vulnerabilities listed above and promptly apply patches before the due date provided by CISA.
  2. 02
    Comply with BOD 26-04
    Follow Binding Operational Directive 26-04 from the Cybersecurity and Infrastructure Security Agency (CISA), which outlines the minimum cybersecurity standards that all federal agencies must follow.
  3. 03
    Use Affected-Product Data to Find Assets
    The affected products listed in this report help identify assets affected by KEVs without a scan. Patch these assets with priority to reduce risk.
04 / Sources

References & Patch Links

Patch links for each CVE appear in the table above. Due Date is the CISA-recommended deadline for prioritizing remediation.

What Next?

At Hive Pro, it is our mission to detect the most likely threats to your organization and to help you prevent them from happening.

Book a Demo of HivePro
CISA KEV September 2026 · Report generated October 05, 2026 10:30 AM© 2026 All Rights are Reserved by Hive Pro · www.hivepro.com

Reduce real exposure. Not just vulnerability volume.

Platform

Arbis AI

The Hive Pro Platform

Integrations

OT / ICS Security

Compare

vs Rapid7

vs Tenable

vs Qualys

vs Nucleus

Solutions

Attack Surface Mgmt

Multi-Env Scanners

Exposure Assessment

Security Intelligence

Threat Prioritization

Exposure Validation

By Role

CISO

Vulnerability Managers

Resources

Platform Resources

Blog

Learning Center

Security Guides

Podcast — Threat Talks

Threat Advisories

Threat Digests

Nation-State Cyber Threats

HiveForce Labs

Company

About Us

Our Leadership

Careers

Partner Program

Contact Us

Help Center

Book a Demo
© 2026 Hive Pro. All rights reserved.Privacy PolicyTerms & Conditions