Audience: Vulnerability Managers, Security Operations, CISOs, DevSecOps Teams
Reading Time: Approximately 10 minutes

Subscribe to get these articles directly to your inbox when published

This Week's KEV Additions

Note: EPSS scores are as published by FIRST.org at time of writing and are not updated after publication; scores change daily.

Analysis

CVE-2026-84869 — ConnectWise / ScreenConnect

• What it is: Missing authorization and improper privilege management in the ScreenConnect client that lets an attacker with an active remote-support session transfer and execute files on the host without authorization or Host confirmation. The ScreenConnect server itself is not affected.

• Affected versions: ScreenConnect client versions prior to 26.6.5.

• Exploitation status: Actively exploited since at least August 20, 2026 (Huntress); observed being used to distribute malicious VBScript payloads to newly connected systems.

• Patch available: Yes — ScreenConnect 26.6.5, released September 8, 2026. On-premises instances must be on 25.4+ before upgrading; cloud deployments are auto-updated server-side but still require host client/agent refresh.

• CISA due date: 2026-09-14

• Operational risk: ScreenConnect is widely deployed by MSPs for remote endpoint management. Exploitation lets an attacker push and execute malicious files on every endpoint reachable through an active session, creating a realistic path from one compromised session to ransomware deployment across an MSP's entire client base.

CVE-2026-42016 — JFrog / Artifactory

• What it is: Incorrect authorization in Artifactory's token handling: the platform validates a token's signature and issuer but not its intended scope, letting a low-privileged token be exchanged for one with administrator scope.

• Affected versions: Self-Hosted Artifactory prior to 7.133.11 (fixed across branches: 7.111.21, 7.117.28, 7.125.20, 7.133.29, 7.146.38, 7.161.20).

• Exploitation status: Actively exploited between August 15 and September 8, 2026 (Wiz Research), chained with CVE-2026-42018.

• Patch available: Yes — upgrade to the fixed version for your release branch.

• CISA due date: 2026-09-25

• Operational risk: Chained with CVE-2026-42018, this flaw lets an attacker escalate an anonymous token to full administrator scope on the software supply-chain repository. Wiz observed persistent admin-account creation, malicious Groovy plugin deployment, and webshell uploads during the campaign.

CVE-2026-42018 — JFrog / Artifactory

• What it is: An improper-authentication flaw that causes Artifactory to return an internal anonymous-user token to an unauthenticated caller, even when anonymous access has been explicitly disabled.

• Affected versions: Prior to 7.111.20, 7.117.27, 7.125.19, 7.133.28, and 7.146.8, depending on branch.

• Exploitation status: Actively exploited as the entry point of the same Artifactory chain described above; discovered by Daniil Vylegzhanin of NetSPI.

• Patch available: Yes — upgrade to the fixed version for your release branch.

• CISA due date: 2026-09-25

• Operational risk: Provides the unauthenticated foothold that CVE-2026-42016 then escalates to full administrator control, so the two flaws should be treated and remediated as a single attack chain rather than independently.

CVE-2026-85706 — GitLab / GitLab CE & EE

• What it is: Improper path confinement and missing authentication enforcement in the repository commits API let an unauthenticated attacker read arbitrary files from an affected, self-managed GitLab server.

• Affected versions: Self-managed GitLab prior to 19.3.2, 19.2.6, and 19.1.8.

• Exploitation status: Actively exploited; watchTowr observed probes within hours of disclosure, with subsequent reports of confirmed exfiltration of configuration files and SSH configurations. Public PoC code is available.

• Patch available: Yes — 19.3.2 / 19.2.6 / 19.1.8, released September 10, 2026.

• CISA due date: 2026-09-14

• Operational risk: Unauthenticated remote attackers can read arbitrary server-side files — including secrets and configuration — from internet-facing self-managed GitLab instances. CISA has flagged the vulnerability for forensic triage under BOD 26-04.

CVE-2026-86060 — MikroTik / RouterOS

• What it is: Improper handling of SSH login usernames beginning with a prohibited character lets an attacker alter the trusted RouterOS policy mask associated with the session, resulting in privilege escalation.

• Affected versions: RouterOS prior to 6.49.21 (Long-term), 7.23.4 (Long-term), and 7.24.2 (Stable).

• Exploitation status: Actively exploited since at least September 2, 2026 as part of the "MikroTrick" chain alongside CVE-2026-67276; CERT Polska observed creation of a privileged "ops" account on compromised devices.

• Patch available: Yes — upgrade to the fixed builds listed above.

• CISA due date: 2026-09-13

• Operational risk: Lets an attacker who reaches the SSH login helper obtain full administrative control of edge/gateway routers. Shadowserver counted over 122,500 internet-facing RouterOS SSH instances in a single scan window during the disclosure period.

CVE-2026-67277 — MikroTik / RouterOS

• What it is: RouterOS accepts a "related" bandwidth-test (btest) connection before the corresponding primary session completes authentication, allowing an unauthenticated client to leak uninitialized kernel packet-buffer memory or trigger a kernel restart via a crafted UDP test.

• Affected versions: RouterOS prior to 6.49.21 (Long-term), 7.23.4 (Long-term), and 7.24.2 (Stable).

• Exploitation status: Listed by VulnCheck as actively exploited; unauthenticated and remotely reachable regardless of confirmed campaign activity.

• Patch available: Yes — upgrade to the fixed builds listed above.

• CISA due date: 2026-09-13

• Operational risk: Allows an unauthenticated remote client to disclose kernel memory or crash the RouterOS kernel via the btest service, enabling both reconnaissance and denial-of-service against edge routers.

CVE-2026-19490 — Citrix (Cloud Software Group) / NetScaler ADC & Gateway

• What it is: An authentication-bypass-using-an-alternate-path-or-channel flaw (CWE-288) that lets a remote, unauthenticated attacker bypass login controls when a NetScaler appliance is configured as an AAA virtual server or as a Gateway (SSL VPN, ICA Proxy, CVPN, or RDP Proxy).

• Affected versions: NetScaler ADC and Gateway 14.1 before build 73.32, and 13.1 before build 63.21 (plus FIPS/NDcPP equivalents).

• Exploitation status: Actively exploited in the wild; CISA added the flaw to KEV based on evidence of exploitation. No ransomware use confirmed at time of writing.

• Patch available: Yes — 14.1-73.32, 13.1-63.21, and corresponding FIPS builds (14.1-73.32 FIPS, 13.1-37.277).

• CISA due date: 2026-09-12

• Operational risk: NetScaler Gateway appliances typically sit at the network edge providing SSL VPN and remote-access services; bypassing authentication here can expose every downstream application and resource reachable through the gateway.

CVE-2025-25249 — Fortinet / FortiOS, FortiSwitchManager, FortiSASE

• What it is: A heap-based buffer overflow that allows an attacker to execute unauthorized code or commands via specially crafted packets.

• Affected versions: FortiOS 7.6.0–7.6.3, 7.4.0–7.4.8, 7.2.0–7.2.11, 7.0.0–7.0.17, and all 6.4 versions; FortiSwitchManager 7.2.0–7.2.6 and 7.0.0–7.0.5.

• Exploitation status: Actively exploited in the wild per CISA.

• Patch available: Yes — fixed in FortiOS 7.6.1, 7.6.2, and 7.6.3 per vendor advisory FG-IR-25-084.

• CISA due date: 2026-09-12

• Operational risk: Fortinet firewall and SD-WAN appliances are frequently internet-facing; a heap overflow reachable via crafted packets can enable remote code or command execution on core perimeter security infrastructure.

CVE-2026-87491 — Google / Chromium V8

• What it is: An out-of-bounds write in V8, Chrome's JavaScript/WebAssembly engine, that allows a remote attacker to execute arbitrary code inside the browser sandbox via a crafted HTML page.

• Affected versions: Google Chrome prior to 153.0.8010.36, and other Chromium-based browsers (e.g., Microsoft Edge, Opera) until they ingest the fix.

• Exploitation status: Actively exploited as a zero-day; discovered and reported by Jihyeon Jeong of Compsec Lab, Seoul National University. Public PoC code chaining this flaw with a separate type-confusion bug (CVE-2026-85046) has since been published.

• Patch available: Yes — Chrome 153 (153.0.8010.36).

• CISA due date: 2026-09-23

• Operational risk: A single crafted web page can achieve code execution inside the browser sandbox on any unpatched endpoint, making this a high-value initial-access vector that is frequently chained with a separate sandbox-escape flaw for full device compromise.

CVE-2026-20079 — Cisco / Secure Firewall Management Center & Security Cloud Control Firewall Management

• What it is: An authentication-bypass-using-an-alternate-path-or-channel flaw (CWE-288) stemming from an improperly created system process at boot time, letting an unauthenticated remote attacker send crafted HTTP requests to the FMC web interface, bypass authentication entirely, and execute scripts and commands as root.

• Affected versions: Cisco Secure FMC Software versions 7.0.0 through 7.7.12, including 10.0.0 and 10.0.1.

• Exploitation status: Confirmed actively exploited; Cisco Talos has tied the attacks to three separate intrusion clusters, including a Sandworm-linked APT and a Qilin ransomware affiliate.

• Patch available: Yes — see Cisco's advisory for fixed FMC/SCC builds.

• CISA due date: 2026-09-12

• Operational risk: Grants unauthenticated attackers root access to the platform that centrally manages an organization's firewalls, enabling both direct compromise of the management plane and pivoting into every firewall it administers.

CVE-2026-75650 — Adobe / Adobe Commerce, Adobe Commerce B2B, Magento Open Source

• What it is: An improper-neutralization-of-special-elements-in-a-template-engine flaw ("StyleSmuggler") that lets an unauthenticated attacker inject and execute PHP code by abusing Magento's template/email-generation system, without requiring the victim to open the resulting email.

• Affected versions: Adobe Commerce 2.4.4–2.4.9; Adobe Commerce B2B 1.3.3–1.5.3; Magento Open Source 2.4.6–2.4.9 (2026-Aug releases).

• Exploitation status: Actively exploited since September 4, 2026 — three days before the vendor hotfix shipped. Sansec has observed a Rust-based Linux backdoor and PHP web shells deployed on compromised storefronts.

• Patch available: Yes — Hotfix VULN-39341, released September 7, 2026 via bulletin APSB26-146.

• CISA due date: 2026-09-11

• Operational risk: Unauthenticated attackers can achieve full server compromise on e-commerce platforms that process customer payment data. CrowdSec recorded over 500 unique attacking IP addresses since disclosure, with any store reachable during the exposure window at risk of backdoor implantation regardless of current patch status.

CVE-2026-81963 — Microsoft / Windows Update Stack

• What it is: Improper link resolution before file access ("link following") in the Windows Update Stack that allows an authorized local attacker to escalate privileges to SYSTEM with no user interaction.

• Affected versions: Windows 11 23H2, 24H2, 25H2, 26H1; Windows Server 2025 (including Server Core).

• Exploitation status: Confirmed exploited in the wild at time of release (September 8, 2026); CVSS vector rates exploit-code maturity as "Functional."

• Patch available: Yes — September 2026 cumulative update (e.g., KB5124008).

• CISA due date: 2026-09-22

• Operational risk: A low-privilege local user or process can escalate to SYSTEM with no user interaction required, making this a high-value post-compromise step for attackers who already have initial local access to a Windows endpoint.

CVE-2026-86218 — N-able / N-central

• What it is: A static code injection vulnerability (CWE-96) in a public-facing N-central application endpoint that allows an unauthenticated attacker to inject and execute arbitrary code on the N-central server before authentication.

• Affected versions: N-central prior to build 2026.3.1.14.

• Exploitation status: Confirmed actively exploited (Huntress); may be chained with authentication-bypass flaws CVE-2026-86206 and CVE-2026-86207 for attacker-controlled administrative account creation. This is the third distinct N-central vulnerability wave exploited within six weeks.

• Patch available: Yes — build 2026.3.1.14 (Hotfix 4).

• CISA due date: 2026-09-11

• Operational risk: N-central is an RMM platform typically managing thousands of endpoints across many downstream client organizations, so unauthenticated pre-auth RCE on the server represents a single point of compromise for an MSP's entire managed estate.

CVE-2026-85880 — Microsoft / Windows ALPC

• What it is: A heap-based buffer overflow combined with use of an uninitialized resource in the Windows Advanced Local Procedure Call (ALPC) subsystem, allowing an attacker who can already execute code inside a low-privilege AppContainer to escape the sandbox and elevate privileges to SYSTEM.

• Affected versions: Windows 10 (1607, 1809, 21H2, 22H2) and Windows Server 2012, 2012 R2, 2016, 2019, and 2022 (standard and Server Core installations).

• Exploitation status: Confirmed actively exploited in the wild; Volexity has linked related spear-phishing activity to Chinese threat actors UTA0560 and JungleBamboo (APT31/Violet Typhoon/TA412) beginning September 1, 2026.

• Patch available: Yes — September 2026 cumulative update.

• CISA due date: 2026-09-22

• Operational risk: Lets an attacker who has already achieved low-privilege code execution — for example, via a sandboxed browser exploit — escape the AppContainer sandbox and obtain SYSTEM privileges, turning an initial foothold into full device compromise.

Exploitation Context

This week's KEV additions are dominated by two patterns: attacks on internet-facing management and edge infrastructure, and disclosure-to-exploitation windows measured in days rather than weeks. RMM and DevOps tooling used to administer other organizations' environments — ConnectWise ScreenConnect, N-able N-central, and JFrog Artifactory — were all confirmed exploited this week, each capable of cascading from one compromised server into many downstream customer or endpoint environments. Perimeter and management-plane appliances from Cisco, Citrix, and MikroTik were also added, with Cisco confirming that CVE-2026-20079 exploitation has been tied by Talos to three separate intrusion clusters, including a Sandworm-linked APT and a Qilin ransomware affiliate.

The Adobe Commerce/Magento "StyleSmuggler" flaw (CVE-2026-75650) was exploited for three days before a patch existed, and the GitLab path-traversal flaw (CVE-2026-85706) saw honeypot probes within hours of disclosure — both illustrate how little runway defenders now have between advisory and active scanning. A Chrome V8 zero-day (CVE-2026-87491) rounds out the week's browser risk and has since been paired with a separate sandbox-escape bug in public exploit code, while two Microsoft local-privilege-escalation flaws (CVE-2026-81963, CVE-2026-85880) provide the kind of post-compromise escalation path that chains naturally after an initial browser or phishing foothold.

Remediation Priorities

Detection and Monitoring Guidance

• CVE-2026-84869 (ScreenConnect):

  • Log Sources: ScreenConnect session/audit logs; host client event logs; EDR process-creation telemetry on managed endpoints.

  • Behavioral Indicators: unexpected file transfers or script execution (e.g., VBScript) initiated through an active session without operator confirmation; new files dropped in temp or startup paths via the client.

  • Monitoring Gap / Detection Artifacts: server-side logs do not capture client-only file transfer or execution, so detection depends on endpoint telemetry and the interim TransferFiles-permission mitigation until clients are upgraded.

• CVE-2026-42016 (Artifactory):

  • Log Sources: Artifactory access logs for token-creation requests; admin audit trail; authentication logs.

  • Behavioral Indicators: a low-privileged identity minting new tokens or enumerating users; admin-scoped tokens tied to non-admin usernames.

  • Monitoring Gap / Detection Artifacts: token scope is not independently logged from signature validity, so alert separately on any admin-token issuance rather than relying on standard authentication logs.

• CVE-2026-42018 (Artifactory):

  • Log Sources: Artifactory access logs for the token endpoint; WAF/reverse-proxy logs.

  • Behavioral Indicators: unauthenticated POST requests to the token endpoint (including trailing-slash variants) receiving a 200 response with a token payload.

  • Monitoring Gap / Detection Artifacts: per Wiz's guidance, a 401 on the bare token path followed by a 200 on a variant path from the same client is the key detection signature.

• CVE-2026-85706 (GitLab):

  • Log Sources: GitLab access/audit logs for the repository commits API; reverse-proxy/WAF logs.

  • Behavioral Indicators: requests to the commits API containing path-traversal sequences or requesting files outside the repository root.

  • Monitoring Gap / Detection Artifacts: no comprehensive campaign-specific IOC set (IPs, domains, hashes) is publicly available yet; rely on request-pattern signatures rather than known indicators.

• CVE-2026-86060 (RouterOS):

  • Log Sources: RouterOS system/user logs; SSH authentication logs.

  • Behavioral Indicators: SSH login attempts using usernames beginning with a dash or other prohibited character; unexpected new user accounts with elevated policy grants.

  • Monitoring Gap / Detection Artifacts: CERT Polska's public write-up documents observed artifacts; no vendor-supplied Sigma or detection ruleset is currently referenced in advisories.

• CVE-2026-67277 (RouterOS):

  • Log Sources: RouterOS system logs for unexpected kernel restarts; network flow logs for btest/UDP traffic from unexpected sources.

  • Behavioral Indicators: unauthenticated "related" btest connections preceding primary session authentication; anomalously large or fragmented UDP test output.

  • Monitoring Gap / Detection Artifacts: restrict btest and management-interface exposure to trusted IPs; no confirmed IOC set has been published.

• CVE-2026-19490 (NetScaler):

  • Log Sources: NetScaler authentication/session logs; AAA virtual server logs.

  • Behavioral Indicators: anomalous authentication events, unexpected new administrator sessions, or configuration modifications without a corresponding admin login.

  • Monitoring Gap / Detection Artifacts: check the NetScaler configuration for "add authentication samlAction," "add authentication vserver," or "add vpn vserver" entries to determine exposure; no official IOC list has been published.

• CVE-2025-25249 (FortiOS):

  • Log Sources: FortiOS system event logs; IPS/IDS logs for crafted-packet signatures.

  • Behavioral Indicators: unexpected process crashes or restarts on affected services; anomalous packet patterns targeting the vulnerable daemon.

  • Monitoring Gap / Detection Artifacts: consult Fortinet advisory FG-IR-25-084 for specific mitigation and detection guidance; no public IOC list was identified in reviewed sources.

• CVE-2026-87491 (Chromium V8):

  • Log Sources: EDR/browser telemetry for anomalous renderer-process behavior; proxy/web logs where available.

  • Behavioral Indicators: unexpected child-process spawning from the browser renderer; sandbox-escape indicators following page navigation.

  • Monitoring Gap / Detection Artifacts: no campaign-specific IOCs are published; given the zero-day nature of exploitation, prioritize rapid browser-update deployment over signature-based detection.

• CVE-2026-20079 (Cisco FMC):

  • Log Sources: FMC web-interface access logs; csm_processes session logs.

  • Behavioral Indicators: unexpected session upgrades using default/static csm_processes credentials; unusual calls to validateLicense or upgradeReadinessCall endpoints.

  • Monitoring Gap / Detection Artifacts: Metasploit and other public exploit modules exist; cross-reference Cisco Talos IOCs linked to the observed Sandworm and Qilin activity.

• CVE-2026-75650 (Adobe Commerce/Magento):

  • Log Sources: web server access logs for checkout/payment-failure email triggers; file-integrity monitoring on template and media directories.

  • Behavioral Indicators: unexpected PHP files written to media or template directories; outbound heartbeat-style traffic in small, fixed-size packets at regular intervals, consistent with the reported backdoor C2 pattern.

  • Monitoring Gap / Detection Artifacts: Sansec has published host, network, and media-directory IOCs; treat any store reachable between September 4, 2026 and patch application as potentially compromised regardless of current patch status.

• CVE-2026-81963 (Windows Update Stack):

  • Log Sources: Windows Security event logs (privilege use, process creation); Windows Update Stack service logs.

  • Behavioral Indicators: unexpected symbolic-link or junction creation in Update Stack working directories, followed by SYSTEM-level process activity.

  • Monitoring Gap / Detection Artifacts: no public IOC set has been identified; prioritize patch deployment given confirmed pre-patch exploitation.

• CVE-2026-86218 (N-central):

  • Log Sources: N-central application/server logs; endpoint agent task-execution logs.

  • Behavioral Indicators: unexpected code execution on the N-central server process; unplanned scripts or tasks pushed to managed endpoints; unfamiliar administrative accounts.

  • Monitoring Gap / Detection Artifacts: review for signs of compromise predating the patch — new admin accounts, unusual console logins, and changed automation policies — before assuming remediation is complete.

• CVE-2026-85880 (Windows ALPC):

  • Log Sources: Windows Security event logs (process creation, privilege use); ALPC-related ETW traces where available.

  • Behavioral Indicators: AppContainer-sandboxed processes making anomalous ALPC calls immediately followed by SYSTEM-level activity.

  • Monitoring Gap / Detection Artifacts: correlate with browser/renderer exploitation telemetry, since this flaw is frequently chained after an initial sandbox compromise rather than used standalone.

Hackerstorm Analysis

The through-line across this week's fourteen additions is management-plane exposure. Seven of the fourteen flaws sit in software whose entire purpose is administering other systems — RMM platforms (ScreenConnect, N-central), a source-code and artifact repository (GitLab, Artifactory), and network/security management consoles (Cisco FMC, Citrix NetScaler, MikroTik RouterOS) — rather than in end-user-facing applications. For defenders, that means the highest-value patching targets this week are rarely the systems users interact with directly; they are the consoles and agents that IT and security teams use to manage everything else, where a single compromise can cascade across an entire managed fleet or client base.

The gap between vendor disclosure and confirmed exploitation continues to compress: Adobe's Magento flaw was under attack three days before a patch existed, and GitLab's path-traversal bug drew honeypot probes within hours of its fix shipping. Teams that wait for a scheduled patch cycle to address KEV-listed vulnerabilities are, in practice, patching after the exploitation window has already opened. Prioritizing this week's Immediate and Within-24-hours items above — all of which involve unauthenticated or actively exploited access to internet-facing management infrastructure — should take precedence over the two local-privilege-escalation entries from Microsoft, which still require a prior foothold to exploit.

Sources

• CVE-2026-84869:

  • Arctic Wolf (Vendor/researcher advisory) — https://arcticwolf.com/resources/blog/cve-2026-84869/

  • SC Media (Threat intel report) — https://www.scworld.com/news/connectwise-screenconnect-bug-exploited-in-the-wild-cisa-says

  • SecurityWeek (Threat intel report) — https://www.securityweek.com/connectwise-patches-screenconnect-vulnerability-exploited-in-worm-like-attacks/

  • Strix.ai CVE database (CVSS/EPSS aggregator, NVD-sourced) — https://www.strix.ai/cve/CVE-2026-84869

  • CISA KEV catalog — https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-84869

• CVE-2026-42016:

  • OpenCVE (NVD-sourced CVE database) — https://app.opencve.io/cve/CVE-2026-42016

  • Strix.ai CVE database (CVSS/EPSS aggregator) — https://www.strix.ai/cve/CVE-2026-42016

  • The Hacker News (Threat intel report, Wiz Research) — https://thehackernews.com/2026/09/attackers-chain-jfrog-artifactory-flaws.html

  • The Hacker News (KEV addition report) — https://thehackernews.com/2026/09/cisa-adds-5-actively-exploited.html

• CVE-2026-42018:

  • OpenCVE (NVD-sourced CVE database) — https://app.opencve.io/cve/CVE-2026-42018

  • Strix.ai CVE database (CVSS/EPSS aggregator) — https://www.strix.ai/cve/CVE-2026-42018

  • DailyCVE (Technical writeup) — https://dailycve.com/jfrog-artifactory-improper-authentication-cve-2026-42018-high-dc-sep2026-2371/

  • The Hacker News (Threat intel report, Wiz Research) — https://thehackernews.com/2026/09/attackers-chain-jfrog-artifactory-flaws.html

• CVE-2026-85706:

  • watchTowr (Vendor/researcher advisory) — https://watchtowr.com/resources/rapid-reaction-gitlab-critical-path-traversal-vulnerability-cve-2026-85706/

  • The Hacker News (Threat intel report) — https://thehackernews.com/2026/09/gitlab-cvss-10-file-read-flaw-draws-in.html

  • Rapid7 (Vendor/researcher advisory) — https://www.rapid7.com/blog/post/etr-cve-2026-85706-critical-gitlab-path-traversal-exploited-in-the-wild/

  • Senserva (EPSS/CVSS aggregator) — https://senserva.com/exploited-this-week.html

• CVE-2026-86060:

  • CERT Polska (Vendor/researcher advisory) — https://cert.pl/en/posts/2026/09/mikrotik-routeros-cve/

  • Exploit-Intel (CVSS/EPSS/KEV aggregator) — https://exploit-intel.com/vuln/CVE-2026-86060

  • CyberPress (Threat intel report) — https://cyberpress.org/cisa-warns-mikrotik-routeros-flaw/

  • CISA (US Government resource, KEV addition alert) — https://www.cisa.gov/news-events/alerts/2026/09/10/cisa-adds-two-known-exploited-vulnerabilities-catalog

• CVE-2026-67277:

  • CERT Polska (Vendor/researcher advisory) — https://cert.pl/en/posts/2026/09/mikrotik-routeros-cve/

  • Exploit-Intel (CVSS/EPSS/KEV aggregator, VulnCheck-sourced) — https://exploit-intel.com/vuln/CVE-2026-67277

  • CISA (US Government resource, KEV addition alert) — https://www.cisa.gov/news-events/alerts/2026/09/10/cisa-adds-two-known-exploited-vulnerabilities-catalog

  • runZero (Vendor/researcher advisory) — https://www.runzero.com/blog/mikrotik-routeros/

• CVE-2026-19490:

  • Rescana (Threat intel report) — https://www.rescana.com/post/citrix-netscaler-cve-2026-19490-authentication-bypass-kev

  • Help Net Security (Threat intel report) — https://www.helpnetsecurity.com/2026/08/21/citrix-netscaler-gateway-cve-2026-19490/

  • Strix.ai CVE database (CVSS aggregator) — https://www.strix.ai/cve/CVE-2026-19490

  • Cybersecurity News (Threat intel report) — https://cybersecuritynews.com/cisa-citrix-netscaler-authentication/

• CVE-2025-25249:

  • Vulnerability-Lookup (NVD/EPSS/CISA KEV aggregator) — https://vulnerability.circl.lu/vuln/CVE-2025-25249

  • AiCybr (Threat intel report) — https://aicybr.com/blog/fortinet-cve-2025-25249-kev

  • Strix.ai CVE database (CVSS/EPSS aggregator) — https://www.strix.ai/cve/CVE-2025-25249

  • Exploit-Intel (CVSS/KEV aggregator) — https://exploit-intel.com/vuln/CVE-2025-25249

• CVE-2026-87491:

  • The Hacker News (Threat intel report) — https://thehackernews.com/2026/09/chrome-v8-zero-day-exploited-in-wild.html

  • Exploit-Intel (CVSS/EPSS/KEV aggregator) — https://exploit-intel.com/vuln/CVE-2026-87491

  • OpenCVE (NVD-sourced CVE database) — https://app.opencve.io/cve/CVE-2026-87491

  • SecurityOnline.info (Threat intel report) — https://securityonline.info/chrome-zero-day-cve-2026-87491/

• CVE-2026-20079:

  • BleepingComputer (Threat intel report) — https://www.bleepingcomputer.com/news/security/cisco-confirms-cve-2026-20079-secure-fmc-flaw-exploited-in-attacks/

  • Forkast (Threat intel report, Cisco Talos-sourced) — https://forkast.news/three-strikes-on-the-firewall-management-plane-cisco-fmc-logs-its-third-cisa-kev-of-2026/

  • ZeroDayHub (Threat intel report) — https://zerodayhub.co.uk/2026/09/12/cisco-secure-fmc-auth-bypass-cve-2026-20079/

  • Exploit-Intel (CVSS/EPSS/KEV aggregator) — https://exploit-intel.com/vuln/CVE-2026-20079

• CVE-2026-75650:

  • Sansec (Vendor/researcher advisory, original discovery) — https://sansec.io/research/stylesmuggler-0day

  • The Hacker News (Threat intel report) — https://thehackernews.com/2026/09/adobe-patches-magento-zero-day.html

  • NetSPI (Vendor/researcher advisory) — https://www.netspi.com/blog/executive-blog/critical-vulnerability/stylesmuggler-adobe-commerce-adobe-commerce-b2b-and-magento-rce-cve-2026-75650/

  • CrowdSec (Threat intel report) — https://www.crowdsec.net/vulntracking-report/cve-2026-75650-stylesmuggler-rce-adobe-commerce-magento

  • Strix.ai CVE database (EPSS aggregator) — https://www.strix.ai/cve/CVE-2026-75650

• CVE-2026-81963:

  • Exploit-Intel (CVSS/EPSS/KEV aggregator) — https://exploit-intel.com/vuln/CVE-2026-81963

  • OpenCVE (NVD-sourced CVE database) — https://app.opencve.io/cve/CVE-2026-81963

  • EndpointWeekly (Threat intel report) — https://endpointweekly.com/blog/cve-2026-81963-windows-update-stack-elevation-privilege.html

  • CISA KEV catalog — https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-81963

• CVE-2026-86218:

  • Arctic Wolf (Vendor/researcher advisory) — https://arcticwolf.com/resources/blog/cve-2026-86218/

  • Vulnerability-Lookup (NVD/EPSS/CISA KEV aggregator) — https://vulnerability.circl.lu/vuln/CVE-2026-86218

  • nFlo (Threat intel report) — https://nflo.tech/knowledge-base/2026-09-08-cve-2026-86218-en/

  • CISA (US Government resource, KEV addition alert) — https://www.cisa.gov/news-events/alerts/2026/09/08/cisa-adds-four-known-exploited-vulnerabilities-catalog

• CVE-2026-85880:

  • Exploit-Intel (CVSS/EPSS/KEV aggregator, Volexity-sourced) — https://exploit-intel.com/vuln/CVE-2026-85880

  • RedLegg (Threat intel report) — https://www.redlegg.com/blog/security-bulletin-multiple-vulnerabilities-affecting-microsoft-windows-update-and-windows-advanced-local-procedure-call-alpc

  • SOC Prime (Threat intel report) — https://socprime.com/blog/cve-2026-85880-and-cve-2026-81963-analysis/

  • Vulnerability-Lookup (NVD/EPSS/CISA KEV aggregator) — https://vulnerability.circl.lu/vuln/CVE-2026-85880

What you should do next

Ensure you understand the latest KEV additions to cover off any potential gaps in your remediation activities.  View all weekly reports here

Further Reading

The following resources offer technical analysis to help integrate CISA KEV data into operational triage workflows and stay aligned with updated mitigation guidance.

About This Report

Attribution Note

This analysis is based on publicly available reporting and security research summaries. Some technical details may change as additional information becomes available. 

Author Information

Timur Mehmet | Founder & Lead Editor

Timur is a veteran Information Security professional with a career spanning over three decades. Since the 1990s, he has led security initiatives across high-stakes sectors, including Finance, Telecommunications, Media, and Energy. Professional qualifications over the years have included CISSP, ISO27000 Auditor, ITIL and technologies such as Networking, Operating Systems, PKI, Firewalls. For more information including independent citations and credentials, visit our About page.

Contact: This email address is being protected from spambots. You need JavaScript enabled to view it.

Editorial Standards

This article adheres to Hackerstorm.com's commitment to accuracy, independence, and transparency:

• Fact-Checking: All statistics and claims are verified against primary sources and authoritative reports
• Source Transparency: Original research sources and citations are provided in the References section below
• No Conflicts of Interest: This analysis is independent and not sponsored by any vendor or organization
• Corrections Policy: We correct errors promptly and transparently. Report inaccuracies to This email address is being protected from spambots. You need JavaScript enabled to view it.

Editorial Policy: Ethics, Non-Bias, Fact Checking and Corrections

Learn More: About Hackerstorm.com | FAQs

Source Transparency

Analyst Notes

• No ransomware attribution was publicly associated with this week's KEV additions at the time of publication.
• No confirmed threat actor attribution was available beyond CISA's confirmation of active exploitation for the majority of entries.
• Where vendor advisory details or EPSS values were unavailable at publication time, placeholders were retained pending analyst validation and vendor updates prior to final publication.